The following content is provided under a Creative
Commons license.
Your support will help MIT OpenCourseWare
continue to offer high quality educational resources for free.
To make a donation or to view additional materials
from hundreds of MIT courses, visit MIT OpenCourseWare
at ocw.mit.edu.
GARY GENSLER: I just want to say how
touched I am that you are all still here.
I really-- you know, there's a lot of shopping opportunities
in the MIT courses.
And that you have come back and not shaken
loose after reading Satoshi Nakamoto's
peer-to-peer Bitcoin paper, or maybe you just came back
to see whether I was going to crash and burn describing it.
But what we're going to try to do in the next three classes,
just to frame it, is really give you
some of the technical underpinnings
of blockchain technology through the lens of Bitcoin.
Bitcoin is just the first use case of blockchain technology.
So if I often say Bitcoin this or Bitcoin that,
it's really largely--
not entirely-- largely applicable
to blockchain technology.
My feeling is I'm only about eight or nine months ahead
of all of you.
I may have spent my whole professional life
around finance and public service,
and I can talk a lot about markets and about
public policy, but MIT has given me
the gift of thinking about blockchain technology.
And I'm trying to return that gift a little bit for you all.
And I have a few computer scientists
in the room that are going to bail me out
if I don't get this right.
Sabrina, and then, oh, I see Alin is putting up his--
do you all know Alin?
He's actually a PhD student at MIT, computer science.
So somebody gets to that part of their life--
AUDIENCE: Terrible life choice.
GARY GENSLER: Yeah, yeah.
What was that?
AUDIENCE: Terrible life choice.
GARY GENSLER: Terrible life choice.
Yeah.
But he's going to bail us all out.
But the reason that I think it's relevant not to just belabor
it, is I really believe the only way that any of us
can get to ground truths is to know a little bit about how
the inner workings of this technology are.
You're not going to have to do an algorithm
or actually do a hash function, but to know underneath it.
And then you can step away and say
I no longer need to know how the carburetor on the car works,
but I know what a carburetor is.
Or, you know, whatever analogy you want.
So with that little bit, as opposed
to sort of all of that Socratic cold calling
that I did last class, because money,
Fiat currency is something at the core,
and ledgers is at the core of a Sloan student's
either education or background, this a little less of the core.
If today's and the next couple of lectures,
if you can work with me then I want you to interrupt me
anytime you've got a question.
I'm not going to do much cold calling.
I don't want you to relax too much.
I still want you to do the readings the next three
classes.
But just raise your hand, stop me, say, well,
but what is that all about.
And that just sort of we can work
a little bit different on these next classes.
So, as I'm always going to be doing, consistency.
What are the study questions?
So really, what are the design features?
What are the key design features of this new technology,
blockchain.
And I put a few on the syllabus.
And we're going to go through all this today and next week.
Cryptography, append-only, timestamps
blocks, distributed consensus algorithms, and networking.
I list four.
Later in this lecture, you'll see 8 or 10 that--
I guess it's 10 that we're going to really dig dig into.
Can I just get a sense of the class and this
is not for Talita or Sabrina to write down
notes about participation.
Is it a decent assumption, did most or all of you
at least read Nakamoto's paper?
All right.
Good.
All right, great.
Just a sense, how many of you felt you got at least half
of it, maybe less than 2/3, but at least half of it?
All right, pretty good.
When I first read it, I was right with you.
So it's all right.
Alin you got more than half of it, right?
AUDIENCE: I read it five years ago, so.
GARY GENSLER: You read it five years ago.
Yeah, yeah, yeah.
Yeah, life choices, talk about it.
All right.
And you're taking this class.
Good, good.
So we'll go through each of those.
And then more specifically, we're
going to peel back the cryptography.
The two main cryptographic algorithms, or these words
that you'll hear sometimes, cryptographic primitives--
Alin, what is a cryptographic primitive?
AUDIENCE: Oh, it's a wild beasts.
There are so many of them.
GARY GENSLER: Yeah, but what's the two words together mean?
AUDIENCE: Well, that's I'm saying.
It could be anything.
It could be a hash function, could be encryption function,
could be a very powerful computation scheme,
it could be a data outsourcing scheme, could be a data access
privacy access.
GARY GENSLER: But it's anything that
basically protects the communication
in the presence of adversaries.
AUDIENCE: Well it's also something
that you can use to prove that computation was done correctly
on trusted servers.
It's not just communication, it's also computation.
GARY GENSLER: So communications and computation
that needs to be protected or verified,
have some form of cryptographic algorithm,
which happens to be called a cryptographic primitive.
The two main ones--
and there's a third one we'll talk about later
in the semester-- but the two main ones, hash functions,
just as a working knowledge of blockchain is worthy to know,
and we're going to get-- everybody's going to get there.
We're going to all get there to where
you have some sense of what a hash function is.
And then this whole concept of digital signatures,
which relates to asymmetric cryptography.
Those two are very fundamental to blockchain technology.
Later in the semester, we'll talk a little bit
about zero knowledge proofs, but they're not
as fundamental to the first application.
And so that's why they're kind of--
and they help make things verifiable and immutable.
And that's the business side, the market side.
Why does it matter?
Otherwise, like, who cares what's in the carburetor
if it doesn't matter?
And then how does this all relate to the double
spend problem?
I can cold call on this.
Isabella, do you remember what the double spending
problem was from?
AUDIENCE: It was when they would use the same coin,
I guess, and they would use it multiple places
and other digital wallets [INAUDIBLE]..
GARY GENSLER: All right.
So in essence, a double spend is when
you have a piece of information and you use it twice.
And we happen to call this piece of information "money,"
but you use it twice.
You can send an email to two people and that's OK.
I mean, it's a little embarrassing
if you're sending it to one friend telling them
you're available for dinner and the other friend
thought you told them you weren't available.
But you can still send it to two places.
But in the system of money, it's a critical thing
that you don't use it twice.
The readings, was the demo helpful?
I mean, we're going to do a lot more on that.
I watched that demo last November, December.
That was one of the first things I watched.
From an MIT student.
I don't know if you knew Bosworth.
And I found it very helpful, so I'm glad.
And I see it's actually that demo is on a Stanford
blockchain course as well, so the West Coast, one
of our competitors is using an MIT product.
And so we're going to just do a slight review of what
we did in class 2.
And then we're going to talk about the key design
features, hash functions, as I mentioned,
what is an append-only log, block headers and Merkle trees,
and asymmetric cryptography and digital signatures.
Crazy.
We're going to cover all five of those today.
And then you're going to tell me how we did.
Oh, Bitcoin addresses, which is just a small thing.
Six, actually.
So last time, for those of you that weren't with us,
we talked about money.
And again, money is just a social construct,
or an economic consensus mechanism.
We're going to talk a lot about consensus
next Tuesday when we talk about the consensus
protocol on Bitcoin.
But remember, money itself is just a consensus.
There was a question on Tuesday, I
think Alin actually had asked this question
about well, what does it mean to be
a liability in the central bank?
Why is money, what does that actually mean?
And I said it just means that somebody else will accept it.
It's a social consensus because it's not
that they're going to give you anything else.
It's just that you can get a bank deposit,
you can pay your taxes, you can use it at Starbucks,
if in fact, you've already gotten a cup of coffee.
If you remember, it's only legal tender for a debt.
And so forth.
Fiat money is just in that long line.
But it's had its challenges and instabilities.
It doesn't mean it's going to go away.
I'm not a Bitcoin maximalist who thinks that Fiat currencies are
going to go away.
But Fiat currencies have their instabilities, particularly
around weak monetary policy.
In essence, when you debase a currency and allow a lot of it
to be issued, or usually around unstable fiscal policy.
So either the government is spending a lot,
the King is off to foreign wars, and the Bank of England
was actually set up in the late 17th century in essence
to control the currency when the King was--
of England, I think--
was in wars with France, if I can recall.
A lot of banks, central banks, were set up right
about when a sovereign was off debasing a currency
and spending too much at war.
Ledgers, we talked about ledgers,
how critical ledgers are.
In essence, ledgers are a way to keep records.
And those records could either be transaction records
or balance records.
We'll see that Bitcoin is set up as a transaction ledger system.
Later we're going to be talking about other blockchain
technologies that are set up as balance ledgers.
So one should not just think immutability
that there's only one way to do this.
But transactions and ledgers are at the core of Bitcoin.
And central banking is of course, built on ledgers.
The master ledger of the central bank, and then
the commercial banks have sort of the sub-ledgers.
And then you can think sometimes your digital wallet,
maybe Starbucks has yet a third tier ledger.
We obviously live in an electronic age already.
We know this.
There's been many efforts, they've
all died until Bitcoin to crack that riddle
that we talked about, peer-to-peer money
without a central authority.
And later in the semester when we
talk about what are the use cases,
that's going to be the core thing.
It's why I'm not a maximalist.
I'm not sure in every circumstance
a central intermediary isn't necessarily so bad.
And this is not a value judgment.
It's just pure money and markets and so forth.
But in some circumstances, decentralization really
will compete and beat the centralized intermediary.
So let's talk about his little paper, which of course he
was modest, or she was modest.
Please remind me, we don't know who Nakamoto is or was,
or a group of people.
"I've been working on a new electronic cash
system that's fully peer-to-peer with no trusted third party."
So you've seen this slide before.
But a time stamped append-only log.
Just think blocks of data.
To kind of oversimplify, but it's got a name, blockchain.
And I don't think-- did Satoshi's paper,
you all read it in the last few days, I of course
read it again yesterday just to make sure I remembered it,
I don't remember that he ever used the word blockchain.
Am I right about that?
Right.
So the words blockchain are really--
have been sort of layered over his innovation.
So information, blocks going on.
And that leads to basically a database.
But it's the blocks of data.
Bitcoin right now is about 550,000 blocks,
and the blocks are added on average every 10 minutes.
And we'll talk about why it's every 10 minutes, and not
only why Satoshi Nakamoto made it every 10 minutes
but how they maintain that.
Other blockchains like Ethereum it's about every seven seconds.
So don't get too caught up that it's all the same.
And there's some technologists, here Silvio Micali
is working on Algorand and that's even tighter,
less than seven seconds.
So there's not one way.
There's multiple designs on how often blocks are added.
But let's start with Bitcoin.
Secured by yes, guess what, those two
cryptographic primitives, hash functions
and digital signatures.
Lose anybody yet?
Yeah?
Maybe.
And then there's a consensus for agreement.
The whole debate usually about databases
is who gets to change the data.
And this is true in all databases.
In its essence, it's usually centralized.
But in blockchain, it's all a sudden, well, maybe it's
not centralized.
Who gets to add that next bit of information, that next block?
And the consensus agreement is--
which we'll discuss next Tuesday--
is about that very issue.
And I think there was a little pretty picture
of that done in slides before.
But I'm going to I'm going to delay that discussion
until next Tuesday.
And hopefully you'll all come back.
So what are the key features?
And I might do a little cold calling.
Do you remember any key feature, Tom?
From the papers?
AUDIENCE: Oh, boy.
GARY GENSLER: It's all right.
AUDIENCE: Yeah.
You know, the hash function.
GARY GENSLER: Hash function.
Any other key features?
Let's see how many.
I'm going to have 10 on this page.
AUDIENCE: A private and a public key.
GARY GENSLER: What is that?
AUDIENCE: Private and public keys.
Private and public--
GARY GENSLER: Oh, private and public key.
Yes.
So asymmetric cryptography, or private and public keying.
Yes, hash functions, yes, private and public key.
Any other kind of key design features,
or words you didn't understand?
Maybe that's another way to put it.
Leandro.
AUDIENCE: Addresses.
GARY GENSLER: What's that?
AUDIENCE: Addresses.
GARY GENSLER: Bitcoin addresses.
Three.
AUDIENCE: Timestamp server.
GARY GENSLER: Timestamp server.
That's four of the things.
This is going well.
[INAUDIBLE]
AUDIENCE: Double payments.
GARY GENSLER: Double payment is something
that it's trying to address.
It's not really a design feature,
but it's a-- they have a solution for double payment,
so I'll give you a credit for it.
But it's--
AUDIENCE: Miners.
GARY GENSLER: All right.
So Hugo says miners, which is really the consensus.
So I'll say that the design feature is
the consensus or proof of work.
Kelly.
AUDIENCE: The full node versus the lightweight node.
GARY GENSLER: Right.
So very interesting, this concept of nodes.
And Satoshi actually talks about full nodes
or lightweight nodes.
In essence, how much information has to be stored.
I want to reserve that.
Kelly, please remind me when we talk about block
headers to come back to that.
But nodes in the network is a very important design feature.
Over here.
AUDIENCE: The Merkle tree structure.
The Merkle tree structure.
GARY GENSLER: Merkle tree structure.
So Merkle tree structure is a way to compress a lot of data,
and also to sort through that data.
Uh-oh.
No, Sabrina's not going to clean me out here.
Merkle tree structure is there.
We're going to talk about that.
Two more.
AUDIENCE: Nonce.
GARY GENSLER: What's that?
The
AUDIENCE: Nonce.
GARY GENSLER: Nodes.
All right.
What's that?
AUDIENCE: Nonce.
GARY GENSLER: Nonce.
The nonce.
OK.
So a nonce.
Anybody know what the word nonce is?
A year ago I didn't.
So this-- so we're all getting there.
What, do I have a look, do you know what a nonce is?
Yeah.
AUDIENCE: In the actual protocol,
it's essentially a guess for the miners to kind of--
GARY GENSLER: So the word "nonce"
means a random number that is used once.
N for number, and "once."
It's a number that's random and it's used once.
That's how I've learned it.
Whew.
And so one more, because this is great, actually.
AUDIENCE: Peer-to-peer.
GARY GENSLER: Remind me your first name.
AUDIENCE: Pria.
GARY GENSLER: Pria.
Peer-to-peer.
All right.
So this is what I have.
Cryptographic hash functions.
We're going to go through these in more detail.
Timestamped append-only logs, block headers and Merkle trees.
So Merkle trees were discussed.
But we need to actually say what information
is kept at the head of the block as opposed to all the body.
And some of that's just to make it more manageable.
Asymmetric cryptography, which is this public key,
private key, and signatures.
The Bitcoin addresses themselves,
which interestingly are a little bit different than public keys.
And then I breach break because in the next,
we're going to talk about next Tuesday, the proof of work,
the miners, the then the nodes, the nonces, they're
are all in that little topic.
There's actually in Bitcoin a really important protocol
is how information gets propagated on the internet.
Just the network communication.
It's not written about a lot.
You won't read a lot about it in Nathaniel Popper's Digital
Gold or all the other popular books,
but it is an important thing to remind ourselves
that information has to propagate around the internet
and all these transactions have to communicate with each other.
There's currently about 10,000 nodes on the Bitcoin network.
We don't know where all of them are,
but they're probably in 180 different countries.
And so it's just--
also the networking and communication matters.
And it matters to the economics a lot.
There's a native currency.
This is interesting that it was the one thing that no one said.
That's an actual technological design feature.
It's not only that he created a currency,
but the native currency is part of the economic incentive
system.
And we'll have some fun with that.
In essence, he said that when you
mine and did the proof of work, you created
and you've got some native currency called Bitcoin.
So he created an economic incentive system.
Whomever Satoshi Nakamoto was or is
knew a lot about economics, as well as technology.
Yes.
AUDIENCE: I just wanted to quickly add to what you said.
So it's not only that he created this native currency,
but wants the finite supply has reached, the currency can
be distributed as a transaction fee,
which I think is very important in [INAUDIBLE]..
GARY GENSLER: And remind me your first name?
AUDIENCE: Daniel.
GARY GENSLER: So what Daniel just said
is really interesting.
Not only to take light of this individual or individuals
that did this.
But this world of Bitcoin and other cryptocurrencies
creates a unit of account that could be valued.
And once it's valued, you have sort of a native currency.
But as Daniel said, Nakamoto also
said there would be a finite limit.
It happens to be 21 million Bitcoin
is the most that it can be, and we'll
get there around the year 2040.
Does anyone know how many Bitcoin there are right now?
About half of you were investing in it.
Hugh?
Hugo?
About 17 million Bitcoin right now.
And all 17 million have come from this process
of proof of work and mining.
Initially it was 50 Bitcoin every 10 minutes,
roughly every 10 minutes.
Then it went down to 25, and we're now
at 12 and a half Bitcoin.
And does anyone know what today's value purported--
I always should say purported value of Bitcoin,
because I don't know if we can trust
some of those websites that say with the values are.
What is it?
AUDIENCE: $6,500.
GARY GENSLER: So $6,500 of Bitcoin
at 12 and a half Bitcoin to mine a block.
So you see that it's about $80,000
US is the reward to mine a block, right?
So he created an incentive system
that initially, if you got 50 Bitcoin and they
weren't worth a penny, you would not commit that much.
You had to be a hobbyist, basically, in 2009,
or a cyberpunk, or just kind of curious.
Because you weren't getting much incentive.
If in fact it's worth 6,500 today,
you're getting $80,000 if you actually successfully mine
a block.
And then there's the transaction inputs and outputs.
Think about a check, who signs it, where you move money.
There's something called the unspent transaction ledger.
So this is the ledger part.
So when you think--
I think of the technology, I think
of cryptography, which is kind of all
that stuff at the top which we're going to discuss today.
Secondly, the consensus mechanism.
In essence, that's that key question
of any database, who gets to amend the database?
Who gets to decide to change the state of what we all agreed to?
And then thirdly, is the ledger, or the transaction ledger,
which we're not going to deep dive
into the scripting language, but we
are next Thursday going to talk a little bit
about the underlying scripting.
Does that give you a path that's all this cryptography,
the consensus, and then the transactions.
Yes.
AUDIENCE: I have a question.
GARY GENSLER: And your first name?
If everybody just says first name.
AUDIENCE: Oh.
I'm just curious, so you mentioned that--
GARY GENSLER: I'm curious about your first name.
AUDIENCE: Sean.
GARY GENSLER: All right.
AUDIENCE: So just curious, you mentioned
that the block value is roughly $80,000 US as of now.
So just curious, in terms of the CPU power,
the electricity that will be consumed to mine the block,
how much does that translate to equivalent US dollar terms?
GARY GENSLER: So the question that's asked
is how much electricity is being consumed for that miner
to get that reward, that $80,000.
And I'm going to try to answer in one minute.
But we'll come back to this later in the semester about
economics, and blockchain economics, and mining
economics.
But what has happened over these 10 years
is more and more computers are being used,
or are trying to mine for the Bitcoin.
And so today in the most recent research I've seen
is that the probability of winning a block--
there's so much-- is it measured in terahashes?
I can't remember the numbers.
But it's how many terahashes, which, is it 15 zeros
Is a terahash?
Is it that, or is it 12?
Well, in any event, there's so many hashes
being done a second, x number of terahashes,
that your probability of winning is quite low.
And so what's happened is most nodes and miners
have entered into agreements called mining pools, where
they smooth out the risk and everybody
shares in the rewards.
But those economics we'll talk about later,
it's thought to be that you need electricity
cost around $0.03 a kilowatt hour to be successful.
And in most parts of the world you
can't get electricity for $0.03 a kilowatt hour.
So you would put your mining rigs
where you can get low cost electricity
or where you possibly can--
you can get it legally low cost or illegally low cost.
So there are a lot of mining rigs
and in jurisdictions where there may be local officials that
are allowing those mining rigs, and instead
of $0.03 a kilowatt hour to the electric company
it's $0.01 to $0.02 cents a kilowatt hour
to the local government officials.
And the two largest mining pools are in China.
And the third is in Russia.
But we'll get into the sort of economics
and at least some theories about why some are where they are.
So cryptography.
So Alin's probably going to clean me up.
It's not just communication in the presence of adversaries,
it's also computation in the presence of adversaries.
That would be good.
And we talked about-- we're not going to deep dive.
If you remember, even in ancient times if you were going to war
there was this wonderful little way
that you could do cryptography.
And then anybody who's seen imitation games
about the British breaking into the German codes,
even though they should have probably
given more credit to the Polish government that had probably
broken into it in the 1930s, but Turing did great work.
And then we're going to talk about asymmetric cryptography
today.
All right.
What is a hash function?
A hash function, and these are just words that I think of it,
I think of it as a fingerprint for data.
But it has certain properties.
The one that you'll see throughout
is that it takes inputs of input x.
It maps that input of any size to a fixed size.
So one that we use here in the US,
one hash function we all use is zip codes, in a way.
It's five digits, it's a fixed size.
I know I'm doing this as a loose hand, how can I think of it.
But zip codes.
You might have 50,000 people or 5,000 people all living
in one postal district.
And you can map them to zip codes, and it's a fixed let.
Now, I don't know whether my friends in the computer science
departments-- but it's an early sense of a hash function.
I just wanted to say there are tangible things in our life
that act like hash functions.
Problem with zip codes is it will not in any way
be a secure hash function.
And you'll see that in a minute.
But it does take--
you can be a 300-pound person or a 30-pound kid
and you still map into the same zip code.
It's deterministic.
It's always the same.
So if you take a certain set of data,
it will always give you the same hash.
And that's relevant to the background.
And you can efficiently compute it.
You don't want to take a year to do this.
You've got to do it in short periods of time.
And in Bitcoin's case, it's done in nanoseconds
or less, because they're one computer, one CPU can do--
can't remember, probably-- how many millions a second?
AUDIENCE: Couple of terahashes a second.
GARY GENSLER: Couple of terahashes a second.
So it's a remarkably efficient algorithm.
And so a bunch of mathematicians-- and hashing
started in the 1950s and '60s, but the ones
that we're talking about here are much more recent.
But it's really terrifically talented
scientists, mathematicians, computer scientists,
and sometimes the National Institute Standards
of Technology here in the US working on hash functions.
So it takes a array of any size, puts it into a fixed number--
I think zip codes for a minute--
it's deterministic.
It's always-- you only live in one zip code, in a sense.
And it's very efficient.
But now what are its cryptographic properties?
Because a zip code wouldn't make it.
It just wouldn't.
Well, the computer scientists use
this term preimage resistant.
I would just say it's one way, you
can only go one way, meaning it's infeasible to determine
the input from the output.
It's infeasible to determine the x from the hash of x.
Does anybody know why I use the word infeasible rather than
impossible?
AUDIENCE: [INAUDIBLE]
GARY GENSLER: First name?
AUDIENCE: Brotish.
GARY GENSLER: Brotish
AUDIENCE: Because we can do it with brute force.
GARY GENSLER: So you might be able to use it brute force.
What do you mean by brute force, just so everybody--
AUDIENCE: Try all the options.
GARY GENSLER: Try all options.
But as I understand it, a sort of tenet of cryptography
for centuries is not to have it mathematically impossible,
the point is getting it so infeasible
that your adversary can't either get the communication
or so forth.
So hash functions, I just say this
because you can't assume that Bitcoin can't be broken.
We all call it immutable.
It is immutable.
Until the hash functions that are inside of Bitcoin
might be broken.
And even Satoshi wrote about this in 2010.
He got emails.
There's this wonderful book if any of you
want that I mentioned in the bookshelf at the end
of the syllabus, he said, well what if a SHA-256, which is
the hash function, gets broken?
And his answer, by the way, was well,
there will be a better hash function at that time.
Whatever that is, we'll hash the entire system,
whatever that is.
Because remember, you can take something of any size,
hash it with a new system, and move forward.
And so he or she felt in this wonderful email
is that Bitcoin actually could transition to a new hash
function as long as you had a little bit of time
before it was all corrupted.
Kelly.
AUDIENCE: Is this what his article called the Gambler's
Ruin problem?
Is that we you're describing?
GARY GENSLER: The Gambler's Ruin problem.
AUDIENCE: The probability that an attacker could catch up
to recreating it.
GARY GENSLER: OK.
AUDIENCE: That's something else.
That's--
GARY GENSLER: Will you speak a little louder?
AUDIENCE: Yeah.
So that's the-- you want to sort of assess
how hard it is to fork Bitcoin.
If I have a lot of computational power,
how hard is it for me to create a fork?
And Satoshi does an analysis at the end of the paper--
GARY GENSLER: Oh, I apologize.
You're talking about in his paper.
Yes.
In his paper, he's talking about how hard
it is computationally to do what some people call
a 51% attack, to basically take over all the nodes.
And that part of his paper we're going
to talk about next Tuesday.
But it's basically, can you take over the nodes?
I was talking about a separate thing,
can you break the cryptography.
And he doesn't write about that in his paper.
He writes about it in an email about 10 months later or so.
Second key cryptographic thing.
So we said one is it's one way.
The other thing is this concept of collision resistant.
I presume if everybody in this room told me your birthdays,
there's multiple people in this room
who have the same birthday.
And in fact, if we got it past 26 people in a room
it's over 50% chance that two of you have the same birthday.
We don't need to get to 183 people in the room, which is
half of the days of the year.
We can get to about 26 or 7.
And similarly, the key thing is is that two sets of data are--
it's again, infeasible that x and y would
hash to the same thing.
It's not impossible.
It's infeasible.
And if you look at the history of hash functions,
this is usually the thing, that at some point in time
these hash functions will not be collision resistant.
Some quantum computing will come along,
or something will come along.
But for now you can put something of any size in
and they're independent.
They also look terribly random.
It's called an avalanche effect, meaning
you change one little difference and the whole thing
looks different.
So when you noticed on that little video,
if you changed one thing, it all looked so different.
And why that's important is it makes it more secure.
And then there's something called puzzle friendliness.
Even if you know a little bit of the input,
it doesn't mean that you're going to get the output.
I put these up here not for you to know them.
You're not going to get tested.
If you go into business, as Elon,
you've started, when you probably haven't thought,
well, collision resistant this or that.
But I just wanted you to know there
is a bunch of cryptography underneath this.
And the key is it is not 100% immutable.
It's probably one in, you know, I don't know,
a quadrillion immutable.
But there's still-- these things could be broken.
And quantum computing and something else might--
Alin.
AUDIENCE: The actual probability should be actually 1 over 2
to the power of 128.
So much more than one quadrillion.
GARY GENSLER: So it's 1 over 10 to about the 40th.
How'd I do?
My math all right?
All right.
And anybody who's interested can come to office hours.
So it's highly unlikely to be broken.
But I think it's always worthwhile to say, well,
no, there's some outward--
it's not as bounded as you think.
So what is it used for?
In many places it's used for names, and references,
and pointers, and in something called commitments.
In Bitcoin, it's used for pointers because one block
points to another block.
But it's also used in commitments.
You'll hear these words.
We're not going to delve into them.
But the headers and the Merkle trees use something
called SHA 256, which is a standard which
is literally 256 bits long.
That's like zeros and ones for 256 registries.
But a Bitcoin address actually--
Satoshi Nakamoto threw on a loop.
I'm glad to debate why, but he uses two hash functions
for Bitcoin addresses.
The one thing I saw that he actually
wrote about it is he said if one of them
is broken at least the other one is less likely to be broken.
So as I've read about it, I think
in his own voice is you have to hash something twice.
And he was just making it that much more secure,
even knowing it was one out of 10 to the 40th chance.
AUDIENCE: Which is astronomically low, so.
GARY GENSLER: Right.
So.
So remember, where's Caroline?
I remember-- there we are.
You asked me about, I thought I had set it
up for today, which you were good to remind me
for Tuesday, what's the longest running hash,
time stamped hash?
AUDIENCE: That is a great question.
GARY GENSLER: Thank you for the compliment.
AUDIENCE: The answer is--
yeah, I don't know that phonetically,
so I'm not sure if I'm totally butchering this one.
But it came out of Bell Labs with Stuart Haber and Surety.
GARY GENSLER: There he is.
Yeah.
So Haber and his colleague-- yes.
You got it.
AUDIENCE: That's my roommate.
GARY GENSLER: That's you roommate.
Terrific.
So I'm just trying to say it wasn't Bitcoin that had it.
He did this in 1991.
But by 1995, they started a company called Surety.
I don't think it took off that much.
It's not competing with Apple for the largest market cap
or anything like that or Facebook.
But every week in the notices section,
you can see a hash literally.
It's time stamped because it's in the New York Times.
And it's a hash, all those funky digits and everything
of all the information came before it.
And they're basically hashing any document.
Any document that you want a timestamp in that week,
you put it in.
One follows another, and that's a blockchain.
It's not about money.
There's no native currency and so forth.
I believe that Haber and Stornetta
are three of the eight or nine footnotes in the Satoshi paper.
Maybe it's four of them.
So he gets his credit.
And if you go to his website, Stuart Haber,
I think he says, blockchain's co-founder
on his personal website.
Who knew?
So here, we get-- this was in the National
Institute, the NIST paper.
But timestamp append-only logs in Bitcoin or blockchain.
What is put together is the header, the top information.
And if I can go past the visual and just say, what's there?
There's five pieces of key information.
The version, it doesn't change that often.
But there is a version number.
The previous block's hash, so it's
some information about all the blocks that came before it.
The Merkle Root hash, which does anybody want to tell me what
that does, the Merkle Root?
AUDIENCE: So it essentially posts the transactions
in the bottom most layer of the tree
and then creates the [INAUDIBLE] hash
of each of the transactions.
GARY GENSLER: So if I go back to this nice little picture,
the yellow box at the bottom up each of these blocks
is all the transactions.
There could be upwards to 1,000, 2,000 transactions in a block.
So there's blockchain concept, 1,000, 2,000.
There's means and methods well before Nakamoto's paper
about how to compress that, how to keep that information
a little bit tidier.
And that uses this thing called Merkle Roots.
The five items right at the top, what's called the block header,
doesn't have the 1,000 transactions.
And earlier, Kelly, you had asked me
about full nodes and light nodes.
A light node or a wallet that anyone here
could download on your cell phone
probably does not download the millions
of transactions that have happened
in the history of Bitcoin.
You are unlikely to download what's called a full node.
But you might download all the headers,
this bit of information that's all of the headers.
All of the information in Bitcoin
is still not that large.
It's less than 200 gigs.
But all of the headers, I think, is single digit gigs.
I can't remember if it's four or six gigabytes right now.
What is the number?
AUDIENCE: The header is 80 bytes.
So it's 80 bytes times 500,000, which
is 50 megabytes, 60 megabytes of headers.
GARY GENSLER: So it's 60 megabytes,
so it's much smaller as opposed to like 180 gig.
So Satoshi was thinking in advance.
And every blockchain that you're going to work on,
likely, I mean, there might be some, this concept of it's
really keeping the security by a little bit of information
in something called a header and then pushing
all the meat of the transaction and data down.
And this is really important when
you get to like Ethereum where there's
a lot of data, a lot of computation
down in each of these blocks.
It's sort of like if Stuart Haber
had a lot of documents and pictures and everything.
You don't have to have all the picture
quality and a whole movie.
You can actually hash a whole movie,
and you still get these 256 bits.
So whoops.
So the header has the previous hash, this Merkle Root,
which is just a way to get all the transactions.
Just think of a Merkle Root as a way to grab
2,000 transactions in a way.
A timestamp, that one's easy.
We can get that.
Difficulty target, anybody know what blockchain,
Bitcoin tried to do to make it more
or less difficult over time?
No.
Brodish, we've heard.
AUDIENCE: [INAUDIBLE] time but such
that it stays with creating a block every 10 minutes.
So with more computational power,
it gets harder to find a block.
GARY GENSLER: So it's harder to find a block,
the more miners there are.
So every block header needs to have some what's
called a difficulty target.
How difficult is the mining going to be?
Since we're talking about mining next Tuesday,
these all bring me back to difficulty target.
And then what's a nonce?
AUDIENCE: [INAUDIBLE]
GARY GENSLER: What's that?
AUDIENCE: Just a random number.
GARY GENSLER: A random number that's used one.
Number once, nonce.
And that's hash functions.
How'd we do?
We're a little off the skids.
We are MIT.
Yes?
AUDIENCE: I have a question.
The number of characters in the hash is equal to your--
GARY GENSLER: The output, not the input.
AUDIENCE: No.
No.
They put the number of characters in the hash
is limited, right?
So that's a pool of functions that you have.
When you have many, many transactions,
that's like a flow, right?
So internally, you're just consuming and consuming hashes
up to a point where you're going going to repeat that hash,
right?
So how do you know for the same has,
you have two different information,
to which information you're referring to?
GARY GENSLER: So could you help me pronounce your first name?
AUDIENCE: Diermo.
GARY GENSLER: Diermo, has asked the right question.
He's say, well, how do you know?
Especially as you have more and more time and more and more
time, you might get the same output of a hash
from different inputs.
And if you recall--
wait.
Somebody does recall.
Now before Brodish, in front of Brodish.
AUDIENCE: The papers mentioned that it's
possible that two the hash of x equal to hash of y.
But if the miners are working at the same time,
if the same information are not treated at the same exact time,
it won't be a problem because then they just continue just
like two different--
GARY GENSLER: So you're correct as it relates to mining.
But there is another piece of it as well
is that the hash function, if it's
a good cryptographic secure hash function,
is what's called collision resistant where what you're
saying is so infeasible, in fact,
1 divided by 10 to the 40th, that's a 1 with 40 zeroes
after it.
It's so infeasible to happen, it's possible but infeasible
to happen.
What you're referencing is what if two parties
solve the cryptographic puzzle as opposed to a collision.
And because of the difficulty, they just got at the same time.
Please.
AUDIENCE: It seems like a dumb question but--
GARY GENSLER: No.
There's no dumb questions when it comes to this.
I really mean that.
AUDIENCE: The timestamps attributed, so is it
from the whole system or?
GARY GENSLER: So timestamps are not a particularly important
part of Bitcoin.
They are timestamped.
But sometimes if somebody puts something off
and it's off by a few minutes or even up to two hours,
there's a check in the technology
in the scripting function if the timestamp's off
more than a couple hours.
So literally, it's not that precise.
Having said that, the real way that timestamping happens is
if a block is mined and it's the 540,000th block and it's sort
of accepted in all the nodes, these 10,000 nodes start mining
the 540,000 and 1st block, in essence,
it's just think of it as almost like a stack.
And so what's, in essence, more relevant than the actual time
that's in the header, and they all
have a timestamp in the header, but what's
more relevant is the order of the blocks,
and, most importantly, the previous block hash.
Yes?
AUDIENCE: I would say that without the timestamps,
you cannot do this difficulty readjustment.
The timestamps are very important.
If you don't have timestamps on the block,
you cannot do the difficulty readjustment,
which is necessary to keep the rate of blocks 10 minutes after
[INAUDIBLE].
GARY GENSLER: I'm going to partially agree
with you because the difficulty adjustment happens every two
weeks.
So even if any one individual or five or six timestamps
are a little goofed up in the two weeks,
the algorithm is basically looking over the course
of about 2,000 blocks.
AUDIENCE: Yeah.
So a little goofed up is fine.
But you need the timestamp.
GARY GENSLER: You need the timestamps.
But it's more important is basically the--
here, I'll go back a slide.
It's the order of the blocks.
Please.
AUDIENCE: Going back to when we talked about collisions.
The paper didn't really go into detail,
but it said like in addition to how unlikely
it is with to the power of 128 that even if there were two
that hashed to the same kind of has digest
that it would be unlikely that they'd
both be valid in the context.
So given what's a valid blockchain transaction
that that could even further reduce
the likelihood of any problems, which there
wasn't a lot of detail as to why the blockchain context would
even make two hashes of the same value even more unlikely
because of the context.
GARY GENSLER: I want to hold that question for Tuesday.
But it has to do with rather than the collision issue, what
the paper is talking about is if two miners solve the puzzle.
And that doesn't mean that they got identical hashes
because the puzzle is not geared to getting an exact hash.
The Bitcoin puzzle is having a certain number
of leading zeros.
So it's literally started, I think,
it was nine or 10 leading zeros.
I'm talking about 10 years ago.
And now, you have to hash to something with, I think,
it's about 20 or 26 leading zeros.
Meaning it's gotten more and more difficult,
and the result of the hash has to have
a bunch of leading zeros, what you saw in that video.
I'm sorry.
AUDIENCE: I have a question on how the hash, the [INAUDIBLE]
hash comes about.
So if it's only hashing the transactions,
how does it change when the hash of the previous block changes?
GARY GENSLER: OK, so, Addy.
It reminds me of that old television
show with Johnny Carson.
And you just did a great setup for the comedian.
So thank you.
So I'm going to go to Merkle Roots.
So Merkle Roots, which are a binary data tree,
looks something like this.
If one had 1,000 transactions, I wouldn't have a pretty slide.
So this only goes to four levels.
But think of four transactions at the bottom.
They're each hashed.
And then you concatenate.
You put the two hashes together.
You hash that.
You keep going up the tray.
If you had 1,000 transactions, because that's 2 to the 10th
roughly, then you'd have 10 levels of this tray.
And so that's what happens.
And literally, the mining pull operators are doing this a lot
for the nodes.
But in the Bitcoin core application,
in software that anybody in this room
could download the software if you wished.
There is software that helps, takes transactions, puts them
basically into this binary tree called a Merkle tree,
uses hash functions, and basically skinnies it
all the way up to the top.
Does that--
AUDIENCE: I think what my question was
that given that this structure exists,
how does the root hash change with the previous block?
So basically, we saw that if you change
the hash of the previous block, all the blocks forward
will get invalidated because the hash changes.
But it doesn't seem to use the previous hash.
GARY GENSLER: So I'm going to repeat the question.
Does the Merkle Root that is basically
a summary of the 10,000 transactions
that are in a block change if the rest of the header changes
or the previous block change?
And the answer is no.
It only changes if some of the data in the 10,000 transactions
change.
And so a Merkle Root will change if you
put different transactions in the mix
or, as is really important, one of the incentives.
You get your 12 and 1/2 bitcoins today
in what's called a Coinbase transaction.
And so one of these 1,000 transactions
is the payment to the miner.
So the Merkle Root would be different
depending upon who wins.
But that wasn't your question.
I'm just saying.
But Merkle Roots are a very efficient way
to take thousands of transactions,
store it up, have one spot.
Please.
AUDIENCE: So the order of the different transaction
has to be exactly the same for everyone that
is hashing, right?
GARY GENSLER: No, actually not.
So if you're hashing, and you're running a mining rig,
and Elon's running a mining rig, if Elon solves the puzzle
and propagates it out on the network,
and people start mining on top of Elon's block
because they say, well, he's finished.
You're not-- you're just going to probably start mining
on the top of his block and look in something called the mem
pull.
The memory pull is this network of all
the free floating transactions.
You'll scoop up the next set of transactions.
AUDIENCE: And so how can we validate
that all the transaction he wrote are the real ones?
GARY GENSLER: All right, so validation,
which is more next Thursday, but I'll give it a shot.
No, no, no.
It's a good question.
Every transaction-- or actually, you're setting me up,
digital signatures.
There you go.
Thank you.
Did you have a question or I'm going to on to digital.
So the second cryptographic thing,
and we're going to keep going back and forth,
hash functions are basically a way to compress a lot of data,
have a fingerprint, make sure that it's basically commitment.
Digital signatures, well, remember that little graph
that we had Alice and Bob?
Alice wants to send a note to Bob and just say, hello, Bob.
She wants to encrypt it.
She encrypts it with Bob's public key, sends it to him.
He decrypts it with his private key.
You might say, oh my god, Gensler, what's a private key?
What's a public key?
In cryptography, it's a way to kind of scramble information.
I know.
I'm really making this like--
So if we went back to that little mechanism
the Romans used or we used what the Germans used in the Enigma
machine, they were symmetric cryptography.
Both people had the key.
The key was the Enigma machine with five rotors.
In the 1970s, some wonderful technologist here and elsewhere
basically said, well, what if the key isn't the same?
Because the adversary could steal the key.
What if it's not symmetric but it's asymmetric?
There's a private key and a public key.
In essence, there's two keys that have
some mathematical relationship.
And the math between these two keys
don't matter for a class like this.
But know that the public key and the private key link together.
They're bonded together.
But the critical thing is about digital signatures,
there's three functions.
You have to generate a key pair.
And when a key pair is generated,
a public key and a private key are generated at the same time.
And they need a random number to go into it.
And one of the things that makes a lot
of Bitcoin and other wallets insecure,
and it's probably why some have been hacked,
the wallets, not Bitcoin, is because they don't have
good random number generation.
Yes, Brodish?
I saw-- I was at a conference last week
where a technologist from the University of Pennsylvania
had done a survey of 150 hedge funds, mining
companies, and Bitcoin wallet companies and the like.
So they actually let a cybersecurity individual
get inside and do a survey of 150 what you would consider
really committed, high end users of Bitcoin, miners
and hedge funds and crypto exchanges.
And it was horrifying, their cyber security
as to what they're doing with their private keys.
Before he even got to the private keys, many of them
didn't really have a secure way to create the random numbers
to create their private keys.
So it's just a piece.
When somebody says they have really good private key,
public key, in the back of your mind,
just know there's got to be some way to do a random number
generation.
That's the only math that I'm going
to ask you to remember of that.
There is a signature function.
And the key thing is a signature creates.
You can create a digital signature
from a message and a private key.
So if Kelly has a private key and wants
to send a secret message to somebody across the room--
Isabella, you want a message from Kelly?
Kelly's going to take the message.
You got this, Kelly?
You're going to take the message,
and you're going to sign it with a private key.
You send it over to Isabella.
How's Isabella know that it was from you?
AUDIENCE: She has to decrypt it with her key.
GARY GENSLER: She's got to verify it.
So there's a function called a verification function,
and it comes back just yes, no.
I mean, it might say it differently.
But it's just a yes, no.
It's a verification function.
Isabella-- you want to do this with me--
is going to verify your signature
is valid for this message because you
have the public key.
So you're right.
Isabella has your public key.
But using your public key, she can verify that the signature.
It's magical math.
Well, it's not magical math.
It's real math.
But it's not math we need to study in this class.
Yes, Hugo?
AUDIENCE: Back to generating the key pair.
GARY GENSLER: Yeah?
AUDIENCE: So they're both generated
from the random number?
One is not-- like the private is not
determined by the public key or the other way around?
GARY GENSLER: The public--
you can think of it--
in Bitcoin, it uses an elliptic curve cryptography.
And you can think of it as that the private key
is based on the random number.
To be more technical, the random number
is what gets you to the public key.
But I think of it as the private key
is almost the random number, and then the public key
is generated along with it.
AUDIENCE: So [INAUDIBLE].
GARY GENSLER: Yes.
AUDIENCE: So you pick a random number actually
between 0 and 256, that's your private key.
To pick a public key, you derive it
directly from the private key.
In fact, all you do is you exponentiate another number
by the private key.
So you can think of the public key
as a one way function of the private key.
So given a public key, you cannot recover the private key.
If you could, then you could sign, potentially disastrous.
GARY GENSLER: And instead of exponentiation, in Bitcoin,
it uses a function called the elliptic curve.
So what properties?
And these are the key economic properties as well as
cryptographic properties.
Basically, it's infeasible.
And again, I use the word infeasible.
I didn't say impossible, even though Eileen
might want to tell me that it's 1 over 10
to the 40th of something.
But it's infeasible to find a private key from a public key,
so reverse engineer.
AUDIENCE: So even if you can't find the private key,
like in the case of Kelly and Isabella,
if I knew Kelly's public key, could I
send a message to Isabella impersonating Kelly?
GARY GENSLER: No.
You need to do a signature--
if you please just run your eye up there.
To do a digital signature, you need
a private key and a message.
And it's a function of the message and the private key.
Let's call it complex math.
That digital signature was created from the private key.
And the public key was created from the private key.
And to oversimplify the reason that the verify function
works is because both the digital signature
and the public key that Isabella has--
Isabella has this digital signature,
and she has the public key, and she has the message.
The math is such that, basically,
the private key, if you wish, almost like factors out.
But think of two functions.
Isabella has Kelly's public key, the message,
the digital signature.
It either verifies or it doesn't.
But she never has to see the private key.
And in fact, Kelly does not want her
to ever see the private key.
AUDIENCE: Eric, maybe just to simplify
the way the validation of the digital signature works
is Kelly's message is run through a hash function which
generates a hash.
And it's encrypted with her private key.
Then the message encrypted and the digital signature
goes to Isabella.
Isabella, what she does is using the same hash function
to run it with the document to generate the hash function
and uses the public key of Kelly to unencrypt the signature
and compare those two hashes.
If those two hashes correspond that
means that the message belongs to Kelly
and it hasn't been tampered with.
So that's the more or less the simplification
of the digital signature process.
AUDIENCE: I don't know if--
GARY GENSLER: So I mean, the key is basically
that there's a scheme unrelated to Bitcoin
that exists for many other reasons on the internet,
many other reasons in commerce and at war
that this public key, private key cryptography.
And it's not simply just going back,
it's not just simply Alice sending something.
It's also digital signatures.
You generate the key pair.
Everything in Bitcoin, everything in Ethereum
has key pairs, public key and private key,
a digital signature.
But, Kelly, never lose your private key.
You got that?
Do not.
And by the way, you have to create it with a good random
number generator because most sophisticated hedge funds
around the world aren't.
So you're going to be better than those.
That's what I learned at a conference I was at recently.
And then there's a verification function.
AUDIENCE: A quick question about the random number generator
and the verification function.
So is there any third party generating
the generator or the generator is a function already existing
and already there?
GARY GENSLER: So the question is, if random number generation
is so important, are there outside parties that
have good software, in essence, to produce the random number
generation?
And the answer is yes, and there's
some that are not so good.
And yes, some good laptops have it.
At the heart, I want to skip ahead.
Elliptic curve digital signature algorithm,
that's the actual algorithm that Bitcoin uses to take
the private key and so forth.
But many of the wallets, if you download a wallet application
to hold your Bitcoin, to hold your Litecoin,
to hold some other coin, that wallet application
has a random number generation software.
I can't attest to all the random number generation software.
I'm not a cyber security expert.
But there's probably a range of some
that are a little bit more.
There's stronger ones.
The key to random number generation
is if you're generating any length that it truly
is not clumpier, that there's let's
say it's what maximum entropy, and that you really
don't have any clumps.
If it all clumps in one area, then
that's not great randomness.
So I just want to finish because there's
one other thing we're going to chat about
to lay the groundwork is Bitcoin addresses.
I put that up.
You can look at the slides later.
The details don't matter much.
But the key thing is that when you hear somebody talk
about public keys and Bitcoin addresses, colloquially,
we all reference them the same.
They're actually not.
The technology that Nakamoto did was he uses the public key.
He literally hashed it twice, once with this hash function
called SHA256, another hash function,
then concatenates, and puts a little check sum at the end,
and then uses something called a base 58 to make
it even shorter.
I've gone back and read some of Nakamoto's emails
for the two years after he published all this
and I've read other things.
My understanding is the reason there is two hash functions
and actually two different ones was just
to make everything a bit more secure.
Also, a public key is very long.
It's about 512 bits.
And so you can shrink the data and make
the data more compressed by hashing it,
which took it to 256 bits.
He hashes it twice, and then he does this base 58
and makes it even a little tighter.
So for all purposes, you could go ahead and just use
public key and Bitcoin address is the same.
But remember back in the mind, oh, actually,
they're a little different.
Bitcoin addresses are a little bit more secure supposedly,
unless of course somebody has hacked into your wallet
and figured out all these little details.
A Bitcoin address is a little bit
like the signatures on these notes we talked about, right?
Remember what an-- half of you don't use checking accounts.
But these are early forms of checks.
And there's a signature on the bottom.
That's really kind of a Bitcoin address.
I'm sorry, the signature is the digital signature.
The address, the Bitcoin address is who it's paid for.
And I promise last slide.
We're going to be talking about this next week.
Transactions, all that stuff that
rolls up into the Merkle trees.
All that little itty bitty important information,
they basically have an input and an output, the input
and a lock time.
But the input is a previous transaction.
This uniquely identifies, basically, money.
And you're going to send value in Satoshis.
He named the unit of count for himself.
There's a lot of Satoshis in every one Bitcoin.
That's why we don't hear much about Satoshis.
But there's 10 to the 8th Satoshis in every one Bitcoin.
So when you actually enter in the computer
code in a transaction, you're doing it in Satoshis.
And it's sent to a public key.
That's a coin.
That is what the incentive system's all about.
Any other questions?
And this is just I know.
There's a lot.
I wonder how many of you are going to come back on Thursday.
No.
Let me say this.
It's not just that we're at MIT.
But we are at MIT.
Come on.
Everybody in this room can get these kind of key concepts.
The key questions that we talked about
were timestamped append-only logs.
Does anybody want to tell me what a--
if this class here in the next seven minutes
can get these two concepts, that's
all we talked about for the last hour.
So I don't know your name in the orange shirt.
AUDIENCE: Andrew.
GARY GENSLER: What's that?
Andrew?
Andrew, what's time append-only logs?
AUDIENCE: Timestamped append-only logs is essentially
a record of transactions or a block
as blockchain uses it with a time.
And that can't be changed in the future.
So you can only add on transactions.
GARY GENSLER: So it's kind of immutable because
of all this cryptography.
Stuart Haber was making it in a timestamped append-only log.
And he was placing it where?
Carolyn, you still with me?
Where was Haber putting it?
AUDIENCE: New York Times.
GARY GENSLER: New York Times.
There you go in the classified section.
So it's just it's a bunch of blocks of data compressed up.
So we talked about something called
Merkle trees and Merkle Roots.
Just think about as that's a way to take a lot of information
and compress it but also make it searchable later
because 1,000 transactions, when we talk next week,
you have to be able to verify.
Somebody asked me about how to verify, right?
When you go back to verify, you need an index number to find it
in that Merkle tree situation.
And it's secured through hash functions.
Anybody want to tell me that easiest lay definition
of the hash function?
Jennifer?
AUDIENCE: It's like a mapping can be
so members can get to just one.
GARY GENSLER: Right.
You could take a picture of this classroom and everybody exactly
and they could map it into something.
I don't know.
Would a QR code be a form of a hash?
Not cryptographically secure.
But is it a hash?
AUDIENCE: It's more of a different representation
of some data rather than binary you're using.
GARY GENSLER: All right, so I failed that one.
AUDIENCE: It often stores hashes.
GARY GENSLER: So cryptographic hash function
is a way to take not only a lot of information
and put it into a fixed form, but the key thing here
is the hash functions are what tie the blocks together
because hash functions can point to previous information.
And as the video showed, if you change any of the underlying
information, the hash changes.
So what does that give you?
It basically secures the data.
You know if somebody has tampered.
So the only reason to really learn about hash functions
is it's to say, oh, I get it.
This is one of the ways to make this data tamper proof.
Go on.
AUDIENCE: I have a question about a theoretical event where
a better hash function is found than the SHA256.
How would that be implemented into the Bitcoin network
practically?
There needs to be a consensus and--
GARY GENSLER: So how would any relevant change
be adopted into Bitcoin is always a challenge
because it's a decentralized network.
And all decentralized networks have a little bit
of a governance challenge.
The governance challenge is, how do you do software updates?
We all know that on our laptops, our iPhones,
there's probably software updates going on here now
unbeknownst to me, right?
They're probably just Apple has dropped.
I mean, who knows what they're doing in here, right?
And Uber, I really, one of my favorites, who knows what's
happening inside this phone.
But the commercial enterprise, the central authority
has a way to update the software.
We probably sign some terms of use
that allows them to do that.
In a decentralized network like this,
there has to be consensus.
And so the only way really to update
the software for a new hash function or for most everything
else is, in essence, that the nodes,
the operators of the software collectively in a consensus
form adopt it.
So it's another way that not only is the data
immutable because of these hash functions but the software is.
And that comes both with benefits and costs.
Some people would say that's a bug of blockchain.
Some people would say it's a feature.
You can come to your own judgment
over the course of this semester.
But the software is harder to update
than software in centralized authorities
because centralized authorities just say--
they just push the--
now sometimes you have to click and say update.
But don't be naive.
Not every software do you click.
I mean, there's some that's just happening.
But here, you've got to have consensus.
I know it didn't answer your question
about the hash function.
But if it were a hash function that had to be updated
and everybody said they had to quickly update it,
there's interesting debates about this,
but you wouldn't need to go back over all 540,000
previous blocks.
You could just hash all 540,000 blocks, 180 gigabytes to one
256 or maybe it's then a different,
and then you'd have that.
And it would be tamper proof.
So those are the key things.
That's what we covered really.
What we're going to cover next Tuesday is consensus protocol.
We've talked a lot about proof of work
here because everybody thinks of Bitcoin about proof of work.
But we're going to talk about proof of work, the nodes,
and the native currency.
And then next Thursday, we're going
to talk about transactions.
Again, I try to break down this technology.
If you want to forget about this lecture,
and you're going to go, oh my god, it
was like going to the dentist, you
can tell your friends that you actually know
something about cryptography.
It is called cryptocurrencies.
So how could we not know something about cryptography?
But it's basically those three things.
It's cryptography.
It's a consensus mechanism and the transactions.
So right?
Cryptography, consensus mechanism, transactions.
And we will get through it.
And then you'll see this matters to finance
and whether it's got any use cases.
So thank you.