Bitcoin and Cryptocurrency Technologies

Bitcoin and Cryptocurrency Technologies, by Arvind Narayanan, Joseph Bonneau, Edward W. Felten, Andrew Miller and Steven Goldfeder, is a computer-science textbook on building models of Bitcoin, from hash pointers and signatures through consensus, mining, anonymity and smart property. Princeton University Press published it in 2016 with a preface by Jeremy Clark. This review follows the prepublication draft dated February 9, 2016, released through Princeton's Center for Information Technology Policy, and cites chapters because the printed edition may differ in wording and pagination.

Its lasting value is a habit of separating what a protocol can enforce among its own records from what still depends on people and courts outside them. Public argument about cryptocurrency often merges the two, and the book keeps them apart while marking where each model stops. Readers need basic computer science, data structures, some programming and a little probability.

Chapter 2 starts from ScroogeCoin, a toy currency that works because one party orders every transaction, and asks how to remove that party. A digital signature authorizes a payment, and any node can check it alone. Ordering conflicting payments requires agreement, which counting anonymous nodes cannot supply because new identities cost almost nothing, so proof of work weights each participant by the computation it spends. In the chapter's double-spend figure, Alice signs a payment to Bob and then a second transaction sending the same coins to her own address. Both signatures verify. Nodes cannot judge which spend is morally legitimate, and a valid chain can include either one. Signatures stop forgery; consensus picks which authorized spend survives.

The chapter refines its own claim. Its recap credits a rule-following majority with keeping invalid transactions out, but a later thought experiment about an attacker with most of the mining power is more precise. Suppose that attacker mines a block spending coins without the valid signatures required by the spent outputs' conditions. A merchant's validating node rejects that block and every block built on it, however much work stands behind them, because each full validator checks the rules for itself. Validity has its own limits. A thief who has copied someone's private key produces signatures the protocol accepts, and consensus has no way to learn who holds lawful title. The book's rule of following the longest valid branch simplifies a protocol that tracks the most cumulative valid work. Six confirmations likewise leave a residual risk that depends on the attacker's share of mining power and network delay, under whatever probability model one adopts. The incentive argument shows why rewards make rule-following attractive, short of proving it optimal for every miner in every setting.

Chapter 6 shows why a fresh address for every payment falls short of guaranteeing unlinkability. Alice wants a teapot priced at 8 coins and holds outputs of 3, 5 and 6, so she spends two of them together. An observer can infer from the combined inputs that they are probably under common control and chain that inference across a cluster of addresses. A separate heuristic treats an output sent to a never-seen address as the payer's change. Each rests on wallet habits that some users break. In the study the book describes, combining the change heuristic with input clustering produced false positives that researchers had to prune by hand, so a cluster is a fallible claim about control. Names come from outside the chain, as when researchers transacted with exchanges and other services and recorded the addresses. That outside information can turn a transaction graph into an identification, which remains an inference.

CoinJoin is the chapter's clearest case where the common-input inference breaks, so joint-input clusters need qualification before they imply identity. Several users build one transaction together. Each participant supplies the required signatures for the inputs it controls after checking the outputs and amounts, so nobody pools private keys. The authors call theft impossible here, a claim that holds when transactions are correctly built and validated and the signature scheme stays secure. They also record what remains exposed. A peer can refuse to sign or double-spend its input, and participants need an anonymous channel for submitting inputs and outputs, since a coordinator who sees both can link them. On a transparent ledger, distinctive values and timing can survive mixing, as when a weekly salary of unusual size arrives and a fixed share moves on at once. Zerocash, covered in the same chapter, hides amounts, so this exposure is specific to transparent ledgers. We would add that colluding or Sybil participants shrink the real group a user hides among. The authors treat taint analysis as a heuristic for how related two addresses are and reject it as a measure of anonymity, because an adversary can draw on information the score ignores.

Chapter 11 carries the method to property. The authors imagine a car whose locks accept whichever key a blockchain transaction last designated, so control of the key counts as possession. Alice, traveling abroad, sells her parked car to Bob in one atomic transaction whose inputs are her ownership and his payment, so neither transfer happens without the other. That atomicity binds ledger claims. It cannot inspect the car or establish that Alice held rightful title, and the authors note that Bob could keep a signed transaction and broadcast it after the price moves. Their two-of-three escrow keeps the mediator from taking funds alone, while bribery and money frozen during disputes remain open problems the authors themselves list.

The chapter also separates choosing among competing mediators from removing intermediaries altogether. A crowdfunding contract can hold money until a threshold is met and still cannot make the entrepreneur deliver. The authors tie reputation to stable, binding identities; on our reading, a persistent pseudonym with a history and a cost to abandon could qualify without any government identity. They call their examples cartoons, fault the key-centered model for key loss and for attacks such as malware and phishing, and see the larger opportunity in complementing state and legal institutions. Readers wanting more private ordering than the authors endorse can still use these distinctions to test proposals.

The draft reflects 2015 and early 2016, from the 25-coin block subsidy and Ethereum to Zerocash's status and remarks on vehicle title, and its conclusion calls the book a work in progress. Readers writing software that handles funds should pair its mechanisms with current protocol specifications.