Research Perspectives and Challenges for Bitcoin and ...

1 SoK: Research Perspectives and Challenges for Bitcoin and CryptocurrenciesJoseph Bonneau , Andrew Miller , Jeremy Clark , Arvind Narayanan , Joshua A. Kroll , Edward W. Felten Princeton University, Stanford University, Electronic Frontier Foundation, University of Maryland, Concordia UniversityAbstract Bitcoin has emerged as the most successful crypto-graphic currency in history. Within two years of its quiet launchin 2009, Bitcoin grew to comprise billions of dollars of economicvalue despite only cursory analysis of the system s design.

2 Sincethen a growing literature has identified hidden-but-importantproperties of the system, discovered attacks, proposed promis-ing alternatives, and singled out difficult future a large and vibrant open-source community hasproposed and deployed numerous modifications and provide the first systematic exposition Bitcoin and themany related cryptocurrencies or altcoins. Drawing from ascattered body of knowledge, we identify three key componentsof Bitcoin s design that can be decoupled.

3 This enables a moreinsightful analysis of Bitcoin s properties and future map the design space for numerous proposed modifica-tions, providing comparative analyses for alternative consensusmechanisms, currency allocation mechanisms, computationalpuzzles, and key management tools. We survey anonymityissues in Bitcoin and provide an evaluation framework foranalyzing a variety of privacy-enhancing proposals. Finallywe provide new insights on what we term disintermediationprotocols, which absolve the need for trusted intermediariesin an interesting set of applications.

4 We identify three generaldisintermediation strategies and provide a detailed WHYBITCOIN IS WORTHY OF RESEARCHC onsider two opposing viewpoints on Bitcoin in straw-man form. The first is that Bitcoin works in practice, butnot in theory. At times devoted members of the Bitcoincommunity espouse this philosophy and criticize the securityresearch community for failing to discover Bitcoin , not im-mediately recognizing its novelty, and still today dismissingit due to the lack of a rigorous theoretical second viewpoint is that Bitcoin s stability relies onan unknown combination of socioeconomic factors whichis hopelessly intractable to model with sufficient precision.

5 Failing to yield a convincing argument for the system ssoundness. Given these difficulties, experienced security re-searchers may avoid Bitcoin as a topic of study, consideringit prudent security engineering to only design systems withprecise threat models that admit formal security intend to show where each of these simplistic view-points fail. To the first, we contend that while Bitcoin hasworked surprisingly well in practice so far, there is an im-portant role for Research to play in identifying preciselywhythis has been possible, moving beyond a blind acceptance ofthe informal arguments presented with the system s initialproposal.

6 Furthermore, it is crucial to understand whetherBitcoin will still work in practice as practices change. Weexpect external political and economic factors to evolve, thesystem must change if and when transaction volume scales,and the nature of the monetary rewards for Bitcoin minerswill change over time as part of the system design. It isnot enough to argue that Bitcoin has worked from 2009 2014 and will therefore continue likewise. We do not yethave sufficient understanding to conclude with confidencethat Bitcoin will continue to work well in practice, whichis a crucial Research challenge that requires insight fromcomputer science the second viewpoint, we contend that Bitcoin isfilling an important niche by providing a virtual currencysystemwithout any trusted partiesandwithout pre-assumedidentities among the participants.

7 Within these constraints,the general problem of consensus in a distributed systemis impossible [7], [93] without further assumptions likeBitcoin s premise that rational (greedy) behavior can bemodeled and incentives can be aligned to ensure secureoperation of the consensus algorithm. Yet these constraintsmatter in practice, both philosophically and technically, andBitcoin s approach to consensus within this model is deeplysurprising and a fundamental contribution. Bitcoin s coreconsensus protocol also has profound implications for manyother computer security problems beyond currency1such asdistributed naming, secure timestamping and commitment,generation of public randomness, as well as many finan-cial problems such as self-enforcing ( smart ) contracts,decentralized markets and order books, and distributed au-tonomous agents.

8 In short, even though Bitcoin is not easyto model, it is worthy of considerable Research attention asit may form the basis for practical solutions to exceedinglydifficult and important this dichotomy in mind, we set out to synthesizethe collective knowledge from the first six years of Bitcoin soperation and development, as well as from its many derivedcryptocurrencies. Our goal is both to highlight the manyareas where significant innovation has already occurred,ranging from novel payment protocols to user-friendly keymanagement, and also highlight the most important openresearch Challenges for Bitcoin and future we shall see, it may not be possible to remove the currencyfunctionality and still have a working consensus OVERVIEW OFBITCOINA.

9 A Contextualized HistoryWe refer the interested reader to existing surveys on the first wave of cryptocurrency Research [15], [95]. In short,cryptographic currencies date back to Chaum s proposal for untraceable payments in 1983 [28], a system involvingbank-issuedcash in the form of blindly signed coins. Un-blinded coins are transferred between users and merchants,and redeemable after the bank verifies they have not beenpreviously redeemed. Blind signatures prevent the bank fromlinking users to coins, providing unlinkability akin to the 1990s, many variations and extensions ofthis scheme were proposed.

10 Significant contributions includeremoving the need for the bank to be online at purchasetime [29], allowing coins to be divided into smaller units [92]and improving efficiency [27]. Several startup companiesincluding DigiCash [107] and Peppercoin [99] attempted tobring electronic cash protocols into practice but ultimatelyfailed in the market. No schemes from this first wave ofcryptocurrency Research achieved significant key building block of Bitcoin , moderately hard proof-of-work puzzles, was proposed in the early 1990s forcombating email spam [42] although it was never widelydeployed for this purpose [71].