Looking forward into the next year and more of bitcoin, I see three main areas of concern, each related to the other. Let’s look at the problems, and the work going on to solve them.
- Fungibility
- Centralization
- Scalability
Fungibility: Protecting Your Privacy
Fungibility technically means all coins are substitutable, but in practice it means that you can spend your bitcoins how you want. That means that nobody has the power to stop your transaction (see: Centralization), and nobody has reason not to accept your coins.
The state of fungibility in bitcoin today is poor. Services exist which aim to trace where bitcoins came from and whose they are. The fact that coins can be traced means some services are obliged to do so, and they refuse to interact with coins they see as “tainted”.
The simplest weakness of fungibility is the public ledger: everyone can try to analyze payments to see where they went. Consider transaction 3d96bcd… from April 8th 2016; one output is 3.10510875 BTC, the other is 0.05934611 BTC. If we convert them using the USD closing rate from April 7th, that’s $1307.8842 and $24.9968. It’s fair to guess that the second output is a $25 payment, and the first output is back to the payer. I’d also guess the payer is in the United States.
Addresses naturally cluster when a wallet has to use more than one input to create a transaction; when public addresses are revealed (particularly with address reuse!), analysis becomes easier. I asked someone to look at my bitcoin address, and he immediately linked me to localbitcoins.com using such techniques.
Different software creates slightly different transactions, which can also be used to link transactions and thus addresses. Differences in fee estimation is another method. And every transaction you know makes it easier to guess the remaining transactions, like solving a crossword puzzle. Fungibility is a network property: other people having it helps you have it, too.
There are also active probes going on; fake bitcoin nodes which connect to as many other nodes as they can, presumably to try to nail down the original source of transactions.
What’s Being Done For Fungiblity
Software is slowly improving: every bitcoin core release changelog seems to include tweaks to make active snooping more difficult.
We may see more uniformity in wallet implementations, too, though in the short term things like replace-by-fee will probably make wallets more different, not less.
The most promising development here is TumbleBit: it’s a tumbler which you don’t need to trust with your coins or your privacy. A normal tumbler is where I take everyone’s coins, and then return them randomly. Of course, I might decide to not return them, or keep records so I can trace whose coins went where. TumbleBit is more complicated, but doesn’t have either of these problems. It’s in early development, but once it’s complete I look forward to quite a few TumbleBit servers mudding the waters.
Centralization: Control of The Network
If the miners refuse to mine your transactions, your bitcoins aren’t worth anything. With better fungibility that becomes unlikely, but still possible (miners could insist on ID for every transaction, for example).
In most systems, there are economies of scale which drive centralization, and bitcoin mining is no exception. The invention of mining pools dramatically increased centralization, as small miners delegated their transaction selection to a handful of pools (this smooths out a miners income, by profit sharing). As block sizes increased, the situation became worse: if your block is slow to get out to the other miners, it’s likely to lose a race, and if you’re slow to get blocks from other miners, you’re more likely to produce obsolete blocks. Blocks which lose out like this are called “orphan blocks”, and how often you produce them is your “orphan rate”. More than 1% and your profitability is probably shot.
You can drop your orphan rate by being the biggest miner (or, part of the biggest pool). If a single miner or pool gets more than 50% (which has happened), they can reliably censor the network (which hasn’t). With even less they can still profitably exploit vendors who accept unconfirmed transactions (which has happened). And it turns out that larger miners can drive up orphan rates of other miners (so-called selfish mining) and magnify their advantage.
It should be no surprise then that mining is fairly centralized: four groups control more than half the mining power. Fortunately, there doesn’t seem to be deliberate orphaning attacks happening.
The other issue is that fear of orphaning leads to miners mining empty blocks (aka SPV mining). They do this because they watch other mining pools, and as soon as they see a block header which refers a new previous block, they start mining an empty block themselves. They have to mine an empty block, because they don’t know what transactions were in the previous block. That doesn’t help the network throughput at all, and because they are not validating the previous block, it greatly weakens the security of lightweight nodes which assume miners are actually checking blocks. It turns out over 50% of mining power was doing this in 2015, and many still are.
What’s Being Done For Centralization
Fast block propagation was a big area of work last year, with Bitcoin Unlimited’s XTHIN and Bitcoin Core’s Compact Block work. Both send short summaries of the block contents which often allow a node (which usually knows all the transactions already, just not which ones are in this block) to reconstruct it.
Matt Corallo previously ran the Bitcoin Relay Network to try to increase propagation and reduce incentive to SPV mine; the latest version is based on compact blocks and is even more efficient, called Bitcoin Fibre. You’re welcome to run your own Fibre network, too (I run a test one on Digital Ocean, for example). It uses UDP and error correction so you can get blocks from multiple sources at once, and handle packet loss. Matt claims that there’s no point in SPV mining any more; Fibre gets you the blocks just as fast.
There’s ongoing work on speeding up new block creation further: I’m told Bitcoin Unlimited removed the validity double-check on newly created blocks (it’s caught issues in the past, but maybe it’s time) and Bitcoin Core has worked on speeding it up so it’s no longer measurable. Combined with more significant fee income (which is lost when SPV mining), we may see SPV mining eliminated this year.
None of these addresses the core problem of centralization; this is the issue we have fewest technical fixes for and thus is likely to be least amenable to technical efforts.
Nontheless, Roger Ver’s bitcoin.com mining pool gives me hope that we’ll see some diversity in motivations for miners. Making life easier and more convenient for small miners (especially solo mining) should be a priority for those who care about centralization. In the long term, as more businesses become dependent on bitcoin, I’d like them to start investing in mining capacity as a kind of distributed insurance policy.
Scalability: More Transactions
In the early days, bitcoin software had a 100k block limit and no transaction fees were required. Nobody cared, and blocks were never full.
When blocks passed 700k, bitcoin saw its first centralization crisis as orphan rates spiked and one pool (Ghash.io) got over 50% of the hash power. Since then developers have scrambled over the issue of block propagation; in theory, it could be independent of block size, but in practice it’s not. Centralization has remained a core source of tension with hopes for enlarging blocksize. Blocks are now full (though only 85% of theoretical maximum), and the transition from “free” to “user pays” is causing pain as software has to be upgraded and users proceed through the stages of mourning on free transactions (disbelief, denial, bargaining, guilt, anger, depression, and acceptance).
But other scalability issues exist: the bitcoin history has reached 100GB (that’s a lot of work for starting a new node), the size of unspent outputs each node has to remember keeps expanding (it must remember these forever), and the number of full nodes in the network is in long-term decline (though currently flat).
What’s Being Done For Scalability
There are several “20% improvement” factors on the horizon, and together they multiply to give significant improvements in scalability as software improves. Rising fees are causing wallet authors to (finally!) begin optimizing their transactions, because users are noticing.
Block propagation has gotten better (see centralization above) and slightly less coupled to blocksize, and validation has gotten much faster (thanks much to libsecp256k1) which may see us close the gap between the theoretical 1MB blocksize and the current 850k average blocksize.
Segregated Witness should increase blocks to about 2MB, though it depends how quickly the ecosystem (wallets and other transaction businesses) start using it.
Segregated witness makes signatures (aka “witnesses”) discardable, and gives them a discount over parts of transactions which must be kept (ie. unspent outputs). This should bias wallets towards using it so more of the blocks can be discarded by nodes.
Replace-by-fee is becoming more common: this allows you to bump the fee on transactions which are taking too long to confirm. This not only means you can be more aggressive on lowering fees, it also allows you to combine multiple payments into one if you have them, which reduces your total transaction size.
On the horizon are Schnorr signatures, which can be combined together, reducing witness size even further: instead of a transaction with two inputs which are each a 33 byte key and 72 byte signature, we might have two 33 byte keys, and a single signature. Interestingly, this also provides an incentive to adopt mixing protocols (like TumbleBit) because they are smaller and hence cheaper, helping the network fungibility even if you don’t care about fungibility yourself.
Finally, there are at two significant efforts to create off-chain scaling for bitcoins; Lightning for microtransactions, and the proposed sidechain MimbleWimble. Lightning takes Satoshi’s original (but incomplete) ideas for payment channels on top of bitcoin and makes them bi-directional and trustless, and forms them into a network. There are at least four teams of us actively working on implementing it. MimbleWimble is more radical, and uses a cut-down scriptless bitcoin with some amazing math to produce a blockchain which doesn’t require transmission or storage of any historical state, just the current unspent outputs, without loss of security (but with great fungibility benefits). Implemented as a sidechain, you would move bitcoins across to it, then back. It has cast its spell on Andrew Poelstra and I look forward to seeing an alpha release this year.
Conclusion
It’s often hard to find an overview of all the different threads of development and effort going on at once in the bitcoin technical community. I haven’t even covered more speculative things like Bitcoin-NG or Confidential Transactions nor developments which don’t directly address these three areas such as covenants or new scripting enhancements, let alone things which will no doubt be dropped from the sky…
But hopefully this gives you a list of things I’m looking forward to in 2017!
________________________________________________
About the Author
This article was written by Rusty Russell. Rusty is a Linux kernel dev who wandered into Blockstream, and is currently trying to produce a prototype and spec for bitcoin lightning.
