Does the bitcoin block contain minimal transaction detail? (Is it as private as possible given the proof-of-work design?)

Question

From https://crypto.stackexchange.com/questions/508/could-one-prevent-double-spending-in-decentralized-digital-currencies-like-bitc

"Now, the only information about the transaction that needs to be public is enough information to prove I have the coins and prove that I didn't transfer them elsewhere. As it happens, the Bitcoin protocol leaks much more information than this (for example, the account I transferred the coins to). The protocol could have been designed to make less information public if that was desired."

Is this true, could the block-chain report less data but still gain the proof-of-work mechanism's benefits? If so, what aspects of the blockchain are non-essential and what is the reason for including them?

Answer 1

1. In order to send someone some coins, you need to know their public address.
2. In order for them to redeem their coins, they have to show everyone that they possess the private address associated with that public address.

You could try encrypting your public key by some means and later decrypt it when you want to spend the coins, but you'd probably have to provide something that could identify you similarly to using a public key.

You could alternatively encode only transaction hashes in the block, rather than actual transactions and only send the actual transaction to the peer you are sending the coins to. This approach though creates a lot of new problems with validation and so forth.

All in all, Bitcoin protocol doesn't have much excess data. In fact, by today's standards one may say it is trying to be too slick at times (say by using something like VarInt).

Answer 2

To be able to prove that you have the coins, it is necessary to be able to prove where the coins are (ie, what address they're at) right now. This means the public ledger has to show the movements of the coins. Otherwise, how do we know the coins are in your wallet and not another wallet?

Answer 3

Users may choose (perhaps unintentionally) to add identifying information, typically through re-using addresses. If you use a different address for each transaction, you are more anonymous than if you use the same address (thus creating a link between all your transactions, so any information leak associated with any one of them might serve to de-anonymize them all).

Answer 4

I'm not a crypto expert but I think the answer is exactly the opposite, Satoshi chose to give out less information than he could have.

To use PGP encryption you publish a public key that anyone can use to send a message that only you can read. Typically your public key is available to everyone in the world, including the NSA, from a public keyserver. This is convenient, someone dosn't have to email you and say "Hey guy, I need your public key to send you a private email".

The NSA might have spent the last 17 years cracking my old 384bit public key to read a couple of email replies I got in 1994 saying "Re: can I sleep on your floor after the 2600 meet? Yeah dude bring a sleeping bag".

A bitcoin address is a hash of a hash of an ECSDA public key. That is just as identifying as the public key, or a non-existent "account number" since it is unique to the person receiving the money.

There is loads of money sitting in the bitcoin block chain. To take the money from an address you just have to provide a number that meets certain conditions. The whole thing rests on it being really really difficult to find a number that meets the conditions if you don't have the private key that was produced along with the bitcoin address.

Satoshi could have just had the bitcoin software publish the public key. That would mean that if someone dosn't spend some bitcons for 15 years an attacker has 15 years to try to crack the ECSDA crypto. That should have an insignificantly tiny chance of success but there is no harm in making it more difficult.

In theory the hashing means that there are more possible numbers which satisfy the condition to get the money. That should reduce the cracking time from a 1000 zillion years to only a zillion years, which dosn't matter. In practice it means an attacker has to crack ECSDA plus two hashing algoristhm instead of just ECSDA so it's probably more difficult in practice.