CommitCoin: Carbon Dating Commitments with Bitcoin

Abstract

Abstract. In the standard definition of a commitment scheme, the sender commits to a message and immediately sends the commitment to the recipient interested in it. However the sender may not always know at the time of commitment who will become interested in verifying it. Further, when the interested party does emerge, it could be critical to establish when the commitment was made. Employing a proof of work protocol at commitment time will later allow anyone to "carbon date" when the commitment was made, approximately, without trusting any external parties. We present CommitCoin, an instantiation of this approach that harnesses the existing processing power of the Bitcoin peer-to-peer network; a network used to mint and trade digital cash. Introductory RemarksConsider the scenario where Alice makes an important discovery. It is important to her that she receives recognition for her breakthrough, however she would also like to keep it a secret until she can establish a suitable infrastructure for monetizing it. By forgoing publication of her discovery, she risks Bob independently making the same discovery and publicizing it as his own.Folklore suggests that Alice might mail herself a copy of her discovery and leave the letter sealed, with the postal service's timestamp intact, for a later resolution time. If Bob later claims the same discovery, the envelope can be produced and opened. In reality, this approach does not work as (among other shortcomings) most postal services are pleased to timestamp and deliver unsealed empty envelopes that can be retroactively stuffed with "discoveries."In our approach, Alice will use a commitment scheme to put the discovery in a "digital envelope" which can be opened at some later time, but only by Alice. Alice can safely disclose the commitment value to anyone, but she does not know ahead of time that Bob will rediscover her breakthrough. Alice might attempt to reach Bob by broadcasting the commitment value to as many people as possible or she might have a trusted/distributed third party timestamp it, however she is neither guaranteed to reach Bob, nor choose a party that Bob will trust.Instead we show that Alice can produce a commitment and later convince Bob that the commitment was made at roughly the correct time, premised on the assumption that she does not have unusual computational power. We call this "carbon dating." We show a general approach to carbon dating using moderately hard puzzles and then propose a specific instantiation: CommitCoin. CommitCoin harnesses the existing processing power of the Bitcoin network without trusting it, and is designed to leave the commitment value evident in the public Bitcoin transcript in a way that does not destroy currency. We use CommitCoin to augment the verifiability of a real-world election. Preliminaries and Related WorkCommitment Schemes. Briefly, Comm(m, r) takes message m and randomness r and produces commitment c. Open(c, m, r) takes the commitment and purported message and returns accept iff c is a valid commitment A shor...

Evaluating User Privacy in Bitcoin

“…In [14], Karame et al thoroughly investigate double-spending attacks in Bitcoin and show that double-spending fast payments in Bitcoin can be performed in spite of the measures recommended by Bitcoin developers. Clark et al [11] propose the use of the Bitcoin PoW to construct verifiable commitment schemes. Reid and Harrigan [16] analyze the flow Bitcoin transactions in a small part of Bitcoin log, and show that external information, i.e., publicly announced addresses, can be used to link identities and organizations to some transactions.…”

Fair Two-Party Computations via Bitcoin Deposits

“…More precisely, each party sends its share to the other party and makes a zero-knowledge proof that it is indeed its share of the result. Of course, one of the parties has to reveal her share first (or at least a part of it) and the other party can quit the protocol at this moment, leaving the honest party with no information about the output 9 .…”

“…Commitment schemes and zero-knowledge proofs in the context of the Bitcoin were already considered in [9], however, the construction and its applications are differentthe main idea of [9] is to use the Bitcoin system as a replacement of a trusted third party in time-stamping. The notion of "deposits" has already been used in Bitcoin (see [26], Example 1), but the application described there is different: the "deposit" is a method for a party with no reputation to prove that she is not a spambot by temporarily sacrificing some of her money.…”

ZombieCoin: Powering Next-Generation Botnets with Bitcoin

“…This approach is used by Commitcoin [29] to insert hash digests in transactions. Bitcoins are not wasted using this method, and bandwidth is up to 32 bytes per input.…”