1. 引言
1. Introduction
六年前，比特币被发明出来时（参见文献 [8]），贝拉克·奥巴马刚刚宣誓就任总统，Lady Gaga 也刚刚推出她的第一首热门单曲。如果你今年 20 岁，那可能像是很久以前的事了。如果你和我一样，已经 48 岁，就会觉得那似乎并没有过去多久。我在 2010 年第一次听说比特币。它以一种非常有趣的方式，把经济学、点对点网络和密码学结合起来，这吸引了我。
When Bitcoin was invented six years ago (cf. [8]), Barack Obama had just been inaugurated president and Lady Gaga had just released her first big single. If you are 20 years old, that probably seems like forever ago. If you are 48 like me, that seems like not all that long ago. I first heard about Bitcoin in 2010, and was attracted to it because it combined economics, peer-to-peer networking and crypto in a really interesting way.
我想谈谈过去六年里我们学到了什么。中本聪懂得很多，但他并非无所不知。我认为，他发明比特币时，还有许多大大小小的事情并不了解。最后，我也会谈谈一些我认为我们至今仍不知道的事情。
I’m going to talk about what we have learned over the last six years. Satoshi knew a lot, but he wasn’t omniscient – I think there were a lot of things, both big and small, that he didn’t know when he was inventing Bitcoin. I will finish by talking about some things that I think we still do not know.
2. 中本聪不知道的事
2. What Satoshi Didn’t Know
我认为，中本聪不知道的一件事是：它能从零起步吗？除了我和他这样的极客，还有人会对这项复杂的技术感兴趣吗？有没有办法从无到有地创造价值？因为这正是大多数人想不通的地方：一种原本价值为零的货币，怎样才能启动起来？在诞生后的第一年里，它一文不值。我认为，中本聪当时也不知道这件事究竟能不能成。如果回头读他早期的一些文字，就会发现，他对比特币可能如何起步的判断完全错了。他以为它会被用作电子邮件的垃圾信息过滤工具，类似一套实用的 HashCash [1] 系统。但他在这一点上判断错了。它实际的起步方式，是有人用 10,000 个比特币买了两份披萨，还有人愿意相信它真的可能成功，相信它将来某一天可能值一两美元。
I think one of the things Satoshi did not know is would it bootstrap? Would anybody, besides geeks like me and him, be interested in this complicated piece of technology? Is there some way of creating value out of nothing? Because that’s the thing that trips up most people: how can you bootstrap a currency from literally zero value? It had no worth for the first year of its life. I don’t think Satoshi knew if this was possible or not. If you go back and look at some of his early writings, he was completely wrong about the ways it might bootstrap. He assumed it would be used as a spam filter device for email, something like a practical HashCash [1] system. But he was wrong about that. The way it bootstrapped was a guy buying a couple of pizzas for 10,000 bitcoins and people taking that leap of faith that it could actually be successful and might be worth a dollar or two at some point in the future.
我认为，中本聪不知道的另一件事是：它合法吗？2010 年我刚开始参与比特币时，我们仍然不知道答案，而这确实让我很担心。我当时在想：我会不会因为研究这项技术而被逮捕？会不会被关进监狱？我相当确信自己不会——这是个开源项目，我没想骗任何人，也没有人付钱给我。看起来，当局没有太多理由严厉打击我，把我抓起来关进监狱。但我确信中本聪考虑过这件事；在社会层面，这也是他不知道答案的问题。
I think something else Satoshi did not know is was it legal? When I first got involved in Bitcoin in 2010 we still did not know the answer and that actually worried me a lot. I was thinking: could I get arrested for working on this technology? Would I be thrown in jail? I was pretty sure I wouldn’t – it was an open source project, I was not trying to rip anybody off and nobody was paying me any money. It didn’t seem like there was a whole lot of room for authorities to come down hard, arrest me and throw me in jail. But I am sure Satoshi thought about that and it’s something he didn’t know on the social side.
现在的情况好多了。去年，美国证券交易委员会（SEC）发布了一份关于“利用虚拟货币实施的庞氏骗局”的投资者警示 [11]。其中重要的词是“利用”。他们并不是说虚拟货币就是庞氏骗局，而是在提醒投资者：如果你看到某个使用比特币、莱特币、狗狗币或其他替代币的项目，好得令人难以置信，那就要小心。你很可能正在受骗。相比六年前，这已经好得多了。我想，如果六年前去问 SEC，他们可能会把比特币归为庞氏骗局。
The situation is much better today. Last year, the SEC published an advisory about “Ponzi schemes using virtual currencies” [11]. And the important word in there is “using”. They are not saying that virtual currencies are Ponzi schemes, they are just warning investors that if you see a too good to be true scheme using Bitcoin or Litecoin or Dogecoin or any of the other altcoins, then be careful. You are probably getting ripped off. That’s a much better situation than we were in six years ago, where I think, if you asked the SEC, they probably would have classified Bitcoin as a Ponzi scheme.
3. 小额交易洪泛攻击
3. Penny-Flooding
我认为，中本聪还不知道，互联网上的人究竟能有多烦人。我们都知道这一点，但在你真正做出一个系统、把它上线，并亲眼看到人们用各种方式攻击它之前，我觉得你并没有真正理解这件事。比特币最初几个版本中的某些特性很容易遭到滥用。我认为，中本聪没有充分意识到，人们会多么乐意滥用这套东西，哪怕这么做根本没有经济收益。只要你的系统足够受欢迎，就会有人纯粹为了捣乱而滥用它。
I think something else Satoshi didn’t know was how annoying people are on the Internet. We all know this, but until you actually create a system and launch it and see all of the different ways people attack it, I don’t think you really know it. There were some properties of the first Bitcoin releases that were subject to abuse and I think Satoshi didn’t completely internalize how willing people would be to abuse this thing, even if there is absolutely no economic incentive for doing so. People will abuse your system just to be annoying if you are popular enough.
比特币早期遇到过一个很大的问题，我们称之为“小额交易洪泛”（penny-flooding）。它的做法是这样的：我架设两台机器，整天把比特币从一台转到另一台。如果交易免费，就没有什么能阻止我这么干。我可以不停地来回转账，用毫无实际用途的交易淹没整个网络。2010 年接近年底时，这在比特币网络上成了一个相当严重的问题。图 1 展示了比特币网络在 2009 年和 2010 年的交易数量。你可以看到 2010 年底那个巨大的峰值，以及更早几次小额交易洪泛攻击形成的峰值。其中绝大多数交易，都来自一个或几个令人讨厌的家伙；他们这么干，仅仅是因为他们做得到。
Early in Bitcoin’s life we had a big problem with what we called “penny-flooding”. Penny-flooding works as follows: I set up two machines and send bitcoins from one to the other all day long. If transactions are free, there is nothing stopping me from doing that. I can just flood the network with transactions that accomplish nothing, transferring them back and forth for ever and ever. Near the end of 2010 that was a pretty big problem on the Bitcoin network. ?? shows the number of transactions on the Bitcoin network in 2009 and 2010. You can see this huge spike at the end of 2010, and there are a couple of other spikes which were earlier penny-flooding attacks. The vast majority of transactions were one or more annoying people doing this just because they could.
我们后来确实找到了一种解决办法，如今它被称为“权益证明”（proof-of-stake），虽然当时我们并没有这样叫它。我提出，可以根据一笔交易的年龄，以及以比特币金额衡量的交易规模，来确定交易的优先级，并利用这些放置已久的比特币所具有的稀缺性，限制免费交易的速率。中本聪随后发来的一封邮件，大概是最让我自豪的一封。他说：“你可能终于解决了最具挑战性的问题之一。”有一些替代币采用了同样的思路，把权益证明用在其他地方。我们认为那不是个好主意。你可以去问 Andrew Miller、Greg Maxwell 或 Andrew Poelstra，了解原因；他们认真研究过权益证明系统，也思考过这些系统究竟能否奏效。不过，至少在支持网络上的免费交易这件事上，回头看那张图，效果确实很好。我们一实施这项改动，小额交易洪泛就停了下来，一切重新回到正轨。
We actually found a solution to this which is now called proof-of-stake, although we didn’t call it that back then. This is probably my most proud email from Satoshi, where I came up with the idea of using the age of a transaction and the size of the transaction in terms of bitcoin value to prioritize transactions and rate limit free transaction based on this scarce resource of old bitcoins. And Satoshi said “You may have finally solved one of the most challenging problems”. There are a number of altcoins that have taken the same idea and use proof-of-stake for other things. We think that’s a bad idea, and you can talk to Andrew Miller, Greg Maxwell, or Andrew Poelstra about why; they have looked pretty hard at proof-of-stake systems and thought about whether they can possibly work. But certainly, for supporting free transactions on the network, if we go back to that graph, it worked really well. The penny-flooding stopped as soon as we implemented this change and things got back on track.
这里面的想法其实很深刻。稀缺性加上实用性就产生价值，这确实是比特币的一个核心思想。一件东西如果既稀缺又有用，它就有价值。在比特币系统里，比特币本身是首要的稀缺资源：能够被创造出来的数量有限，流通中的数量有限，而密码学确保这些规则得到遵守。交易优先级原来也是一种可以在比特币系统中利用的稀缺资源，我们正是用它来防止小额交易洪泛。这种稀缺性并不直观，但如果你想要一个已经放了一年、而且从未被花费的比特币，那么它就是一种稀缺资源，即使你并不把它花掉。
The idea there is really pretty deep. It really is a core idea behind Bitcoin that scarcity plus utility equals value. If something is scarce and it is useful then it has value. In the Bitcoin system, bitcoins are the primary scarce resource: there are only a certain number that are ever created, there are only a certain number in circulation and the cryptography makes sure that those rules are followed. Transaction priority turns out to be another scarce resource that we can use in the Bitcoin system, and that’s what we used to prevent penny-flooding. It is not obvious that this is a scarce resources, but if you want one bitcoin that is a year old and hasn’t been spent, then that’s a scarce resource, even if you don’t spend it.
图 1：比特币早期的交易量
Fig. 1. Transaction volume in the early days of Bitcoin
我认为，比特币系统里还很少被探索的一个领域，是那些放置已久的未花费交易输出还有什么用途。人们已经开始思考很多事情，但写出的代码还不多，实现出来的系统也不多。有些想法是利用它们进一步防范拒绝服务攻击。比如，可以设想，光是加入网络就需要提供一笔比特币押金。当然，我们并不想这么做，因为我们希望网络能发展壮大。但也可以设想，如果我们真的遭遇了非常严重的女巫攻击（Sybil attack）[4]，那么要求一个人设法获得一些由自己控制的比特币，作为加入网络的门槛，或许就有道理。我们讨论了好几年的另一个想法，是把比特币押金作为假名身份的锚点：如果我持有一百个已经放了五年的比特币，而且能证明自己持有它们，那或许就可以用来维系一个长期身份。只要我继续持有它们，这个身份就能继续维持。这里面有各种各样的问题，但我们确实讨论过；我想还没有人真正尝试过。
I think one of the more unexplored parts of the Bitcoin system is other uses of old unspent transaction outputs. There has been a lot of thinking that has started to happen, there hasn’t been lots of code written, there hasn’t been a lot of systems implemented, but some of the ideas might be leveraging them for further denial-of-service attack prevention. For example, you could imagine requiring some bitcoin deposit to merely join the network. Of course we don’t want to do that because we want the network to grow. But you could imagine that if we had a really big problem with Sybil attacks [4], then requiring that somebody somehow gets some bitcoins that they control, as a kind of gate to join the network, might make sense. Another idea we have talked about for years is bitcoin deposits as pseudonymous identity anchors: if I hold a hundred bitcoins that are five years old and I can prove that I hold them, that might be a useful type of anchor for a persistent identity. And as long as I hold them I will maintain that identity. There are all sorts of issues there, but we’ve talked about this and I don’t think anybody has actually tried to do it yet.
还有一个值得思考的问题：能不能通过花费比特币，防范其他与比特币无关的系统所遭受的拒绝服务攻击？我很想看到有人这样做。到目前为止，大多数人的想法是，把比特币当作一种付出后才能访问其他系统的代币。但你不一定非得把它花掉；在很多情况下，仅仅持有它们，也许就足够了。
It is interesting to think about whether you could spend bitcoins as denial-of-service prevention for other systems that aren’t Bitcoin-related. I would be very interested in seeing that. So far most people think about using bitcoins as a token that you spend to get access to some other system, but you don’t have to spend them, just having them might be good enough in a lot of cases.
我要指出，已经花费的交易输出并不是稀缺资源。它们很容易制造出来，比特币也很容易被反复花费。因此，如果你在思考这类问题，就一定要区分已经花费和未花费的输出，也要注意比特币从未花费转为已花费的那个边界状态——有意思的事情都发生在那里。
I will note that spent transaction outputs are not a scarce resource, those are easy to create, it is easy to spend bitcoins over and over again. So if you are thinking about this, do think about spent versus unspent, and the edge case of when bitcoins go from unspent to spent which is where all the interesting things happen.
4. 中本聪是密码学家吗？
4. Was Satoshi a Cryptographer?
我在大众媒体上看到关于中本聪的文章时，经常发现他被称为密码学家。但他真的是密码学家吗？我认为不是。比特币实际用到的密码学并不多：椭圆曲线密码学（ECC）密钥、ECDSA 签名，还有哈希。差不多就是这些了。整个比特币系统都是基于这些基本构件搭建起来的。如果你认真看代码，就会发现，中本聪运用密码学的方式相当朴素。他使用了 OpenSSL，但用得并不深入。我们现在深入使用 OpenSSL，发现里面有各种棘手的小边界情况。我想，如果他是密码学家，在这些地方就会谨慎得多。源代码里没有提到 Schnorr 签名 [10]、Lamport 签名 [7]，也没有那些我认为真正的密码学家会提到的东西。我没看到诸如“我没有在这里使用 Lamport 签名，因为它太大了”这样的注释。我在准备这次演讲时，还读到中本聪的一段话：“密码学也许能提供一种实现‘密钥盲化’的方法。我做过一些研究，内容很晦涩，但可能有些可用的东西。‘群签名’也许与此有关。”[9] 我认为，从这段话可以看出，以中本聪当时掌握的密码学知识来说，他可能并不是密码学家；我想，他并不熟悉最前沿的密码学研究。
When I see popular press articles about Satoshi, he is often called a cryptographer. But is he really a cryptographer? I don’t think so. There is actually very little cryptography in Bitcoin. We’ve got ECC keys, ECDSA signatures and hashing. And thats about it. All of Bitcoin is built from those primitives. If you actually look at the code, the way Satoshi used cryptography is fairly naive. He used OpenSSL, but he didn’t use it very deeply. We are using OpenSSL deeply now, and there are all sorts of nasty little edge cases down there. I think if he were a cryptographer he would have been much more careful there. There is no mentioning of Schnorr signatures [10], Lamport signatures [7], none of the stuff I would expect a real cryptographer to mention in the source code. I don’t see any comments like “I didn’t use Lamport signatures here because they are too big”. And there is a quote from Satoshi, that I ran across when I was preparing this talk, where he said “Crypto may offer a way to do ‘key blinding’. I did some research and it was obscure, but there may be something there. ‘group signatures’ may be related.” [9] I think that shows you that with what Satoshi knew about cryptography, he probably wasn’t a cryptographer, I don’t think he was up on the very latest crypto research.
5. 交易的有效性与含义有什么不同
5. The Difference between Transaction Validity and Meaning
我还想简单谈谈另一件我认为中本聪当时不知道的事。我觉得，他没有充分理解“验证一笔交易”和“理解这笔交易在做什么”之间的区别。如果他理解了，我想他会以不同的方式设计比特币。交易有效性要回答的问题是：这笔交易是否应该被允许写入区块链？相关规则相当简单。第一，交易的语法必须正确，你必须能够解析从网络收到的数据。第二，解锁条件必须得到满足。如今，这通常意味着，ECDSA 签名对于先前生成的公钥必须有效。第三，输入金额之和必须大于或等于输出金额之和。你不能通过构造交易来创造新的比特币——早期曾有一个整数溢出漏洞破坏了这条规则，那很糟糕。最后，任何输入都不能被双重支付，也就是不能把同一笔比特币花两次。普通交易的规则基本就是这些。产生新比特币的 coinbase 交易另有特殊条件，不过这里我不打算讨论它们。
I want to talk a little bit about something else I don’t think Satoshi knew. I don’t think Satoshi internalized the difference between validating a transaction and understanding what that transaction was about. And I think if he did, he would have designed Bitcoin differently. Transaction validity asks the question: should this transaction be allowed into the block chain? And the rules for this are pretty simple. First, a transaction has to be syntactically correct, you have to be able to parse it off the wire. Second, the redemption conditions have to be correct. Today, that typically means an ECDSA signature has to be valid for the previously generated public key. Third, the sum of the input amounts has to be greater than or equal to the sum of the output amounts. You are not allowed to create new bitcoins by creating transactions (there was an integer overflow bug early on that broke that rule – that was bad). Finally, it does not double-spend any inputs, so you do not spend any bitcoins twice. Those are basically the rules for normal transactions. There are special conditions for coinbase transactions that create bitcoins, but I’m not going to talk about those here.
交易的含义稍有不同，我觉得很多人不理解这一点。事实上，我认为我当时也不理解，中本聪也不理解。交易的含义是：谁收到了付款，收到了多少钱，以及谁授权了这笔付款。理想情况下，这些含义只需要由交易双方掌握，其他人根本不必知道。
Transaction meaning is slightly different, and I think a lot of people don’t understand this. In fact, I don’t think I understood this and I don’t think Satoshi understood this. Transaction meaning is who is being paid, how much are they being paid and who authorized the payment. Ideally, the meaning of the transaction would only be shared between the parties involved in the transaction and nobody else would have to know anything about it.
中本聪最初的钱包能够识别两种交易类型。第一种非常简单：比特币持有人创建一笔交易，规定“你需要核验这个公钥对应的签名”；而收款人在想花费这些比特币时，就提供一个满足条件的签名。这类“支付到公钥”（pay-to-public-key）的交易，把验证和含义混在一起的程度超出了必要范围；任何观察这笔交易的人，都知道花费它所需的公钥。
Satoshi’s original wallet understood two transaction types. The first one is very simple: the person who holds the bitcoins creates a transaction that says “you need to check the signature of the public key” and the recipients, when they want to spend the bitcoins, provide a signature that satisfies those conditions. These pay-to-public-key transactions mix validation and meaning more than necessary; everybody observing the transaction knows the public key needed to redeem them.
比特币交易用一种类似 Forth 的简单脚本语言来表达。转入资金的交易中，scriptPubKey 规定资金如何锁定；花费资金的交易中，scriptSig 则满足解锁条件。在最简单的情形下，scriptPubKey 只包含一个公钥和 OP_CHECKSIG 操作码，而 scriptSig 是用相应私钥生成的数字签名。
Bitcoin transactions are expressed in a simple, Forth-like scripting language. The scriptPubKey in the funding transaction specifies how the funds are locked, and the scriptSig in the redeeming transaction satisfies the locking condition. In the simplest case, the scriptPubKey is just a public key and the OP_CHECKSIG operator, and the scriptSig is a digital signature for that private key.
中本聪还实现了另一种交易类型：把公钥移到花费资金的一端，在原来的位置用公钥的哈希来替代。这样做，是为了让生成的“比特币地址”足够短，便于复制和粘贴。不过，我认为，如果中本聪对 OpenSSL 再多了解一点，知道公钥可以压缩到 33 字节，而不是 65 字节，他也许就不会费这番功夫。他很可能只会采用更长的比特币地址，而我们也都会使用第一种交易类型。如今，网络上几乎所有比特币交易都是第二种，也就是“支付到公钥哈希”（pay-to-public-key-hash）。
Satoshi also implemented another transaction type which just moves the public key over to the redeeming side and replaces it with a hash of the public key. He did that to keep the resulting “bitcoin addresses” short enough to easily copy and paste. However, I think if Satoshi actually had understood OpenSSL a little bit better and knew that he could fit public keys into 33 bytes instead of 65 bytes, he wouldn’t have bothered. He probably would have just had longer bitcoin addresses and we all would be using the first type of transactions. Almost all bitcoin transactions on the network these days are of the second type (“pay to public key hash”).
于是，我们有了由 scriptSig 和 scriptPubKey 支持的这门小语言。这里有一个有趣的问题：中本聪为什么允许在 scriptSig 中使用操作码？scriptSig 是你用来证明自己掌握了满足交易条件所需信息的那部分内容。因此，你可以把 scriptPubKey 写成“11 equals”，然后你——或者任何知道十一等于十一的人——只要提供一个内容为“11”的 scriptSig，就能满足它。你也可以把这个数表示成“6 5 +”，但其实没有理由这样做，因为构造 scriptSig 的人完全可以先运行脚本、得到结果，再把数据放入栈中，而不是把运算放进去。我想，中本聪这样做可能是出于沿用旧设计的原因。但如果他当时考虑到，你并不需要知道一笔交易的含义，我觉得他会采用另一种设计。我认为，他就不会允许在签名脚本中使用操作码了。
So, we have this little language that the scriptSig and the scriptPubKey allow and there is an interesting question here: why did Satoshi allow opcodes in the scriptSig? The scriptSig is the part that you provide to prove that you know enough to satisfy the conditions of the transaction. So you could have a scriptPubKey that is 11 equals and you (or anybody else smart enough to work out that eleven equals eleven) satisfy it with a scriptSig that is just 11. You could also express that as 6 5 +, but there is really no reason to do that because the person who is creating the scriptSig can always just run the script, get the results and put the data on the stack instead of putting the operations on the stack. I think Satoshi probably did it this way for legacy reasons, but I think if he had been thinking about the fact that you don’t need to know the meaning of a transaction I think he would have designed it differently. I don’t think he would have allowed operators in the signature.
如果他事先想到了这一点，我认为他会意识到：不必提前给出解锁条件。实际上，我们已经为比特币引入了另一种交易类型，叫作“支付到脚本哈希”（pay-to-script-hash）。在这种交易中，完整的解锁脚本要到花费资金时才提供；转入资金时，只需提供解锁脚本的哈希。这向着分离“交易是什么意思”和“交易是否有效”迈进了一步。你可以验证转入资金的交易，却不必提前知道被锁定的资金将如何花费。
If he had been thinking ahead, I think he would have realized that you do not need to provide the redemption conditions in advance. We have actually evolved Bitcoin with another transaction type called pay-to-script-hash, where the entire redemption script is provided when the redemption happens and you just give a hash of the redemption script when you are funding the transaction. This is a step towards breaking the link between what does a transaction mean and is it valid. You can validate the funding transaction, but you don’t know in advance how the locked funds will be redeemed.
如果开始考虑把交易的含义与验证分开，棘手的地方在于：手续费怎么办？系统确实需要知道一笔交易付了多少手续费，才能确定它的优先级，并奖励矿工。理想情况下，系统可以去掉我刚才提到的最后两条验证规则。如果不必直接验证输入金额之和是否大于或等于输出金额之和，而是用某种盲化方式隐藏这些信息，同时仍能确保没有新的比特币被创造出来，那会很好。也许，去掉“不能存在双重支付”这一条件，也会有好处。你可以设想这样一种系统：只管把交易放进区块链，只要它们是正确的就行。如果发生双重支付，最终用户的钱包软件就发出警报：“有人想骗你，他们正在双重支付。”但如果把这套思路一直推演下去，问题就复杂了。系统确实需要知道交易中的哪一部分是手续费，因为这些费用要分配给矿工。这又模糊了交易含义与验证的界限，因为我付钱的对象并不是某个指定矿工，而是全世界任何恰好把我的交易打包进区块的矿工。这就暴露了交易的一部分信息。当我们思考 Zerocash [2] 或其他试图实现完全匿名的系统时，这是一个很有意思的设计问题。我想，人们还会为此探索很长时间。
The tricky bit, if you start thinking about breaking the meaning with validation, is what do you do with transaction fees. The system really wants to know what the fee is on a transaction so that it can prioritize it and reward the miner. Ideally, you’d have a system that removes the last two of the validation rules that I was talking about earlier. It would be nice if you didn’t have to validate that the sum of the inputs is greater than equal to the sum of the outputs, if that was blinded somehow and you could just be assured that no bitcoins are created. It might also be nice to get rid of the condition that there are no double-spends. You could imagine a system where you just throw transactions into the block chain and as long as they are correct it’s okay. If there are double spends then end-user’s wallet software would throw red flags and say “somebody is trying to rip you off, they are double spending”. But if you think that all the way through, that gets complicated. The system does need to know what part of a transaction is fees because those get assigned to the miner. And that is blurring meaning and validation because I am not paying a particular miner, I am paying any miner in the world who happens to mine my transaction. It exposes some knowledge about the transaction. And as we think about systems like Zerocash [2] or other systems that are trying to be completely anonymous, that’s an interesting design point that I think people are going to be wrestling with for a long time.
6. 扩展能力
6. Scaling
我不认为中本聪当时知道怎样扩展这套系统。他说过一句话：“每笔交易都必须在网络上传送两次。”但这并不正确。现在有一个很巧妙的研究方向，叫作集合协调（set reconciliation，参见文献 [5]）。简单来说，它让两台机器能够交流各自信息中的差异，而所需带宽与差异的大小成正比。因此，放到比特币的场景中，如果我找到一个新区块，就不必重新发送区块里的每一笔交易，因为在这些交易最初向网络广播时，你很可能已经收到了其中的 99.9%。这让我非常兴奋。可逆布隆查找表（invertible bloom lookup tables）[6] 现在是我最喜欢的数据结构。我正在与马萨诸塞大学的一个研究小组合作，把集合协调应用到比特币系统中。
I don’t think Satoshi knew how to scale the system. He has this quote “each transaction must be sent over the network twice”. And that’s just not true. There is this really neat current area of research of set reconciliation (cf. [5]). Basically, set reconciliation is a way for two machines to express differences in information they have using bandwidth proportional to the size of those differences. So, in Bitcoin’s case, if I find a new block, I don’t have to re-send all of the transactions that are part of that block because you probably already have 99.9 % of them from when they were originally broadcast across the network. I’m really excited about this, invertible bloom lookup tables [6] are now my current favorite data structure, and I am working with a research group at UMass on set reconciliation applied to the Bitcoin system.
7. 密码学的新进展
7. Recent Cryptography Results
2009 年以后，密码学取得了一些新成果。中本聪显然不可能知道这些成果，因为当时它们还没有被发明出来。我们当时不知道全同态加密，也不知道非交互式零知识证明或 SNARK 的实用算法（参见文献 [3]）。六年并不算很长，但如果你看看相关文献，就会发现这期间发生了很多事情。我们现在知道的，的确比当时多得多。我认为，未来六年里也会发生许多有趣的事情。
There is a number of cryptography results that have happened since 2009 that obviously Satoshi did not know about because they hadn’t been invented yet. We didn’t know about fully homomorphic encryption, and we didn’t know any practical algorithms for non-interactive zero knowledge proofs or SNARKs (cf. [3]). Six years is not very long, but if you look at the literature quite a lot has happened since then and we do know a lot more know than we knew back then. And I think there are lots of interesting things that will happen over the next six years, too.
8. 加文不知道的事
8. What Gavin Doesn’t Know
现在，我也有很多事情不知道。我不知道身份问题能否得到解决。我觉得，人们讨论的许多比特币应用，都依赖于一套良好的假名身份或信誉系统。在我看来，假名环境中仍有一些完全没有解决的问题。我还没见过一套不会受到长期布局攻击的良好系统。而且，我们确实已经在比特币世界里看到过这种攻击。丝绸之路上，有些人的信誉极好，看起来诚实可靠，贩卖毒品时也曾在一段时间里值得信赖，但最后却决定卷走所有人的钱。我不知道这个问题有没有解决办法，不过这是个有意思的问题。
There are a bunch of things that I don’t know right now. I don’t know if the identity problem is going to be solved. I think a lot of what people talk about doing in Bitcoin relies on having a good, pseudonymous identity/reputation system. It seems to me that in a pseudonymous world there are completely unsolved problems. I haven’t seen a good system that isn’t subject to long-range attacks. And we have certainly seen those happening in the Bitcoin world. We have seen people with stellar reputations on Silk Road, apparently honest, stand-up people pushing drugs that are reliable for a while but eventually decide to steal everybody’s money. I don’t know if there is a solution to that problem, but it’s an interesting problem.
隐私问题会有实用的解决方案吗？我们掌握的这些巧妙的密码学技术很棒，但我不知道它们能否扩展，也不知道成本能否降得足够低，让人们真的愿意使用。我认为，这是一个尚未解决、也很值得继续观察的问题。
Will there be a practical solution to the privacy problem? All of this neat crypto we have is fantastic, but I don’t know if it will scale and I don’t know if it will be low cost enough for people to actually to decide to use it. I think that’s an open problem that will be very interesting to watch.
我认为，概率算法和近似算法还有各种各样的工作可做。有人提出过，用不太可靠、但速度很快的硬件来挖比特币。因为只要检查挖矿运算的输出，把错误结果丢掉，那么使用一种速度极快、但同时也很不可靠的硬件，运行双重 SHA 算法的某种近似实现，也许反而效果更好、更节能。我觉得这很有意思，也想知道，是否还有其他概率算法能发挥很大的作用。一个显而易见的例子，是全节点按概率抽样检查交易。如果你没有能力检查整个网络中的每一笔交易，那就只检查一半；只要抽样是随机的，大家合起来仍然会把所有交易检查多遍，系统也就能正常运转。我感觉，也许还有其他问题，会让概率算法大有用武之地。
I think there is all sorts of work that can be done with probabilistic and approximating algorithms. There have been some ideas about using flaky but fast hardware to do Bitcoin mining. Because, as long as you check the work that comes out of Bitcoin mining and you just throw out the bad results, maybe its better and more power-efficient to have a really fast but at the same time really flaky piece of hardware that is running some approximations of the double-SHA algorithm. I think that’s interesting and I wonder if there are other probabilistic algorithms that might be incredibly useful. An obvious one is certainly full nodes probabilistically checking transactions. If you can’t afford to check every single transaction across the network then just check half of them, and as long as you do it in a random way everybody will be checking all of them several times anyway and it all works out. I have a feeling that there might be other problems where probabilistic algorithms could be really interesting.
流式算法能用来解决比特币的问题吗？据我所知，流式算法是计算机科学中一个相当活跃的研究领域。它不会把整整 18 PB 的数据都放进内存，而是在数据不断到来时逐步处理。我认为，这或许会是一个有趣的研究方向。
Can streaming algorithms be applied to Bitcoin problems? I know that there is a fairly active area of computer science research on streaming algorithms that don’t keep all 18 petabytes of data in memory but deals with data as it comes along. I think that might be an interesting area of research.
9. 结语
9. Conclusion
过去六年里，我学到了很多东西；实践是很好的老师。今后的一个挑战是：当犯错的代价越来越高时，我们怎样继续在实践中学习。像你们这样不断思考、研究和实验的聪明人，将会迎接这一挑战。
I have learned a lot in the last six years; experience is a great teacher. One challenge going forward will be to continue to learn by doing as the consequences of mistakes rise higher and higher. That challenge will be met by clever people like you, who are constantly thinking and researching and experimenting.