Bitcointalk · Not a suggestion

中本聪,2010 年 8 月 11 日

SN-2245 已核对来源,附原文与上下文。

阅读语言
中文译文

这是个非常有趣的话题。倘若找到了解法,就能实现一种好得多、更容易、更方便的 Bitcoin。

最初,一枚币可以只是一串签名。有了时间戳服务,旧的可以在回溯扇出过大之前逐步丢弃,或者硬币可以单独或按面额保存。需要检查不存在双重支出,才是需要全网知晓所有交易的原因。

挑战在于:如何证明不存在其他花费?看来节点必须知道所有交易才能验证这一点。倘若它只知道 in/outpoint 的哈希,它就无法检查签名以确认某个 outpoint 是否被花过。对此你有什么想法?

很难想出如何在这种情况下应用零知识证明。

我们要证明的是某种东西*不存在*,而这似乎要求知道全部、并检查那个东西不在其中。

ORIGINAL · 英文原文
This is a very interesting topic.  If a solution was found, a much better, easier, more convenient implementation of Bitcoin would be possible.

Originally, a coin can be just a chain of signatures.  With a timestamp service, the old ones could be dropped eventually before there's too much backtrace fan-out, or coins could be kept individually or in denominations.  It's the need to check for the absence of double-spends that requires global knowledge of all transactions.

The challenge is, how do you prove that no other spends exist?  It seems a node must know about all transactions to be able to verify that.  If it only knows the hash of the in/outpoints, it can't check the signatures to see if an outpoint has been spent before.  Do you have any ideas on this?

It's hard to think of how to apply zero-knowledge-proofs in this case.

We're trying to prove the absence of something, which seems to require knowing about all and checking that the something isn't included.
来源
Bitcointalk 原始链接 ↗ 记录编号 SN-2245