Bitcoin: A Peer-to-Peer Electronic Cash System

Bitcoin: A Peer-to-Peer Electronic Cash System Satoshi Nakamoto

Tag layer of the DHSS Meta-Tagging Project. The article text is reproduced from the staged copy named in sourceDesc and is not altered; the tags are held separately in standOff so that overlapping and nested spans are preserved.

Bitcoin: A Peer-to-Peer Electronic Cash System 2008 Self-published white paper (bitcoin.org) nakamoto2008-bitcoin nakamoto2008-bitcoin.txt, the project's staged copy aa20dce2fd043a530a1b6e6225cd140d95e97e42 open-access economics

the paper's own words

the tag layer; a sentence written by the tagger about the paper, always anchored to a quotation but not itself a quotation

0 spans located by searching the stored text for the quote's exact words, allowing any whitespace between them method Quotation withheld because this record is not cleared for redistribution. double-spending in electronic cash Quotation withheld because this record is not cleared for redistribution. system-or-tool-building system-or-tool-building Quotation withheld because this record is not cleared for redistribution. mechanisms proof-of-work blockchain: hash transactions into a chain secured by proof-of-work so the honest majority of computing power extends the longest chain and the record becomes practically immutable, preventing double-spending without a trusted third party Quotation withheld because this record is not cleared for redistribution. security holds only while honest nodes control the majority of CPU power (the 51% assumption) what this limits: every security claim in the paper: Quotation withheld Quotation withheld because this record is not cleared for redistribution. Security holds only under the assumption that honest nodes control the majority of CPU power. duplicate of: limitations[0] · what this limits: the same scope as limitations[0] - the majority-honest assumption Quotation withheld because this record is not cleared for redistribution. Simplified payment verification can be deceived while an attacker overpowers the network. what this limits: simplified payment verification specifically: THE VERIFICATION IS RELIABLE AS LONG AS HONEST NODES CONTROL THE NETWORK, BUT IS MORE VULNERABLE IF THE NETWORK IS OVERPOWERED Quotation withheld because this record is not cleared for redistribution. The privacy scheme cannot prevent all linkage between transactions of one owner. what this limits: the privacy claim: SOME LINKING IS STILL UNAVOIDABLE WITH MULTI-INPUT TRANSACTIONS, WHICH NECESSARILY REVEAL THAT THEIR INPUTS WERE OWNED BY THE SAME OWNER Quotation withheld because this record is not cleared for redistribution. The security claim is conditional on a distributional fact about who owns computing power, which no participant can check. what this limits: the claim that this system removes the need for trust: it is secure as long as honest nodes collectively control more CPU power than any cooperating group of attacker nodes, a condition about the distribution of hardware rather than a property of the cryptography Quotation withheld because this record is not cleared for redistribution. The deterrent is economic rather than cryptographic: it assumes an attacker who prefers the more profitable option. what this limits: the claim that an attack is infeasible: an attacker with a CPU majority is argued to be deterred by preferring to generate new coins over defrauding people, which is an assumption about the attacker's motives and not about what the attacker can do Quotation withheld because this record is not cleared for redistribution. Privacy is pseudonymity, and the paper names the exact way it fails. what this limits: any description of this system as anonymous: privacy is maintained by keeping public keys anonymous, and the paper states that if the owner of a key is revealed, linking could reveal the other transactions belonging to that owner Quotation withheld because this record is not cleared for redistribution. The lightweight verification method is defeasible for as long as an attack lasts. what this limits: a payment accepted through simplified verification: the paper states Quotation withheld because this record is not cleared for redistribution. The feasibility argument for storage rests on a hardware extrapolation made in 2008. what this limits: the claim that block headers can be kept in memory: it rests on 2008 machines shipping with 2GB of RAM and on Moore's Law predicting growth of 1.2GB per year Quotation withheld because this record is not cleared for redistribution. using cryptographic proof (hashes, digital signatures, proof-of-work) to build a currency and payment system with no trusted third party Quotation withheld because this record is not cleared for redistribution. an adversarial calculation of the probability that an attacker generating an alternate chain overtakes the honest chain eliminates: that a slower attacker could rewrite the transaction history by catching up with the honest chain · outcome: held Quotation withheld because this record is not cleared for redistribution. proof-of-work proof-of-work Quotation withheld because this record is not cleared for redistribution. electronic coin electronic coin Quotation withheld because this record is not cleared for redistribution. chain of digital signatures chain of digital signatures Quotation withheld because this record is not cleared for redistribution. longest chain longest chain Quotation withheld because this record is not cleared for redistribution. timestamp server timestamp server Quotation withheld because this record is not cleared for redistribution. the chain - NEVER 'blockchain': the paper's own names for its central object are a chain of digital signatures and a chain of ownership, and the compound the entire field later settled on appears nowhere in the document that introduced the thing Quotation withheld because this record is not cleared for redistribution. majority - AS CPU POWER, NOT AS HEADS: the paper rules out one-vote-per-participant explicitly, so 'majority decision' and 'consensus' here mean the greatest expenditure of computation and not what those words mean in any deliberative sense Quotation withheld because this record is not cleared for redistribution. privacy - AS A BREAK IN THE FLOW OF INFORMATION, NOT AS SECRECY: everything is announced publicly and privacy is obtained only by keeping the keys unattributed, which the paper likens to a stock exchange tape that prints every trade without the parties Quotation withheld because this record is not cleared for redistribution. contradicts → the trusted-third-party (financial-institution) model Quotation withheld because this record is not cleared for redistribution. builds-on → Adam Back's Hashcash [6] Quotation withheld because this record is not cleared for redistribution. electronic coin —operationalised-as→ chain of digital signatures electronic coin chain of digital signatures the relation itself is separately evidenced · strength of the relation: 1 · the relation stated: the coin IS the signature chain - the paper defines it that way outright Quotation withheld because this record is not cleared for redistribution. longest chain —operationalised-as→ proof-of-work longest chain proof-of-work strength of the relation: 1 Audit 2026-09-28: DOUBTFUL - read against its span and kept, but the span says the longest chain has the greatest proof-of-work invested; operationalised-as is a loose reading. Quotation withheld because this record is not cleared for redistribution. A peer-to-peer network solves the double-spending problem by timestamping transactions into an ongoing chain of hash-based proof-of-work that cannot be changed without redoing the work. Quotation withheld because this record is not cleared for redistribution. The system stays secure while honest nodes together hold more CPU power than any colluding group of attackers. Quotation withheld because this record is not cleared for redistribution. proof-of-work proof-of-work Quotation withheld because this record is not cleared for redistribution. Merkle Tree Merkle Tree Quotation withheld because this record is not cleared for redistribution.

The full text of this article is not redistributable, so it is not included here. The evidence sentences are withheld with it; the tag layer and its grounding status remain. The article itself is at https://bitcoin.org/bitcoin.pdf.