COURSE CODE COURSE TITLE LTP C

BCSE325L INTRODUCTION TO BITCOIN 3003

Course Handling Faculty Member

Dr. T. Sivakumar
Associate Professor Sr
School of Computer Science and Engineering (SCOPE)
Vellore Institute of Technology
sivakumar.t@[Link]
Cabin: PRP Block G19-F

7/18/2025
 Bitcoin (BTC)
• The first cryptocurrency
• Created by Satoshi Nakamoto and Martti Malmi during 2007
• A form of digital currency that uses blockchain technology to support
transactions between users on a decentralized network
• A decentralized form of digital cash
• eliminates the need for traditional intermediaries like banks and
governments
• Can be used as a currency or an investment
 Cryptocurrencies
• All currencies (Flat / Crypto) need some way to control supply and enforce
various security properties to prevent cheating
• Cryptocurrencies too must have security measures that prevent people from
tampering with the state of the system, and from equivocating, i.e., making
mutually inconsistent statements to different people

• Example:
• If Alice convinces Bob that she paid him a digital coin, she should not be able to
convince Carol that she paid her that same coin

• But unlike fiat currencies, the security rules of cryptocurrencies need to be

enforced purely technologically and without relying on a central authority
 Cont…
• Cryptocurrency is a medium of exchange, created and stored electronically on
the blockchain
• Uses cryptographic techniques to verify the transfer of funds and an algorithm
to control the creation of monetary units
• Has no intrinsic value in that it is not redeemable for another commodity,
such as gold
• Has no physical form and exists only in the network
• Its supply is determined by the protocol, not a central bank and the network
is completely decentralized
Module 1

Fundamentals of Cryptography
• Cryptographic Hash Functions

• Hash Pointers and Data Structures

• Digital Signatures

• Public Keys as Identities

• A Simple Cryptocurrency
 Introduction to Cryptography
• Cryptocurrencies make heavy use of cryptography
• to prevent tampering and equivocation
• to encode the rules for creation of new units of the currency
• Two primitives to be very useful for building cryptocurrencies
• Cryptographic hashes
• Digital signatures
Cont …
Introduction to Cryptography
• eMudhra
• Capricorn CA
• Verasys
• IDSign
• Vsign
• PantaSign
• Docusign
• Prodigisign
• Capricorn

• Digital Signature Service Provider (DSSP) - licensed Certifying Authorities

(CAs) authorized by the Controller of Certifying Authorities (CCA) in India.
 Cryptographic Hash Functions

• A hash function is a mathematical function with the following three properties:

1. input can be any string of any size
2. produces a fixed size output.
3. efficiently computable - for a given input string, you can figure out what the
output of the hash function is in a reasonable amount of time
• computing the hash of an n‐bit string should have a running time of O(n)
• Properties of a hash function:
• (1) Collision‐resistance
• (2) Hiding
• (3) Puzzle‐friendliness
Hash Property 1: Collision‐resistance
• A collision occurs when two distinct inputs produce the same output.
A hash function H(.) is collision‐resistant if nobody can find a collision

• A hash collision: x and y are distinct values, yet when input into hash
function H, they produce the same output
Collision do exist…

… But can anyone find them?

• Because the number of inputs exceeds the number of outputs, we are

guaranteed that there must be at least one output to which the hash
function maps more than one input
How to find a collision?
• to find a collision for a hash function with a 256‐bit output size: pick 2256 + 1 distinct
values (worst case), compute the hashes of each of them, and check if there are any
two outputs are equal. [2128 – average case)]

• Since we picked more inputs than possible outputs, some pair of them must collide

if a computer calculates 10,000 hashes

per second, it would take more than one
octillion (1027​) years to calculate
2128 hashes!
Application: Hash as message digest
• If we know that two inputs x and y to a collision‐resistant hash function H are
different, then it’s safe to assume that their hashes H​ (x) and H (y) are different

• Message: bitcoin

• Hash Code:

• SHA-256: 6b88c087247aa2f07ee1c5956b8e1a9f4c7f892a70e324f1bb3d161e05ca107b

• SHA-1: ed1b8d80793e70c0608e8a8508a8dd80f6aa56f9

• MD5: cd5b1e4947e304476c788cd474fb579a
Hash Property 2: Hiding

• Given H(x), it is infeasible to find x

Hiding Property
• A hash function H is hiding if:

• When a secret value r is chosen from a probability distribution that has high min‐entropy,
then given H(r ‖ x) it is infeasible to find x

• High min-entropy means that the distribution is 'very spread out', (random variable) so
that no particular value is chosen with more than negligible probability

• Negligible probability: Every individual value is very unlikely to be chosen

• Example:

• If r is chosen uniformly from among all of the strings that are 256 bits long, then any
particular string was chosen with probability 1/2256, which is a very small value.
Application of Hiding: Commitment

“Want to ‘seal a value in an envelope’,

put the envelope on the table where everyone can see it,
the value remains a secret from everyone else’
later open the envelope and reveal the value”

“Commit to a value, reveal it later”

Commit and verify Phase

• We require that the following two security properties hold:

• Hiding : Given com, it is infeasible to find msg
• Binding : It is infeasible to find two pairs msg and msg’ such that msg ≠ msg’
and commit (msg) = = commit (msg’)
Cont …
commit(msg, nonce)​ := H(​ nonce ‖ msg ),
where, ​ nonce​ is a random 256‐bit value
• Every time you commit to a value, it is important that you choose a new random
value as nonce.
• In cryptography, the term nonce is used to refer to a value that can only be used only
once.
Security Properties: Hiding & Binding
1. Hiding: Given H(key | msg), it is infeasible to find msg
• Goal: Keep the message secret until to reveal it
• Since the key is random and secret, even if someone sees H(key | msg) they
cannot learn msg
• Based on the pre-image resistance of hash functions
2. Binding: It is infeasible to find msg ≠ msg′ such that H(key|msg) ==
H(key|msg′)
• Goal: Prevent from changing the message later
• Once you have committed to msg, you can’t switch to a different msg′ without
being caught
• Based on the collision-resistance of the hash function
Hash Property 3: Puzzle friendliness

• Puzzle friendliness

• It is computationally hard to find an input that gives a desired

output, even partially.

• A hash function H is said to be puzzle‐friendly if for every possible

n‐bit output value y, if k is chosen from a distribution with high
min‐entropy, then it is infeasible to find x such that H(k ‖ x) = y in
time significantly less than 2n
Application: Search Puzzle
• ​A mathematical problem which requires searching a very large space
in order to find the solution. In particular, a search puzzle has no
shortcuts.

• That is, there’s no way to find a valid solution other than searching that
large space.
Search Puzzle …
• A search puzzle consists of

• a Hash function H,

• a value id, (called “puzzle ID”) chosen from high min-entropy distribution

• and a target set Y:

• Try to find a “solution” x such that

H(id | x) ∈ Y
• Solving the puzzle requires finding an input so that the output falls within the set Y

• The size of Y determines how hard the puzzle is

• Bitcoin mining: is a sort of computational puzzle

Hash Function: SHA-512
• Summary of the session
Cryptocurrencies
Introduction to Cryptography
Cryptographic Hash Functions
Properties of a Hash Function
Hash Pointers and
Data Structures
Hash Pointers and Data Structures
• Hash pointer
• A hash pointer is a pointer to where some information is
stored together with a cryptographic hash of the information.
Block chain - A linked list that is built with hash pointers

Genesis
Block

• Each block not only tells us where the value of the previous block was, but it also
contains a digest of that value that allows us to verify that the value hasn’t changed
• We store the head of the list, which is just a regular hash‐pointer that points to the
most recent data block
 Tamper‐evident log

• If an adversary modifies data anywhere in the block chain, it will result in

the hash pointer in the following block being incorrect
• If we store the head of the list, then even if the adversary modifies all of
the pointers to be consistent with the modified data, the head pointer
will be incorrect, and we will detect the tampering
Tamper‐evident log
Merkle trees
• A binary tree with hash pointers is known as a Merkle tree, named after
its inventor Ralph Merkle
• In a Merkle tree, data blocks are grouped in pairs and the hash of each of
these blocks is stored in a parent node
• The parent nodes are in turn grouped in pairs and their hashes stored
one level up the tree
• This continues all the way up the tree until we reach the root node
 Example for Merkle tree

any attempt to tamper with any piece of data will be detected

by just remembering the hash pointer at the top.
 Proof of membership
• Someone wants to prove that a certain data
block is a member of the Merkle Tree
• As usual, we remember just the root
• Then they need to show us this data block,
and the blocks on the path from the data
block to the root
• We can ignore the rest of the tree, as the
blocks on this path are enough to allow us
to verify the hashes all the way up to the
If there are n nodes in the tree,
root of the tree only about log(n) items need
A proof of membership (also called Merkle proof) is a way to prove
to be shown
that a given data item (like a transaction) is part of the Merkle tree without revealing the whole dataset.
A sorted Merkle tree

• Blocks at the bottom should be sorted using some ordering function

• Alphabetical, lexicographical order, numerical order, or some other

agreed upon ordering

Proof of non‐membership
• With a sorted Merkle tree, it becomes possible to verify
non‐membership in a logarithmic time and space – O(log n)

• Showing a path to the item that’s just before where the item in question
would be and showing the path to the item that is just after where it
would be

• If these two items are consecutive in the tree, then this serves as a
proof that the item in question is not included
A proof of non-membership in a Merkle tree is a cryptographic proof that shows a particular element does not exist in
the set represented by the tree.
Digital Signatures
 Digital Signatures
• the second cryptographic primitive, along with hash functions, that we
need as building blocks for the cryptocurrency

• two properties:
• only you can make your signature, but anyone who sees it can verify
that it’s valid
• the signature to be tied to a particular document so that the signature
cannot be used to indicate your agreement or endorsement of a
different document.
 Digital Signatures

• A digital signature scheme consists of three algorith

ms:
• generateKeys – randomized algorithms
• Signing - randomized algorithms
• Verification - deterministic
 Digital Signatures
• A digital signature scheme consists of three algorithms:
 Digital Signatures - Unforgeability

• it’s computationally infeasible to forge signatures

• i.e, an adversary who knows your public key and gets to see your
signatures on some other messages can’t forge your signature on
some message for which he has not seen your signature.
Digital Signatures – Unforgeability Game

• ​If the attacker is able to

successfully output a
signature on a message that
he has not previously seen, he
wins.

• If he is unable, the challenger

wins and the digital signature
scheme is unforgeable.
 Digital Signatures - Practical Concerns

• signature algorithms are randomized and we therefore need a good source of

randomness.

• there’s a limit on the message size that you’re able to sign because real schemes
are going to operate on bit strings of limited length. Easy way: sign the hash of
the message, rather than the message itself.

• ECDSA: Elliptic Curve Digital Signature Algorithm – U.S Govt Std

• Private key : 256 bits
• Public key : 512 bits
• Message to be singed : 256 (SHA)
• Signature : 512 bits
 Public Keys as Identities

• Public key can function as an identity,

particularly in systems like blockchain
and public key infrastructure (PKI).

• This means the public key is used to

identify and verify the authenticity of a
user or entity, while the corresponding
private key remains secret, allowing the
owner to digitally sign messages or data.
 Public Keys as Identities

• If you see a message with a signature that verifies correctly under a public
key, pk​, then you can think of this as pk is saying the message.

• In order for someone to speak for the identity, they must know the
corresponding secret key, sk.

• you can make a new identity whenever you want - you simply create a new
fresh key pair, sk and pk​, via the generateKeys operation.

• pk is the new public identity that you can use, and sk is the corresponding
secret key that only you know
 Public Keys as Identities

• ​In practice, you may use the hash of ‘pk’ as your identity since public keys
are large.

• If you do that, then in order to verify that a message comes from your
identity, one will have to check
(1) that pk indeed hashes to your identity, and
(2) the message verifies under public key - pk
 Decentralized Identity Management

• If you want a new identity, you can just generate one at any time, and you can make
as many as you want.

• If you prefer to be known by five different names, no problem! Just make five
identities.

• If you want to be somewhat anonymous for a while, you can make a new identity, use
it just for a little while, and then throw it away.

• All of these things are possible with decentralized identity management, and this is
the way Bitcoin does identity. These identities are called addresses​, in Bitcoin jargon.
• Summary of the session
Hash Pointers and Block chain
Merkle trees
Digital Signature
Practical Concerns of Digital Signature
Public Keys as Identities
Decentralized Identity Management
A Simple Cryptocurrency
 A Simple Cryptocurrency - GoofyCoin

• Rule:

1. Goofy can create new coins

2. Whoever own the coin can pass it on to someone else
 GoofyCoin – Rule 1
1. To create a coin, Goofy generates
a unique coin ID uniqueCoinID
and constructs the string
“CreateCoin [uniqueCoinID]”
2. He then computes the digital
sk
signature of this string with his
secret signing key
3. The string, together with Goofy’s
signature, is a coin
4. Anyone can verify that the coin
contains Goofy’s valid signature
of a CreateCoin statement, and is
therefore a valid coin
GoofyCoin – Rule 2 Pass on to Another user [Alice]

sk – secret key

sk

sk
 Rule 2 – Summary
• Goofy wants to transfer a coin that he created to Alice

• He creates a new statement that says “Pay this to Alice” where “this” is a hash pointer that references the coin

• Identities are really just public keys, so “Alice” refers to Alice’s public key

• Finally, Goofy signs the string representing the statement. Since Goofy is the one who originally owned that

coin, he has to sign any transaction that spends the coin.

• Once this data structure representing Goofy’s transaction signed by him exists, Alice owns the coin. She can

prove to anyone that she owns the coin, because she can present the data structure with Goofy’s valid signature

• Furthermore, it points to a valid coin that was owned by Goofy. So, the validity and ownership of coins are

self‐evident in the system

GoofyCoin - A coin that’s been created (bottom)
and spent twice (middle and top).…

sk

sk

sk

sk – secret key
Alice spends the coin to Bob
• Once Alice owns the coin, she can spend it in turn
• To do this she creates a statement that says, “Pay this coin to Bob’s public
key” where “this” is a hash pointer to the coin that was owned by her. And
of course, Alice signs this statement [She is the owner now]
• Anyone, when presented with this coin, can verify that Bob is the owner
• They would follow the chain of hash pointers back to the coin’s creation and
verify that at each step, the rightful owner signed a statement that says “pay
this coin to [new owner]”
Summary – The rules of GoofyCoin
1. Goofy can create new coins by simply signing a statement that he’s making
a new coin with a unique coin ID
2. Whoever owns a coin can pass it on to someone else by signing a
statement that saying, “Pass on this coin to X” (where X is specified as a
public key)
3. Anyone can verify the validity of a coin by following the chain of hash
pointers back to its creation by Goofy, verifying all of the signatures along
the way
 Issue with GoofyCoin

sk – secret key
sk sk

sk

Alice is spending the same coin twice

sk

Main design challenge in designing Cryptocurrencies

 A Simple Cryptocurrency - Scrooge Coin
• The first key idea is that a designated entity called Scrooge publishes an
append‐only ledger containing the history of all the transactions
• The append‐only property ensures that any data written to this ledger will
remain forever.
• If the ledger is truly append‐only, we can use it to defend against
double‐spending by requiring all transactions to be written the ledger
before they are accepted
• That way, it will be publicly visible if coins were previously sent to a
different owner
A Simple Cryptocurrency - Scrooge Coin

signed
He doesn’t
endorse
transaction that
attempts to
double-spend
 A Simple Cryptocurrency - Scrooge Coin
• 1. CreateCoins

pk
If scrooge puts these
coins into the history,
which he signs then it
is valid.
 A Simple Cryptocurrency - Scrooge Coin
• 2. PayCoins

Append it to the block

chain, if valid. After
which everyone can see
this transaction
 A Simple Cryptocurrency - Scrooge Coin

• Immutable Coins - Coins can't be changed, subdivided, or combined

• But: you can get the same effect by using transactions

• To subdivide:
1. create new transactions
2. consume your coin
3. pay out two new coins to yourself
• i.e two coins of the same total value
 A Simple Cryptocurrency - Scrooge Coin
• Core Problem…

Can we have a cryptocurrency that

operates like ScroogeCoin in many ways,
but doesn’t have any central trusted
authority?
 A Simple Cryptocurrency - Scrooge Coin
• Decentralization?

• How people agree upon a single published blockchain - history of

transactions?

• How people can agree which transactions are valid and which transactions are
really occurred?

• How to assign ID to transactions in a decentralized way?

If we are able to address all these problems, we will be able to have a

cryptocurrency similar to Scoorge coin but in a decentralized way …