Security Confidential S14 E9 Max Hillebrand

Manoj Tandon: Hello everyone, this is your host Manoj Tandon. Welcome to another episode of Dark Rhino Security: Security Confidential. Today we have a first—at least on Security Confidential. In nearly 150 guests, this is the first time we are honored to have Max Hillebrand join us. He is all things crypto and blockchain.

It’s the first time we’ve covered this topic; we are eager to do it. For those of you who want to learn a little bit about Max, he’s got a great background. He’s the CEO of zkSNACKs and Wasabi Wallet—very interesting names, and we’ll ask him about that here in a second.

But he is a pioneering figure in the realm of privacy and cryptocurrency wallets. He’s dedicated to open-source; he’s an open-source contributor on liberty and digital freedom. He champions non-scarcity in the digital realm, sharing his creations generously. He’s a great guy; we’re honored to have him here. Max, thank you for being here.

Max Hillebrand: Appreciate it. Well, thank you, Manoj, for the invitation and for the introduction. I’m really excited about this conversation. As you say, so far on the podcast, you haven’t talked much about Bitcoin, and I guess it’s long overdue. Bitcoin is ancient tech by now, and there’s definitely a lot of excitement and new interesting topics to explore there. So I’m really curious to…

Manoj Tandon: Yeah, and you know, it comes at an ideal time because we are seeing a convergence in many ways. You know, Bitcoin and ransomware have somewhat become synonymous for the wrong reasons. We see quantum computing coming online, which brings into question what the future looks like for cryptography, and that’s the backbone of blockchain here, right? And then we have AI, and what does that do? Does that do anything for mining and the compute power that’s going?

So there’s so many things here to discuss. I don’t even know where we’ll start, but one place that our audience is going to want to know about, because they always want to know about this, is: what’s your beginning, Max? Where do you originate from? How did you get into this world?

Max Hillebrand: Yeah, my first passion was definitely economics and entrepreneurship. This was something that I studied from quite early on in life, and eventually found the Austrian School of Economics, which is a fascinating school of thought that really just makes a lot of sense. It’s very applicable on what it means to be human and to work and to be productive. It’s really quite fascinating.

And so that really just sparked my interest in all of these things: economics, finance, banking, until I eventually just discovered Bitcoin. So, the first time actually I heard about Bitcoin, like so many others, I ignored it, even though I had a great understanding of Austrian economics, which is arguably the foundation of Bitcoin. I still didn’t quite get it, and I believed it was because I hadn’t thought much about technology at that point.

A couple years later, a friend introduced me to Linux and helped me install Ubuntu and just shared the idea of free and open-source software, and I found it fascinating because it resonates very well with Austrian economics and praxiological thought: that information is non-scarce. We don’t need to keep it to ourselves; we can share it with whoever wants it for basically free.

Manoj Tandon: So then how do zkSNACKs and Wasabi Wallet come into play here, then?

Max Hillebrand: Yeah, exactly. Because ultimately, zkSNACKs is a company working on some projects that are, well, free and open-source, right? Meaning, in the sense that we don’t have a trademark on Wasabi Wallet; we don’t have any intellectual property on it. The code is free and open-source under the MIT license. And so you can use it and do whatever; you can read it, you can change it, you can publish it again, you could sell it, right? Whatever you want to do with this code because it’s not ours; it’s just patterns in logic that some of us have articulated.

Manoj Tandon: Yeah, so these applications, the code as it sits today, I assume that it is designed for managing cryptocurrency? Would that be a correct assumption?

Max Hillebrand: Yeah, exactly. So, Wasabi Wallet is a Bitcoin wallet and so fundamentally it does a couple things. You can generate private keys with it and derive public keys from this, as well as sign messages. So that’s the first thing: you create and manage your private keys. You can either do that on the laptop that Wasabi runs on, or you could even connect it to a hardware wallet. Those are basically hardware secure modules that store your private keys. So you have something like a remote signer that you can connect to Wasabi Wallet to keep your private keys secure.

The second part is Wasabi Wallet finds out if you ever received money onto these public keys in the Bitcoin blockchain. So we synchronize the Bitcoin blockchain in a private manner so that you can find out if those public keys are ever mentioned on the Bitcoin blockchain, meaning you have some Bitcoin now. Meaning you can receive and find out how much money you have received, and then of course you can wait. You know, the thing that you usually do with money is save it for a future time, and you don’t have to do anything to save the money in Wasabi Wallet other than, of course, keeping a backup of your private keys, which is just a convenient set of 12 words that you have to write down plus an additional passphrase for extra security.

And ultimately, you can also send your Bitcoin to other people. All you need to send someone else Bitcoin is to have their public key—their Bitcoin address—and that the other person generates on his phone or laptop or wherever he manages his private keys with. And then you can send payments or money—Bitcoin—to this other party.

And I guess the caveat of Wasabi Wallet is that throughout all of these steps, we prioritize user security and privacy most. So we have numerous cryptographic tricks and protocols under the hood that ensures that no sensitive user information is leaked to the public.

Manoj Tandon: But there’s a lot of people who are probably listening that are not dealing in cryptocurrencies. Can you take like a couple minutes and give us the primer on crypto? Like what’s the basics here of Bitcoin or Ethereum or whatever? There’s so many; there’s a couple out there now at this point. What’s the background on this? How does this mechanism work?

Max Hillebrand: Well, since the 1980s, cryptographers and researchers have been hunting for this idea of money in cyberspace and how we can send each other payments securely, so that, of course, you only want to send the payment to one party.

Going back to the thing of scarcity, if I have a PDF and I send it to you, you cannot stop me from sending the same file to 10 other people. And again, that’s great for information; information longs to be free. However, it’s not so good for money. If you have one gold coin and all of a sudden you can spend the same gold coin 10 times, then the money starts to break quite quickly.

So we need to have a, let’s say, record-keeping mechanism, a time-keeping mechanism in cyberspace that ensures that a coin can only be spent once, meaning that the first time a transaction is made, it’s a valid transaction, but if someone else would propose a second transaction spending the same coin, then that would be denied, right? So we basically need access rights to a digital database that manages which transaction came first.

And already back in 1983, we have a beautiful cryptographic solution for this by David Chaum called ecash, utilizing Chaumian blind signatures—a quite clever cryptographic trick where you have many clients and one server, and the server is basically there to do the time-stamping. And coins are fundamentally a signature of that server. And whenever this signature—the token—gets spent, the user also has to tell the server, “Hey, I’m spending this coin and I want to receive a new coin on a new address.” Please ensure that this is the first valid transfer and make sure that in the future no further attempts of spending this money will be done.

So, extremely simple solution, absolutely beautiful. It scales to millions of transactions per second; it’s very, very fast. It’s extremely private because of the clever trick of blind signatures. But one big downside is it’s just one guy and one computer that has this magic private key and this time-keeping record of generating new tokens and ensuring that they can be spent later.

And well, as Nick Szabo would say, “trusted third parties are security holes.” And here we have a third party whom we trust with the record-keeping of our money, right? Which is of course a very sensitive thing. As we’ve seen in the past, authority over money has frequently been abused, both in the terms of censorship—that transactions are not allowed to go through—in other words, theft, right? Or direct theft as well. You know, you could take the money of someone else and say, “No, he can no longer spend the money, but I can.” And then finally, inflation. You can increase the money supply literally at the click of a button; you issue millions of cryptographic signatures which are all tokens that are defined as money.

And so there are numerous flaws with this problem of having a single entity being the record-keeper of who has which coins.

Manoj Tandon: Okay, so why do this? Why do a digital currency in the first place? We already have the dollar, we have the euro, we have all these very… we have gold, we have silver, we have all these mechanisms. Why bring into existence a medium that’s purely digital?

Max Hillebrand: Well, because we want to make digital payments, right? You go online, you find a great thing to buy, but how do you give the merchant money? It’s easy to give the merchant the message of, “Hey, I would like to buy this good,” thanks to the internet. But how would we ever pay him with digital means of payment? That’s a huge problem, right?

And again, I’m still in a timeline back in 1983, right before the actual internet even existed, the World Wide Web, etc. So this is a very early problem in computer science, let’s say. But an obvious one, right? We want to make cyberspace payments.

Well, nowadays we have credit cards and such, which again have the problem of being a single entity—Visa or Mastercard—that controls the time-stamping of these transactions. The validity and the security are in the hands of these tremendous central points of failure, right? To whom a substantial amount of trust has to be given. And yes, I guess it works, right? You know, most people have credit cards and debit cards and online banking and such.

But ultimately, it’s not that great, right? It would be great to have an internet that is free from single points of failure, one that just works for everyone and that is not easy to shut down. And that is the big problem. Now, even further, with for example credit cards, privacy is another big problem that was introduced, whereas in 1983 we had the technology for perfectly private transactions in cyberspace—something that humanity was used to for millennia before that point. And now with recent banking technologies, financial privacy is basically non-existent. And that is quite a substantial tragedy and quite an existential risk, I would say, for the flourishing of humankind.

But then basically we enter Bitcoin, right? So, Satoshi Nakamoto was this genius computer scientist who put together numerous building blocks from past Cypherpunks—things like private-public key cryptography, things like SHA-256 hashing algorithms, and proof-of-work based on hashing algorithms. All of these really ancient technologies and super simple building blocks were put together in a very fascinating way where we say: instead of having a single database of time-keeping for each coin on a single server, we allow anyone to read this database and have the full database available of what are the coins and which public key protects these coins, etc.

Manoj Tandon: How is it then that people lose Bitcoins, or you hear that an exchange failed and it’s all gone, if it’s not a single point of failure? First of all, how is that happening? Like, if I sent you a Bitcoin, is that being… is that not in some central database, or is that scattered all across the world somewhere? And if it’s scattered all across the world, is it replicated or is only parts of it at each place? And if it’s only… if it’s replicated, or even if parts of it are at each place, how do people manage to lose all their Bitcoin, or how do they vanish when an exchange fails?

Yeah, those are excellent questions because it’s distributed. So yeah, again, they might be really dumb questions actually for a novice, but I’m asking. And I know there’s audience members that are probably thinking, “I want to know that. That’s pretty basic. How does that work?”

Max Hillebrand: I guess the difference to highlight here is that we have a distributed database that’s perfectly replicated on tens of thousands, hundreds of thousands of computers. However, this transaction database stores the reference to these coins.

However, access rights to move these coins requires a cryptographic key and a cryptographic signature. So, you can lose your access rights to coins that are stored on the blockchain on numerous other computers because your private keys, of course, are not on the public blockchain. Your private keys are private and they should be kept secure.

And so here there is a difference where in the old Chaumian ecash technology world, if you had a signature—let’s say a secret—you had the money, right? This signature was as good as the money. And if only you knew it—nobody else, even the service provider, did not know the secret—that was the money. So the rule is: whoever has the secret and whoever tells it first to the central service provider, he gets to spend the coin.

But with Bitcoin it’s different. The transactions themselves and the coins are on a distributed server, so everyone sees them. However, access rights to move those coins remains on private computers of individuals.

But maybe to take a step back: so now we want to have a money system where we don’t just have a single server defining the rules and verifying the rules and enforcing the rules; we would like to distribute this responsibility. And the way to do that is quite simple… or well, not so quite simple, but first we need to have a clearly defined set of rules on how a transaction must look like, right? So this is a computer protocol just like HTTP or TCP, etc. There’s a certain standard on how the bits and bytes need to be arranged in order for a certain package of information to be considered valid, right? If you have a random array of bits and bytes, that’s not a valid HTTP package, for example.

And similar with Bitcoin: you need to follow a certain set of rules. And the rules are quite simple. So, we have a transaction and this transaction has inputs and outputs. The output of a transaction is the destination of the payment, basically. So, where is the money going to? And it has an amount of how much money we are sending here and a public key or, more accurately, a script, meaning the definition of a spending condition. Under which condition can this coin that is being created on the output side of the transaction be sent in the future?

And there’s a script language—a programming language—that defines the validity of these conditions. There are things like signature checks with the ECDSA signature scheme; there are, for example, hashes, so you need to reveal a pre-image to a hash; there are time-locks; there are multi-signatures, meaning two out of three signatures from three different private keys are required. All of these can be defined in the spending condition of a coin, which is again on the output side of a transaction. A coin is an address, meaning a public key or script, with an amount.

And then the question, of course, is: where does that money come from? Why does this public key all of a sudden get money? And so the rule is: on the transaction, there cannot only be outputs; there must be an input as well. And the input to a transaction is a reference to a previous transaction outpoint.

And so, basically, when you want to spend a coin on the input side of a transaction, you need to prove that you have received a coin in the past, and you do that by pointing to, “Hey, look at this transaction with this ID number. That’s the coin that I got right here, input number zero.” That was the coin that I got.

And so this is the input side of a transaction: a reference of the coin that is being spent, as well as a signature—a witness—that proves the authority over this coin. And so we check on what was the spending condition originally defined when that coin was created. Let’s say it was just a single public key; then later, when that coin is spent, we check: is there a signature that is valid to that public key? And the signature has to be over the transaction itself. So in Bitcoin, we sign the entire transaction—the inputs and outputs of where the money goes to. That is being signed with a cryptographic signature by the public key that is referenced in the address of a coin that was received in the past.

Manoj Tandon: Okay, so then this brings up two questions. What is zero-zero? At some point, a coin has to come into existence that didn’t have any transaction prior to it. And then the second point is that from what you’re describing, there really is no privacy in the transaction, because if I have to verify both the inputs and the outputs, that means I know exactly how that coin has traveled from A to B to C to D to E, right? So then why use it for ransomware money collection? It should be easy to tell who got the money.

Max Hillebrand: Well, those are two excellent questions, and yeah, that’s exactly the case. So, there’s a huge privacy concern here, because whenever you make a transaction, you need to prove where you got the money from in the past. That’s not private at all. That’s the biggest criticism of Bitcoin since day one.

And to your point of where does the money come from, right? How does this whole chain start? That’s another great observation.

And this then, well, basically… so to get that, let’s first step to another quick aside. So now that we have this transaction—spending inputs, receiving outputs, being signed by the controller of the person who knows the private key—now we have this transaction, but what do we do with it? In the past, you just would send it to the central server and say, “Hey, here’s the transaction. Please process it.” But now we don’t have a central server anymore.

So the way Bitcoin solves it is genius: anyone can write data to this block, to this database. The person who wants to make a transaction can simply write it by himself on the database, and then there’s a peer-to-peer network where we distribute this database to every user. Basically, everyone gets a copy of this.

And you know, that sounds crazy, though. What do you mean, we give anyone access rights to write stuff on this database? That’s ridiculous. It’s like the old bulletin boards and IRC servers back in the past.

Manoj Tandon: So then I should be able to create as much Bitcoin as I want. Why, if I can write to it, why don’t I?

Max Hillebrand: Exactly, right. So that’s the other thing: how do we ensure that only correct transactions get written there? And so there’s two problems. If anyone can just write data anonymously—you don’t need to sign up or anything, you can just do it—then, of course, the problem is everyone will start writing all types of data. They might be invalid data according to our protocol—just stuff that’s not inputs and outputs in the transaction—or it might even be valid transactions but just millions and millions of them. And all of a sudden we have gigabytes, terabytes of transactional data that we need to verify. And so this makes it very tricky.

And then simultaneously we have the other problem: if anyone can write on this database, how do we ever agree which database is the correct one? Because if I write on my server something, but you write something else on your server, we’re no longer in sync; we’re no longer in consensus. You’re saying the coin got spent to Alice, but I’m saying the coin got spent to Bob. That’s a different reality, and now we’re incompatible—a huge conflict again.

So, yeah, how do we get consensus for this distributed database that anyone can write to? It’s like an insane question, right? How do you even come up with asking such a question? It’s ridiculous.

Manoj Tandon: How did they solve it?

Max Hillebrand: It’s ridiculous to presume that it could even be solved in the first place, but the solution is so genius. In the set of rules that define the Bitcoin protocol, there is a saying that whenever we write to the database, we don’t just write a single transaction to it, but we batch it. We make one database entry that is a batch of a thousand, two thousand transactions—something like this.

Okay, so this means we always have a unique, single addition of many transactions to the system. And then simultaneously, we can make it extremely computationally expensive to generate such a block of transactions, this bundle of transactions. We can make that costly in the sense of compute power to generate.

And now the question is: how do we prove to someone else that we’ve consumed electricity? That’s a super difficult problem, but thankfully it got solved by the Cypherpunks in the ’90s with Hashcash by Adam Back. This is proof-of-work, meaning we take a random message and we hash it, and we check: what is the numerical value of this hash? A hash is just a number—a hundred or something, of course much larger—and it’s completely random. So if we change the input to a hash function, the output is uniformly and indistinguishably random.

And so we can change the input to this hash function numerous times and always get a different hash value at the output side. And we can say that a block of transactions is only valid if the hash of this block has a hash value below a certain number. The hash value needs to be below 100 million or something like this. And there’s a random chance, whenever you make a hash of a certain message, that you will get something that’s below a certain target value.

And how low this target value is increases the difficulty of finding the hash. Because, let’s say there’s a 10% chance of hitting a correct hash value simply because the target is 10% of the available number space; then you need to try on average 10 times. You hash the first message—“Ah, it’s above the value, okay, it’s wrong.” You change one bit, you hash it again, check the value—“Ah, it’s wrong.” And you try a third time and a fourth time and a fifth time, and eventually, by pure chance, you will find a hash value of this block that is below the target value.

And so all of this is just done to stall the addition of new blocks being written to the chain, because you cannot come up with a hash value to a block that is below a certain number unless you try for gazillions of times to hash a certain random message. And so a lot of compute has to be added, which takes time.

Manoj Tandon: You know, first law of thermodynamics. Yeah, I mean it’s akin to saying that, you know, if we were to—I guess as an oversimplified analogy—if we had a submarine made out of this special metal that we’ll call the Bitcoin process, the deeper that we go, the stronger that metal is going to end up getting. The more pressure you put on it, the more difficult it’s going to become to penetrate it, which is totally backwards of how you would intuitively think about it.

Max Hillebrand: Yeah, exactly. And this is quite genius because it also ties in with your earlier question: in this chain of transaction, where does the money come from? And, you know, let’s say if you want to start a new monetary system, how would you pick the allocation of the new money units? Would you give it just to yourself, to yourself and your friends, to the people who give you money? To whom would you give those newly created currency units? It’s another incredibly difficult question that needs to be addressed when establishing a new money.

And another question: the Bitcoin protocol now takes so much electricity and compute power to produce these valid blocks. Why would anyone in his right mind spend so much electricity on this “nonsense” application of hashing some random values? Why would you ever do that?

Satoshi solved both of these problems with a genius insight. Because again, we have this database that anyone can write to as soon as he can prove that he spent sufficient electricity. But this means we have a basically fair mechanism to distribute this money. Whenever you find a valid Bitcoin block, one rule in the protocol says: the first transaction in the Bitcoin block does not have to have inputs. The first transaction has no inputs and only an output. But the output has the address of whatever you want, right? And the address, of course, can be your own address—the address of the miner who’s currently producing this block. He can pick his own address, which is of course the most likely thing he will do.

Manoj Tandon: And now these exchanges can’t alter these rules, Max?

Max Hillebrand: No, because Bitcoin is software that runs on your own computer, right? You are the one that controls this database, meaning you define these sets of rules—you know, the input-output structure of Bitcoin, etc. This 10-minute block time—all of this is defined by you in your software on your computer. And then, when you connect to the Bitcoin P2P network, you will download every single transaction, every single block that has ever happened, and you will verify it all the way from January 3rd, 2009, all the way to today. You will verify every single transaction that was ever made by anyone else, and you will ensure that the data integrity is correct, the bits are properly ordered, and that all the rules are adhered to. Like, every input must have a signature and, of course, the rule…

Manoj Tandon: Okay, I do that the first time, but then I change it because I can.

Max Hillebrand: Yeah, you can, right? That’s the magical thing. Now we have this almost like a blueprint for creating digital things: coins that we can pass around. And sure, you can with the click of a button create your own monetary system that doesn’t, like Bitcoin, have 21 million coins, but has 42 million coins. You can change the hashing algorithms, the signature algorithms, etc. There’s a rather big design…

Manoj Tandon: Wouldn’t that affect every other Bitcoin user, though? Because I’m changing it on my server. I’m saying, fine, I’m going to change. But then, how do you ensure the integrity of the currency if I’ve changed it on mine and I went rogue?

Max Hillebrand: Yeah, okay. So to answer that, one of the rules we didn’t talk about yet, and to finally answer your previous question: how does the money get started? The first transaction of a block does not have to have inputs, but the value of the output is clearly defined. It must be 50 Bitcoins. It cannot be above 50 Bitcoins. That was the definition of the initial set of blocks that were issued.

But there was also a rule in this code saying that after four years, this amount gets cut in half. So after four years, block number 210,000 is not allowed to have more than 25 Bitcoin in this first output of this coinbase transaction. And then it got cut in half to 12.5, then 6.25, and just a couple days ago it got cut to 3.125.

Manoj Tandon: Now, with every new block being added… but those rules are not alterable?

Max Hillebrand: That’s not alterable. They’re not alterable on my computer because I don’t change them. But if you feel like changing the source code—it’s written in C++—go hack at it.

The tricky thing then comes: so what if you now run on your computer software that says the rule is 100 Bitcoin per block? Totally fine, right? They go to me anyway, it’s cool. So you produce this block, you spend a tremendous amount of energy producing a block that is valid, and now you broadcast that to the Bitcoin peer-to-peer network, saying, “Hey, look, here’s a block that I produced.” But then every full node will check it and see that, okay, it’s a valid Bitcoin block, it has all of the structure and stuff, but the coinbase transaction has 100 Bitcoin. That’s not according to my rules; that’s an invalid block.

Or if your block includes a transaction that does not have a valid input signature—even if there’s thousands of other transactions that are valid—if one of them is invalid, my full node will say, “Well, that’s an invalid block. It’s not correct.” I will delete it, forget about it, and I will cut my connection to your node.

Manoj Tandon: So there is policing by unanimous consent. Essentially, everybody has to agree that that block is legit in order for it to be legit.

Max Hillebrand: Yup. If you run the Bitcoin full node software, that means you implicitly agree to the definition of the rule set of the money system. Because if you would not agree, you would run a different set of rules. So this means that, by definition, every Bitcoin user has consented actively to the exact set of rules, bit for bit, that are being laid out in the system.

And so therefore, Bitcoin is by far—by absolute far—the most peaceful and clean adoption of a new money unit that was created by humans. In the past, all fiat currencies were enforced by dictate—by law. You have to use this, either to pay your taxes or to settle debt, etc. That’s what legal tender means. You are forced at gunpoint to use this currency, and that’s why people accept paper money as currency even though they can print as much as they want from it.

And with Bitcoin, not only do we have currency that you can control—that nobody else can print more money than you define—but even further, that means that it is available for all.

Manoj Tandon: So how is it then… the one part that I want to get back to is: how is it that the transactions are believed to be anonymous or untraceable? Why do ransomware actors want their cash in Bitcoin?

Max Hillebrand: Well, why do criminals like good money? Because it’s good money. It’s extremely useful to have money that cannot be inflated, that cannot be stolen, that can be sent permissionlessly to anyone. It’s the most useful form of money that we’ve ever seen, and of course everyone will want to use it. And sure, criminals are oftentimes at the cutting edge of technology because ultimately they need it for their activities. So that is an unfortunate thing. Same as with the internet: it was used by porn and scammers from the very beginning. You know, that’s just humanity.

But then, I guess, why did we think at the beginning that Bitcoin was so anonymous? Because you didn’t need to sign up with your name; you just had to flip a coin to generate a new address, and it looks indistinguishable from any other random number out there. And so that is just so different to things that we’re experienced with in the current banking system. You need to show up in person or come with a passport and such.

Manoj Tandon: There’s no name, address, Social Security number; it’s just a private key.

Max Hillebrand: It’s just a private key, exactly.

Manoj Tandon: But when you sign up for an account on Coinbase, they make you give all this data that makes it the same as opening a bank account pretty much.

Max Hillebrand: Exactly, because as you say, Coinbase is not really a Bitcoin wallet in the sense… you don’t really generate private keys and connect to the Bitcoin blockchain with Coinbase. Coinbase is a bank, so to say. It’s two things: it’s a money warehouse and an exchange.

So a money warehouse—a custodian—basically means you have a bar of gold in your hand and you don’t want to keep it at your home; you want to put it with someone else who has a big safe and a guard with a gun. So you give your gold to someone else and he gives you a paper receipt back saying that whoever has this paper gets the bar of gold. Now, this is a money warehouse. Someone else is safeguarding your money; it’s still yours and the ownership is defined by the piece of paper. But ultimately, of course, the piece of paper is not gold.

And the same thing applies to Bitcoin. You have the physical gold, a bearer asset, a base money—and that is Bitcoin. If you have a UTXO—an unspent transaction output—a coin on the blockchain with your private key without any third-party obligation, this is yours.

However, you can make a transaction spending the coins that you have on the input side and, on the output side, add an address of the banking money warehouse service provider. And now the bank has the private keys that control the Bitcoin on the blockchain, and you have, well, maybe a paper slip or, more likely, an online banking account. So you can log in with username, email, password, and that gives you access rights to the ledger of the bank that is being kept internally.

Manoj Tandon: So you really don’t have to provide all that data? So again, if in theory my motives are less than respectable, I could get onto the system, purchase Bitcoins with just my private key, and that’s the only thing that is denoting that transaction. And there’s no way to really know who that private key physically belongs to. I know what it is because it’s my key that I wrote it down; I have it. But everybody else in the ecosystem doesn’t know that it’s Manoj who really is represented by that set of numbers.

Max Hillebrand: Well, basically yes. The generation of a private key you can do in your home by yourself; nobody will ever find out about that. But just having a private key is not enough. Again, we need a private key whose public key is mentioned on the blockchain. And now the question is: how do you get your public key mentioned on the blockchain? There’s basically two ways.

Either you mine a block, and then you can write your public key on the output side of the coinbase and you get your 50 Bitcoin or whatever the current subsidy is. And that’s of course very expensive; you need computers, electricity, blah blah blah.

Then the second approach is someone who has received Bitcoin in the past—someone else has it—will give it to you. Now the question is: how could you ever convince a stranger to hand over his magical cyberspace money? It’s very precious to a lot of people; they won’t give it up easily. So probably you’re going to have to be useful for them, right? So that means providing services and goods and whatever that is. Just like with any other money: how do you get money? You earn it.

Ransomware is unfortunately another thing where they lock up their data and say, “We’ll give you the key to it once we get paid.” And ultimately you’ve got to earn Bitcoin. Of course, another frequent way how people give away their Bitcoin is when you give them another currency—that might be US dollars or euros or whatnot. It can be cash in person, it could be a bank transfer, or a gift card or something. People trade Amazon gift cards for Bitcoin and stuff.

So money is, again by definition, the most liquid medium of exchange, and most liquid means anyone will have it and anyone is going to be willing to trade anything for it. And so you get your hands on Bitcoin just by selling any goods that you have or any services that you offer.

Manoj Tandon: That’s very enlightening. That’s interesting. So yeah, I can see how you could be anonymous. Your anonymity will end if you ever went and stored that data into a central bank, a central repository, because at that point they won’t accept that without getting certain data about you. And that’s when you reveal who’s behind the curtain.

Max Hillebrand: Exactly. So let’s walk through an example. For example, you are back in 2009. You stumble upon this Bitcoin thing, you download the software on your laptop, you let it run for a while. A couple hours later, you have 200 Bitcoin in your wallet because you mined four blocks where you each got a reward of 50 Bitcoin. Nobody knows that these private keys belong to you. Nobody knows, potentially, even that your IP address is related to Bitcoin at all if you use things like Tor and such—which back then wasn’t implemented, by the way.

Anyhow, so now 10 years later, still nobody knows that you have mined these coins back in the day. But now you want to buy your Lamborghini—it has to be orange, of course—and you go to your wallet and you say, “Send.” I want to send 10 Bitcoin to the Lamborghini merchant. I have my 200. So what happens in the background?

Your software will create a transaction with one input that comes all the way from 2009—50 Bitcoin from a coinbase reward transaction. On the output side, 10 Bitcoin with the public key of the merchant, as well as 40 Bitcoin to an address of a fresh private key of yours. Because with Bitcoin, the coins always have to be spent full. You cannot spend half of a coin; you always need to spend the entire transaction output. Again, a transaction output can only be spent once.

But then, you know, when the merchant requires less payment than you have in a coin, you just create two outputs—one to the merchant, one to you. There can be thousands of inputs and thousands of outputs in a Bitcoin transaction. So either you can split one coin into many, or you can consolidate. Let’s say you want to make a payment worth 170 Bitcoin from the past. Then you would have to take all the four coins that you received—four times 50 Bitcoin—and you spend all of these on the input side, and that gives you the right to put 170 and 30 Bitcoin on the output side of the transaction.

Manoj Tandon: Those 30 just come back to you?

Max Hillebrand: Exactly, those 30 come back to you. But then the problem is, now the Lamborghini merchant—he’s only going to give you the Lambo if he checks on his own full node that, yes, in the blockchain, in a confirmed proof-of-work block, is a transaction with 170-something Bitcoin and my address is on it. Okay, you get the Lamborghini now.

But of course, this also means he will see what this transaction looks like, and he will see that there’s four inputs that all come from 2009. And those coins—they were even on unique private keys. Each time you generated a new private key for this new block that you were mining. And in the past, four public keys look indistinguishable, so nobody knew that those four belong to the same person. But however, now that you made this transaction, it is quite obvious that one person had these four coins and that they are now being spent for this Lamborghini. So the merchant knows how long you held onto the money and how often you got paid in the past, and potentially where you made other payments as well. This is due to the transaction graph that is established by this chain of inputs and outputs in the Bitcoin network.

Manoj Tandon: Huh. Well, this is fascinating. You’ve saved a lot of us a lot of trouble in reading a lot of information to understand these basics here. Thank you.

Max Hillebrand: You’re welcome.

Manoj Tandon: Let’s fast forward now. I mean, this is all heavily dependent on the fact that we can’t quickly determine these hash values. So looking into the future with quantum computing and the risk of our current public-private key encryption algorithms: what are your thoughts about that? What is the crypto world thinking about that, or is it not a concern?

Max Hillebrand: Well, it is definitely a concern, and it’s however also quite a difficult problem to deal with. Back in 2009, I don’t think there were any quantum-resistant signature algorithms. And even nowadays, they are quite complex and especially larger in size. I think most of these crypto protocols have a larger proof size and, again, with Bitcoin, every proof, every signature has to be gossiped to tens of thousands of people, not just today but in the future. Every future generation needs to verify all of these signatures, so data size is quite a critical limiting factor.

And that’s why, even though recently in Bitcoin we introduced a second signature algorithm… where in the past it was the ECDSA signature algorithm, now we use the Schnorr signature algorithm as well. Both of these are susceptible to quantum breaking. And no quantum-secure algorithm was implemented because of size restrictions, basically. However, we can certainly adapt the rules of Bitcoin to allow for quantum-secure signature algorithms as well.

Of course, changing the Bitcoin protocol rules is a huge hassle, which we haven’t talked much about, but it is possible and has happened in the past. Another important note, though, is that Bitcoin as a protocol does not use encryption, very interestingly. Signature algorithms, hashing functions—yes, but not encryption. Everything on the Bitcoin blockchain is unencrypted in clear text. So that is quite fascinating, and that means of course there is no encryption attack that could be done on the Bitcoin protocol. By the way, just recently there was some peer-to-peer level encryption introduced, but that’s just for the gossip among two peers. The actual public blockchain is still unencrypted.

And then finally, of course, Bitcoin uses hashing quite frequently, but from my understanding—which is quite limited of quantum computers—I think that hashing algorithms are not susceptible to a quantum attack because they do not rely on the discrete log problem. So I think hashing would be secure, and that a quantum computer would most likely be much slower than a SHA-256 ASIC—just a specialized legacy hardware, let’s say, not quantum. But again, I’m not a cryptographer and definitely not a quantum guy, so take that with a grain of salt.

Manoj Tandon: It makes sense. It was a curiosity question, because if I can come up with a way to generate that private key, now I’ve broken the system.

Max Hillebrand: Exactly, yes.

Manoj Tandon: So there’s a couple… that is my pathway to break the system.

Max Hillebrand: Yes, Bitcoin heavily relies on the discrete log problem of the elliptic curve. If that security assumption is broken, the system is irrevocably lost, I would say. Again, there are some theories on how we could deal with a quantum attack and how we might still salvage the situation, but in any case, it would be a disaster scenario. Maybe we can engineer our way around it, but who knows at this point?

But of course, it’s not just Bitcoin that breaks; everything’s dead at that point.

Manoj Tandon: Everything. Our entire… everything breaks.

Max Hillebrand: Everything breaks. I mean, even Visa and Mastercard are broken at that point. Your bank transactions, your stock exchange—it’s broken. It’s just completely broken. And it all comes down to the simple problem of factoring. Computers are super fast at a lot of things, but they really suck at factoring, and no one has figured that one out yet.

Manoj Tandon: Yeah, I mean, that’s what it comes down to. And for our listeners, you guys can look it up—there’s a thousand YouTube videos on the topic, there’s mathematics courses on this topic—educate yourself on this. But computers are not good at factoring.

Max Hillebrand: Not good at factoring; that’s why the discrete log problem is very difficult to solve. So far Bitcoin holds up, and very interestingly, it presents itself as the largest honey pot for breaking the Schnorr signature algorithm or ECDSA signature algorithm ever. If you’re the one who finds out how to break the signature scheme, you’ll be filthy rich because you get everyone’s Bitcoin, and simultaneously you can short the currency as well, because once news comes out, the price probably goes down. So that person will get insanely rich. The fact that that has not yet happened seems to me quite a strong indication that the cryptography that we use is secure after all.

Manoj Tandon: Well, right now, I think there’s also a little bit of a détente there too, Max. There’s all kinds of actors that are using Bitcoin—legitimate people, nefarious bad actors—but it serves everyone’s purpose, so nobody wants to break it. Right now there’s a foundational belief that it can’t be broken, so there’s a little bit of a détente. But there may come a day. It would be interesting to see if someone does break it; they would be smart not to let anybody know. Because you want to basically use that as your own private ATM at your discretion.

Max Hillebrand: Exactly. You know, it’s like, “Yeah, I do want that Lambo this week. Maybe next week I want a jet. Why not?” If you tell everybody about it, then you lose all your ability to do all those things.

Manoj Tandon: Right? So that’s so fun. Looking at your firm now, zkSNACKs, you mentioned that your code is totally open-source. And I guess one thing again, coming from the cybersecurity perspective: how do you ensure that that code itself is secure when you have so many people working on it and contributing to an open-source development environment?

Max Hillebrand: It’s very critical because the Bitcoin software is critical in the sense that literal money is on the line. So code quality and security quality is of utmost importance. To some extent, people’s lives are at stake, and very much so. This is why the code has to be open-source, because I strongly believe that closed-source code cannot be secure in the long run.

All bugs are shallow with enough eyes on the code, and there is simply no way of getting more eyes on the code other than publishing it and making it available for all to see. Interestingly, that’s the same philosophy with cryptography, right? Most cryptographers believe the best way to test an algorithm is to reveal it to everybody and say, “Okay, if you can solve it… I’m telling you what it is.” If you can solve this, then let us know.

Manoj Tandon: Absolutely.

Max Hillebrand: And it happened to us numerous times that random people have reported bugs in the code, and quite critical ones. I remember one specifically where we used a Schnorr blind signature scheme; we were susceptible to a Wagner attack and were basically leaking private key material to anyone listening. And that is quite scary. We have numerous genius cryptographers on the team, but… and we don’t usually roll our own crypto. But it’s just extremely challenging.

The only reason why this was found is because we’re talking to people at conferences and describing the system and getting feedback. All of a sudden, one guy’s like, “Oh, by the way, there’s this obscure attack that you might be susceptible to, and I’ve checked your codebase and, here, on that line… no, you’re definitely screwed up there.”

In this specific case, the private key wasn’t sensitive—neither we nor our users would have lost any money if that private key got leaked. It would have just been a denial of service in the nuances of our architecture. However, it’s still a critical bug that was found. And free, open-source is the only serious way of doing this in the long run. But nevertheless, just because it’s open-source doesn’t mean it’s secure.

Manoj Tandon: I tell you, all these things that you’re mentioning, Max, they’re beautiful. I just can’t help but think: somebody solves the discrete log problem and this all goes. Then the most secure thing is going to be a notepad and paper; I send it to you and then I burn the paper and that’s it. Nobody knows; it’s gone forever.

Max Hillebrand: Actually, paper-based one-time pads/passwords are still by far the strongest form of encryption that we have. There’s a reason why a lot of terrorist groups still do that by paper carrier. There’s nothing to decrypt, there’s nothing to encrypt; it’s a guy on a motorcycle with a piece of paper. Drops it off, open it, burn it—it’s gone. Who knows what happened?

Manoj Tandon: Exactly.

Max Hillebrand: These are technologies that exist now, and I think humanity definitely has to adapt to some extent, as with any new technology that comes around. The wheel, gunpowder, internal combustion engines, electricity—extremely disruptive technologies that change everything. And if one doesn’t adapt to these new situations, then those are quite critical.

We see the same with the internet and encryption and security best practices. 20 years ago, nobody cared about security in cyberspace. But nowadays, when companies are being held ransom because their servers got hacked, all of a sudden operational security and such are extremely important and front of mind for many people. So we should definitely keep track with technologies, because the bad guys definitely will.

As soon as there’s an asymmetry of power—where some group of people has access to this fantastic technology but another group of people does not—well, then this mismatch in power will certainly manifest itself. That’s a very dangerous situation, which I think is another reason why this code has to be free and open-source.

Let’s say if this money-tech or privacy-tech were closed-source proprietary and you only get access to the information if you pay your monthly fee and subscription, etc.; all of a sudden, it’s a very dependent relationship with the service provider having an enormous amount of power over the end user. And with free and open-source software that can be run on your own machine, that is simply not the case anymore. So I would argue it’s extremely important that these technologies are widely distributed.

Manoj Tandon: I couldn’t agree with you more. And I do have to say that we’re coming up on time here. Listeners, this is part one. I can tell you, out of 10 questions, we got through one. We totally torpedoed what we were thinking of, all the things we were going to touch on. But this is fascinating, Max, and there’s at least a dozen things that come to mind. If you’re up for it, we’d love to schedule you back for part two of this conversation.

Max Hillebrand: Yeah, for sure. As I said before we went into the conversation, the good conversations start three hours in.

Manoj Tandon: I’d want to leave you a few minutes to plug something in part one. Is there anything you want to let our listeners know about? Any links, anything at all that you would like them to know about so that they’ll come back for part two?

Max Hillebrand: Yeah, so I guess in the meantime, while you’re curious to learn more about Bitcoin, I guess the most sophisticated book that I could recommend is Cryptoeconomics: Fundamental Principles of Bitcoin by Eric Voskuil, who is a genius in terms of computer science, economics, and just a security specialist. A brilliant mind, and his book is the most thorough and accurate explanation of Bitcoin, from which I drew heavily in the explanations that I provided you today. So the book Cryptoeconomics by Eric Voskuil—very much worth a read.

And then also check out Wasabi Wallet at wasabiwallet.io. It’s a security and privacy-focused Bitcoin wallet with a bunch of amazing, cutting-edge technologies: Tor, block filters, ecash.

And maybe just one little tease: as I earlier said, we usually don’t roll our own crypto. The one time that we did was to invent a new ecash scheme. Again, all the way back to 1983, Chaumian blind signatures—the downside of all of these schemes was that the value of the token was in clear text. So the mint knew exactly that this signature is worth one gold coin and the other signature is worth five gold coins, for example, and there was no anonymity set in between.

So we researched quite heavily and discovered WabiSabi, which is an ecash scheme with anonymous amounts, so that even the mint—the service provider—does not differentiate the value of the token. If you have, in our case, zero Bitcoin or 5,000 Bitcoin or a million, they all look indistinguishable. So I guess that’s one of the fancy pieces of cryptography that we’re working on. So if some users are interested in this, that would be an interesting place to do some further research.

Manoj Tandon: Yeah, and we’re going to actually pick up on that one among a lot of other things too. Max, you’re brilliant, and I have to—for our audience—I got to remind you folks: if you guys want to keep getting this kind of great content, you got to like, share, and subscribe. Hit the bell for us; do us a little bit of justice. We’re doing a public service here, and folks like Max are doing this… they’re not getting paid for this, they’re doing this out of the kindness of their hearts, sharing tremendous knowledge. So please like, share, and subscribe.

And Max, you’re brilliant. Thank you, sir, so much for being on today’s episode.

Max Hillebrand: Thank you very much, Manoj; it was really a pleasure. I really enjoyed the conversation, really sharp questions. So I’m really eager for part two.