Have any cryptography experts vetted the bitcoin source code?

Theoretically, bitcoin's open source nature makes it more resistant to bugs and exploits. However, due to the specialized nature of the code, even many programmers don't fully understand the cryptography pieces. Have any well-regarded cryptography experts done an analysis of the code and published their thoughts anywhere?

lemonginger

Posted 2011-09-01T15:05:32.950

Reputation: 5 112

7I would really like to see a formal proof of security of BitCoin or at least a bare-bones version of it. That would be a fun project. – Artem Kaznatcheev – 2011-09-01T17:13:28.973

Answers

"It looks good to me" tends to make for a pretty boring paper.

Security expert Dan Kaminsky has given talks and written articles about the Bitcoin system. His two main points are that it cannot scale to the number of transactions a payment processing system needs and that it is not as anonymous as many people think.

He also wrote, "As a note, I have a tremendous amount of respect for BitCoin; I count it in the top five most interesting security projects of the decade. Entire classes of bugs are missing. But it's just not an anonymous solution, and the devs will say as much."

David Schwartz

Posted 2011-09-01T15:05:32.950

Reputation: 46 931

5Gavin spoke about this during his talk at the Bitcoin conference. It seems the consensus is that Bitcoin is secure as David has quoted. +1 – Alex Waters – 2011-09-02T01:18:11.723

Brian Warner is a security expert and he has studied the source code. His presentation about Bitcoin is by far the best deep technical explanation I've seen:

http://vimeo.com/27177893

There is a brief mention about the security of the source code, embedded in two hours of brilliant explication of the security of the overall system design.

Also, the cryptography mailing list hosted by Jack Lloyd is a discussion forum for a wide range of cryptography and security experts. Bitcoin has been discussed several times. The discussions that I have looked at on that list tend to be more about the protocol, the economics, and so forth than about the actual source code. Here is a google search that returns letters from that mailing list that have the string "Bitcoin" in:

https://encrypted.google.com/search?hl=en&q=site%3Alists.randombit.net%20bitcoin