A user called jimbobway posted four lines addressed to Satoshi in the thread “Development of alert system”:
jimbobway (BitcoinTalk post, August 25, 2010, 4:45:22 PM UTC)A few rhetorical questions for satoshi:
Can you resist waterboarding? Can you endure electric shock? All forms of torture? Lastly, are you Jack Bauer by any chance? Seriously.
He called them rhetorical. The worry under them was real. Three days earlier Satoshi had announced an alert system whose messages were, in his words, “signed with a private key that only I have.” A key held by one person makes that person worth finding, and how much he is worth depends on what the key can do. The record answers that twice: once in Satoshi’s reply eleven minutes after the questions, and again in the eight years it took to get the key out of the network.
”A private key that only I have”
Satoshi announced the alert system on August 22, a week after the value overflow incident. Nodes would do two things in response to an alert: put a warning message on the status bar, and make the money-handling methods of the JSON-RPC interface return an error. The second behaviour, which he called safe mode, was meant for automated websites. It “stops automated websites from making any more trades until they’re upgraded.” Six commands were affected, among them sendtoaddress and getbalance. The code went into the repository as SVN r142 on August 25 and shipped as version 0.3.11 two days later.
”They’ll torture you until you give them the key”
The first objections arrived within hours, and the fear of coercion came up several times:
| Poster | Posted (UTC) | What they wrote |
|---|---|---|
| BioMike | Aug 23, 05:15 | A government could arrest Satoshi, demand the key or take it from his computer, and “shut down the complete network” |
| FreeMoney | Aug 23, 05:23 | One person able to send messages is a risk even if trusted now: that person “might get tortured/bribed/blackmailed” |
| lfm | Aug 23, 05:28 | It is open source: anyone who thinks Satoshi will be coerced can replace his key with their own |
| jimbobway | Aug 25, 16:45 | The four rhetorical questions above |
FreeMoney opened his post with the line that gives this page its subject: “No! If you do that they’ll torture you until you give them the key Satoshi!” Then he added, “But seriously,” and stated the real concern. Satoshi answered BioMike’s question and jimbobway’s four lines in one reply:
Satoshi Nakamoto (BitcoinTalk post, August 25, 2010, 4:56:15 PM UTC)WRT the alert system, who cares? The most the key can do is temporarily disable six json-rpc commands until the site owners either add the -disablesafemode switch or upgrade. All nodes keep running and generating, the network stays up. If I’m not available, any script kiddie can figure out how to add two characters and make a new version that disables the alert system. It would be a temporary inconvenience only.
He did not claim he could hold out. He said the key was not worth the trouble: whoever held it could stop six commands for a while, and anyone could build a client that ignored it. At 22:48 UTC the same day FreeMoney wrote, “Okay, I’m not worried anymore.” The next day jimbobway added, “I admit I didn’t know what I was talking about.”
A lighter key, then a handover
Satoshi made the key weaker before he gave it away. In his last public post, announcing version 0.3.19, he removed safe mode alerts:
Satoshi Nakamoto (BitcoinTalk post, December 12, 2010, 6:22:00 PM UTC)“safe mode” alerts was a temporary measure after the 0.3.9 overflow bug. We can say all we want that users can just run with “-disablesafemode”, but it’s better just not to have it for the sake of appearances. It was never intended as a long term feature. Safe mode can still be triggered by seeing a longer (greater total PoW) invalid block chain.
The code shows how far the change went. In r200, committed seventeen minutes after r199, the alert’s field for an RPC error message was renamed strReserved and no longer read. From 0.3.19 on, an alert could put text on the status bar and do nothing else. Safe mode survived only for the case Satoshi named, a longer invalid chain, and no key could trigger it.
Four months later, he sent the key:
Satoshi Nakamoto (email to Gavin Andresen, April 26, 2011)Here’s the CAlert key and broadcast code in case you need it. You should probably give it to at least one or two other people. There are a few long time users who are always around all the time.
Andresen’s reply the same day went straight to that advice: “fricking fracking… now I’ve gotta figure out a couple of people who I can trust to keep them safe…”
Copies that could not be taken back
Andresen sent a network alert on March 11, 2013, during the March 2013 chain fork, and BIP 50, the post-mortem that followed, reviewed who held the alert keys.
Five years after the handover, the key belonged to more than one person. A proposal appeared to complete the retirement of the alert system. The last of its reasons was this:
Gregory Maxwell (bitcoin-dev mailing list post, September 10, 2016)Finally, there is good reason to believe that the key has been compromised— It was provided to MTGox by a developer and MTGox’s systems’ were compromised and later their CEO’s equipment taken by the Japanese police.
Mt. Gox’s chief executive, Mark Karpelès, was arrested by Japanese authorities on August 1, 2015. Maxwell’s email does not say which developer gave the exchange the key, and the retirement notice does not say either. He named a second problem in the same email: “No one can tell which of the key holders created a message.” The retirement notice published on bitcoin.org on November 1, 2016 described the structure behind both points. As developers joined, the key was given to others, but it “cannot be taken away from those who have left.”
What the key could do
Satoshi’s 2010 reply described what the key was built to do. The developers preparing to publish it read the code for what else it could do. Their disclosure on the bitcoin.org blog on July 3, 2018 described memory-exhaustion attacks open to anyone holding the key. A node stored every accepted alert in a map with no size limit, so a key holder could send alerts until the node ran out of memory and crashed (CVE-2016-10724). Even the “final alert” meant to seal the system could be cancelled (CVE-2016-10725). “Many of these issues were not known until the Alert System was removed,” the disclosure says. The unlimited map was there from the start: the r142 code of August 25, 2010 adds each accepted alert to mapAlerts with no upper bound.
| Bitcoin versions | What an alert could do by design |
|---|---|
| 0.3.11–0.3.18 (Aug–Dec 2010) | Show a status-bar warning; switch on safe mode, which stops six JSON-RPC commands |
| 0.3.19–0.12.0 (Dec 2010–2016) | Show a status-bar warning only |
| Bitcoin Core 0.12.1 onward | Nothing: the alert system is removed or disabled |
The disclosure put the end of the memory attacks at network protocol version 700013, released with Bitcoin Core 0.13.0. When the key was published, it said, fewer than 4% of nodes were vulnerable.
jimbobway asked whether Satoshi could survive torture. Satoshi answered by making the key worth little, then worth less again before he gave it away. The danger that remained did not run through one man in a chair. It ran through copies: one to Andresen, more as developers joined, and by Maxwell’s account one that reached Mt. Gox, none of which could be recalled. The developers who closed the system used Satoshi’s remedy at full strength. On July 3, 2018, the private key appeared in a blog post for anyone to copy, and that post was the last answer to jimbobway’s four lines. No one tortures anyone for a key that everyone already has.
