Gwernが​記した、​ビットコインホワイトペーパーの​失われた​公開前の​草稿​（gwern.net、​2014〜2017年）

Footnotes

1. より詳しい差分：

   [-satoshi@vistomail.com-]
   {+satoshin@gmx.com+}
   
   ...Abstract. A purely peer-to-peer version of electronic cash would allow online
   payments to be sent directly from one party to another without [-the burdens of-] going through a
   financial institution. Digital signatures provide part of the solution, but the main
   benefits are lost if a trusted {+third+} party is still required to prevent [-doublespending.-] {+double-spending.+}
   We propose a solution to the double-spending problem using a [-peer-topeer-] {+peer-to-peer+} network.
   The network timestamps transactions by hashing them into an ongoing chain of
   hash-based proof-of-work, forming a record that cannot be changed without redoing
   the proof-of-work. The longest chain not only serves as proof of the sequence of
   events witnessed, but proof that it came from the largest pool of CPU power. As
   long as [-honest nodes control the most-] {+a majority of+} CPU power [-on-] {+is controlled by nodes that are not cooperating to
   attack+} the network, [-they can-] {+they'll+} generate the longest chain and outpace [-any-] attackers. The
   network itself requires minimal structure. Messages are [-broadcasted-] {+broadcast+} on a best effort
   basis, and nodes can leave and rejoin the network at will, accepting the longest
   proof-of-work chain as proof of what happened while they were gone.
   
   ...The proof-of-work also solves the problem of determining representation in majority decision
   making. If the majority were based on one-IP-address-one-vote, it could be subverted by anyone
   able to allocate many IPs. Proof-of-work is essentially one-CPU-one-vote. The majority
   decision is represented by the longest chain, which has the greatest proof-of-work effort invested
   in it. If a majority of CPU power is controlled by honest nodes, the honest chain will grow the
   fastest and outpace any competing chains. To modify a past block, an attacker would have to
   redo the proof-of-work of the block and all blocks after it and then catch up with and surpass the
   work of the honest nodes. We will show later that the probability of a slower attacker catching up
   diminishes exponentially as subsequent blocks are added.
   {+To compensate for increasing hardware speed and varying interest in running nodes over time,
   the proof-of-work difficulty is determined by a moving average targeting an average number of
   blocks per hour. If they're generated too fast, the difficulty increases.+}
   
   ...New transactions are [-broadcasted-] {+broadcast+} to all nodes.
   Each node collects new transactions into a block.
   
   ...The steady addition of a constant of amount of new coins is analogous to gold miners expending
   resources to add gold to circulation. In our case, it is CPU time and electricity that is expended.
   The incentive [-may-] {+can+} also {+be funded with transaction fees. If the output value of a transaction is
   less than its input value, the difference is a transaction fee that is added to the incentive value of
   the block containing the transaction. Once a predetermined number of coins have entered
   circulation, the incentive can transition entirely to transaction fees and be completely inflation
   free.
   The incentive may+} help encourage nodes to stay honest. If a greedy attacker is able to
   assemble more CPU power than all the honest nodes, he would have to choose between using it
   to defraud people by stealing back his payments, or using it to generate new coins. He ought to
   find it more profitable to play by the rules, such rules that favour him with more new coins than
   everyone else combined, than to undermine the system and the validity of his own wealth.
   [-To compensate for increasing hardware speed and varying interest in running nodes over time,
   the proof-of-work difficulty is determined by a moving average targeting an average number of
   blocks per hour. If they're generated too fast, the difficulty increases.-]
   
   ...As such, the verification is reliable as long as honest nodes control the network, but is more
   vulnerable if the network is overpowered by an attacker. While network nodes can verify
   transactions for [-themselves and are only vulnerable to reversal,-] {+themselves,+} the simplified method can be fooled by an attacker's fabricated
   transactions for as long as the attacker can continue to overpower the network. One strategy to
   protect against this would be to accept alerts from network nodes when they detect an invalid
   block, prompting the user's software to download the full block and [-reported-] {+alerted+} transactions to
   confirm the inconsistency. Businesses that receive frequent payments will probably still want to
   run their own nodes for more independent security and quicker verification.

   ↩