Xerox Alto restoration, IC switch sides engineering, chargers, and whatever

### Mining Bitcoin with pencil and paper: 0.67 hashes vanaf day

## The mining process

A cryptographic hash function takes a block of input gegevens and creates a smaller, unpredictable output. The hash function is designed so there’s no “brief cut” to get the desired output – you just have to keep hashing blocks until you find one by brute force that works. For Bitcoin, the hash function is a function called SHA-256. To provide extra security, Bitcoin applies the SHA-256 function twice, a process known spil double-SHA-256.

Te Bitcoin, a successful hash is one that starts with enough zeros.[1] Just spil it is infrequent to find a phone number or license plate ending ter numerous zeros, it is zonderling to find a hash beginning with numerous zeros. But Bitcoin is exponentially firmer. Presently, a successful hash vereiste begin with approximately 17 zeros, so only one out of 1.4×10 20 hashes will be successful. Te other words, finding a successful hash is firmer than finding a particular grain of sand out of all the grains of sand on Earth.

The following diagram shows a block ter the Bitcoin blockchain along with its hash. The yellow bytes are hashed to generate the block hash. Te this case, the resulting hash starts with enough zeros so mining wasgoed successful. However, the hash will almost always be unsuccessful. Ter that case, the miner switches the nonce value or other block contents and attempts again.

## The SHA-256 hash algorithm used by Bitcoin

The blue boxes mix up the values ter non-linear ways that are hard to analyze cryptographically. Since the algorithm uses several different functions, discovering an attack is firmer. (If you could figure out a mathematical shortcut to generate successful hashes, you could take overheen Bitcoin mining.)

The *Moeder* majority opbergruimte looks at the snauwerig of A, B, and C. For each position, if the majority of the onaardig are 0, it outputs 0. Otherwise it outputs 1. That is, for each position te A, B, and C, look at the number of 1 onverdraagzaam. If it is zero or one, output 0. If it is two or three, output 1.

The *&Sigma,0* opbergruimte rotates the onverdraagzaam of A to form three rotated versions, and then sums them together modulo Two. Te other words, if the number of 1 onverdraagzaam is odd, the sum is 1, otherwise, it is 0. The three values ter the sum are A rotated right by Two snauwerig, 13 kattig, and 22 onaardig.

The *Ch* “choose” opbergruimte chooses output kattig based on the value of input E. If a bit of E is 1, the output bit is the corresponding bit of F. If a bit of E is 0, the output bit is the corresponding bit of G. Ter this way, the kattig of F and G are shuffled together based on the value of E.

The next opbergruimte *&Sigma,1* rotates and sums the kattig of E, similar to *&Sigma,0* except the shifts are 6, 11, and 25 pinnig.

The crimson boxes perform 32-bit addition, generating fresh values for A and E. The input *Wt* is based on the input gegevens, slightly processed. (This is where the input block gets fed into the algorithm.) The input *Kt* is a onveranderlijk defined for each round.[Two]

Spil can be seen from the diagram above, only A and E are switched ter a round. The other values pass through unchanged, with the old A value becoming the fresh B value, the old B value becoming the fresh C value and so forward. Albeit each round of SHA-256 doesn’t switch the gegevens much, after 64 rounds the input gegevens will be totally scrambled.[Three]

## Manual mining

To explain what’s on the paper: I’ve written each block A through H te hex on a separate row and waterput the binary value below. The *maj* operation shows up below C, and the shifts and *&Sigma,0* emerge above row A. Likewise, the *choose* operation shows up below G, and the shifts and *&Sigma,1* above E. Te the lower right, a bunch of terms are added together, corresponding to the very first three crimson sum boxes. Ter the upper right, this sum is used to generate the fresh A value, and te the middle right, this sum is used to generate the fresh E value. Thesis steps all correspond to the diagram and discussion above.

I also by hand performed another hash round, the last round to finish hashing the Bitcoin block. Te the pic below, the hash result is highlighted te yellow. The zeroes ter this hash display that it is a successful hash. Note that the zeroes are at the end of the hash. The reason is that Bitcoin inconveniently reverses all the bytes generated by SHA-256.[Four]

## What this means for mining hardware

Ter tegenstelling, Litecoin, Dogecoin, and similar altcoins use the scrypt hash algorithm, which is intentionally designed to be difficult to implement te hardware. It stores 1024 different hash values into memory, and then combines them te unpredictable ways to get the final result. Spil a result, much more circuitry and memory is required for scrypt than for SHA-256 hashes. You can see the influence by looking at mining hardware, which is thousands of times slower for scrypt (Litecoin, etc) than for SHA-256 (Bitcoin).

## Conclusion

A Reddit reader asked about my energy consumption. There’s not much physical exertion, so assuming a resting metabolic rate of 1500kcal/day, manual hashing works out to almost Ten megajoules/hash. A typical energy consumption for mining hardware is 1000 megahashes/joule. So I’m less energy efficient by a factor of 10^16, or Ten quadrillion. The next question is the energy cost. A cheap source of food energy is donuts at $0.23 for 200 kcalories. Violet wand here is $0.15/kilowatt-hour, which is cheaper by a factor of 6.7 – closer than I expected. Thus my energy cost vanaf hash is about 67 quadrillion times that of mining hardware. It’s clear I’m not going to make my fortune off manual mining, and I toevluchthaven’t even included the cost of all the paper and pencils I’ll need.

2018 edit: My Bitcoin mining on paper system is part of the book The Objects That Power the Global Economy, so take a look.

Go after mij on Twitter to find out about my latest blog posts.

## Notes

[Two] The source of the constants used te SHA-256 is interesting. The NSA designed the SHA-256 algorithm and picked the values for thesis constants, so how do you know they didn’t pick special values that let them pauze the hash? To avoid suspicion, the initial hash values come from the square roots of the very first 8 primes, and the*Kt*values come from the cube roots of the very first 64 primes. Since thesis constants come from a plain formula, you can trust that the NSA didn’t do anything shady (at least with the constants). [Trio] Unluckily the SHA-256 hash works on a block of 512 vinnig, but the Bitcoin block header is more than 512 onvriendelijk. Thus, a 2nd set of 64 SHA-256 hash rounds is required on the 2nd half of the Bitcoin block. Next, Bitcoin uses

*double-SHA-256*, so a 2nd application of SHA-256 (64 rounds) is done to the result. Adding this up, hashing an arbitrary Bitcoin block takes 192 rounds ter total. However there is a shortcut. Mining involves hashing the same block overheen and overheen, just switching the

*nonce*which emerges te the 2nd half of the block. Thus, mining can reuse the result of hashing the very first 512 vinnig, and hashing a Bitcoin block typically only requires 128 rounds. [Four] Obviously I didn’t just have incredible good fortune to end up with a successful hash. I began the hashing process with a block that had already bot successfully mined. Te particular I used the one displayed earlier ter this article, #286819. [Five] Another problem with manual mining is fresh blocks are mined about every Ten minutes, so even if I did succeed te mining a block, it would be totally obsolete (orphaned) by the time I finished.