Lecture 1: Intro to Crypto and Cryptocurrencies

What this lecture covers

This opening lecture lays the cryptographic groundwork the rest of the course depends on, before touching Bitcoin itself. It answers a narrow but essential question: what mathematical building blocks make a trustworthy digital currency possible? The lecture works through cryptographic hash functions and digital signatures, then shows how they combine into data structures like hash pointers, blockchains, and Merkle trees.

By the end, you'll understand why Bitcoin uses SHA-256 and ECDSA, how a hash pointer makes tampering detectable, and how public keys double as identities. The lecture closes with two simplified currencies, GoofyCoin and ScroogeCoin, that demonstrate the double-spending problem and set up the central challenge the rest of the course addresses: solving that problem without a trusted central party.

Key ideas

• Collision resistance: no one can practically find two different inputs that hash to the same output, even though collisions mathematically exist.
• Hiding property: given H(r || x), where r is a random, high-entropy value, it's infeasible to recover x — this underlies digital commitments.
• Puzzle friendliness: for a random puzzle ID, there's no shortcut to finding an input that makes the hash land in a target set, which is what makes Bitcoin mining work.
• Hash pointer: a pointer to data plus a hash of that data, letting you both retrieve and verify the data hasn't changed.
• Blockchain and Merkle tree: both are built from hash pointers; tampering anywhere forces the attacker to also forge every hash pointer back to the head, which they can't do.
• Digital signatures: generateKeys, sign, and verify let only the key holder produce a valid signature, while anyone can check it.
• Public keys as identities: an address is just a public key (or its hash); anyone can generate one privately, enabling decentralized identity.
• Double spending: the core problem a cryptocurrency must solve — stopping an owner from spending the same coin twice.

Walkthrough

Cryptographic hash functions (15:04)

The lecture defines a cryptographic hash function as one that accepts any input, produces a fixed-size output (256 bits, as Bitcoin uses), and is efficiently computable. It then covers three required security properties in turn: collision resistance, the hiding property, and puzzle friendliness. For each, the lecture explains what the property means and immediately shows a use: collision resistance enables using a hash as a compact message digest; the hiding property, achieved by hashing a message concatenated with a random high-entropy value, enables digital commitments (a digital sealed envelope); and puzzle friendliness enables search puzzles like the one used in Bitcoin mining. The segment ends by describing SHA-256's structure: padding the message, splitting it into 512-bit blocks, and running a compression function iteratively starting from a fixed initial value.

Hash pointers and data structures (20:28)

A hash pointer combines a normal pointer with a hash of the pointed-to data, so it both locates data and lets you verify it hasn't changed. The lecture builds a blockchain from hash pointers, showing why it's tamper-evident: changing any block breaks the hash stored in the next block, which forces the attacker to tamper with every subsequent hash pointer up to the head, which they can't forge. It then builds a Merkle tree the same way, explaining that only the root hash needs to be remembered, membership can be proven in logarithmic time by showing a path to the root, and a sorted Merkle tree additionally allows proving non-membership. Both structures generalize to any acyclic pointer-based data structure.

Digital signatures (29:25)

The lecture defines the three-operation API — generateKeys, sign, verify — and states the two required properties: valid signatures always verify, and forging a signature without the secret key is infeasible. Unforgeability is framed as a game where an attacker who only knows the public key, and who can request signatures on chosen messages, still cannot produce a valid signature on a new message with better than negligible probability. Practical notes include using good randomness (critical for ECDSA specifically, since bad randomness during signing can leak the private key), signing a hash of a long message rather than the message itself, and signing a hash pointer to effectively sign everything that pointer chain reaches.

Public keys as identities (39:04)

A public key can stand in for an identity: anyone who can produce a valid signature under that key is treated as speaking for it. Because keys can be generated freely and privately, this gives decentralized identity management — no registration authority, and anyone can create as many identities ("addresses" in Bitcoin) as they like. The lecture notes the privacy trade-off: a fresh address has no initial link to a real-world identity, but a pattern of transactions over time can let an observer connect the dots.

A simple cryptocurrency (44:39)

GoofyCoin lets one party, Goofy, create coins by signing a creation statement, and lets any coin owner pass it on by signing a transfer statement referencing a hash pointer to the coin. The scheme is simple but insecure: an owner can sign two different transfer statements for the same coin and give one to each recipient, a double-spending attack. ScroogeCoin fixes this by having a central party, Scrooge, publish a signed, append-only blockchain history of every transaction. Two transaction types are introduced: create-coins (valid because Scrooge says so) and pay-coins (valid only if the consumed coins exist, haven't been spent before, the input and output values match, and every consumed coin's owner signed). Because the full history is public, a double spend is immediately visible and rejected. The lecture closes by naming the remaining problem: ScroogeCoin still depends on trusting Scrooge, and the rest of the course builds toward removing that central party.

Before you watch

• No prior lectures in this course are required; this is the starting point.
• Basic familiarity with what a hash function and a public/private key pair are will make the pace easier, though the lecture defines both from scratch.

Check your understanding

1. Why does a hash function being collision-free not mean collisions don't exist?
2. How does concatenating a message with a random value give a hash function the hiding property, and why is this used for commitments?
3. Why does tampering with one block in a hash-pointer blockchain force an attacker to also forge every hash pointer up to the head?
4. In the digital signature unforgeability game, what is the attacker allowed to do before attempting a forgery, and what must be true about the message they forge?
5. Walk through why GoofyCoin allows double spending and explain exactly how ScroogeCoin's published history prevents it.