Part 1
======

1. Proof or Work is hard to compute and hard to verify.
2. Every puzzle used for mining can be outsourced.
3. Zerocoin and Zerocash have public accounts and hidden accounts.
4. In ethereum contracts cannot access storage of other contracts.
5. SPV clients store…
  · every block.
  · some blocks.
  · only block headers.
6. A 51%-attacker can prevent…
  · others peers from sending blocks to the Bitcoin network.
  · blocks from being appended to the blockchain.
7. Feather forking attacks can be done with less than 50% percent of total mining power.
8. Fresh addresses for every transaction in bitcoin grant complete anonymity.


Part 2
======

Assume G := {G(x)=H(x[0,|x|-2) if |x|>2; H(x) otherwise} and H is a
collision free, hiding, puzzle friendly hash funcion.  Is G collision
free?  Is G hiding?


Part 3
======

Assume transactions of the form <id, id', pk_R, sig_S> where id is the
tx ID, id' is ID of the tx providing the input money, pk_R is the
public key of the receiver and sig_S is the signature of the sender.
Assume blocks contain exactly one tx and a tx transfers exactly 1 BTC.
Assume blocks of form [p, nonce, t], where p is the hash of the
previous block and t is the tx in it.

[insert blockchain of three blocks here, last block has transaction
from Charlie to Alice]
  
Q1. Alice wants to buy goods from Bob.  Alice pays and Bob sends
    goods.  How can Alice still spend the coin?
    
Q2. Bob waits for 6 Blocks to be appended to the blockchain after the
    block with the tx with Alice' payment.  Can Alice still double
    spend with a) <50% mining power, b) >50% mining power?


Part 4
======

Assume a commitment scheme com=(C,V) and discrete transactions of the
form <[i_1: C(x_1),…,i_m: C(x_m)], [o_1: C(y_1),…,o_n: C(y_n)]> where
the first list is the input list with input identifiers
i_k and the second list is the output list with output identifiers o_k
and C satisfying the homomorphic property C(a) + C(b) = C(a + b).

Correct discrete transactions are…
  hiding: Given input and output values of two transactions t,t', an
          attacker cannot distinguish t,t'.
  valid:  Σ i_k = Σ o_k

Q1. If com is not binding, which above property is broken?  Give an
    example.
    
Q2. if com is not hiding, which above property is broken?  Give an
    example.