Appendix A

Mathematical Notation

This appendix collects the notation, conventions, and terminology used throughout the text. Entries are organized by topic and listed in order of first appearance. Section A.12 disambiguates symbols that carry different meanings in different chapters.

A.1 Sets and Common Number Systems

Symbol Meaning Introduced
a ∈ S a is an element of the set S Def. 1.1
ℕ The natural numbers {0, 1, 2, ...} Ex. 1.1
ℤ The integers {..., −2, −1, 0, 1, 2, ...} Ex. 1.1
ℚ The rational numbers Exer. 1.1
ℝ The real numbers Ex. 1.1
𝔽ₚ The finite field of p elements Ch. 2
ℤₙ The integers modulo n, i.e. {0, 1, ..., n−1} Ex. 1.6
ℤₙ* The multiplicative group of integers modulo n (elements coprime to n) Ex. 1.10
⌊x⌋, ⌈x⌉ Floor (round down) and ceiling (round up) of x Ch. 12, 15
Σ Summation over an indicated index range Ch. 10
O(·) Big-O asymptotic growth: f = O(g) if f grows no faster than a constant multiple of g Ch. 2
x || y Concatenation of byte strings x and y Ch. 9

A.2 Group Theory

Symbol / Term Meaning Introduced
(G, ∗) A group: a set G with binary operation ∗ satisfying closure, associativity, identity, and inverse Def. 1.3
e The identity element of a group Def. 1.3
a⁻¹ The inverse of element a Def. 1.3
Abelian A group whose operation is commutative: a ∗ b = b ∗ a Def. 1.4
|G| The order of a group (number of elements) Def. 1.5
⟨g⟩ The cyclic group generated by g Def. 1.6
gⁿ g ∗ g ∗ ⋯ ∗ g (n times); written ng in additive notation Def. 1.6
H ≤ G H is a subgroup of G Def. 1.7
Isomorphic Two groups are isomorphic if there exists a bijection between them that preserves the group operation. Informally, they are structurally identical as groups—they have the same algebraic structure, differing only in the names of their elements. Thm. 1.1
ord(a) The order of element a: the smallest positive m with aᵐ = e; equals |⟨a⟩| and divides |G| Def. 1.5, Cor. 1.1
log_g(h) The discrete logarithm of h to base g Def. 1.9
φ(n) Euler's totient: the count of integers in {1, ..., n} coprime to n Def. 2.7

A.3 Elliptic Curves

Symbol / Term Meaning Introduced
y² = x³ + ax + b Short Weierstrass form of an elliptic curve Def. 3.1
𝒪 The point at infinity (identity element of the curve group) Ch. 3
Affine coordinates Representation of curve points as (x, y) pairs, as opposed to projective or Jacobian coordinates Ch. 3
λ The slope of the chord (addition) or tangent (doubling) line in the point-addition formulas Thm. 3.2, 3.3
E(𝔽ₚ) The group of points on curve E with coordinates in 𝔽ₚ, together with 𝒪 Ch. 4
kP Scalar multiplication: P + P + ⋯ + P (k times), computed by double-and-add Alg. 3.1
Hasse bound |#E(𝔽ₚ) − (p+1)| ≤ 2√p: the curve's point count is close to p Ch. 5

A.4 The secp256k1 Curve

Symbol Meaning Introduced
p The field prime 2²⁵⁶ − 2³² − 977 Ch. 5
a = 0, b = 7 Curve coefficients: secp256k1 is y² = x³ + 7 over 𝔽ₚ Ch. 5
G The standard generator point (base point) Ch. 5
n The order of G: the number of points in ⟨G⟩; prime, slightly below p Ch. 5
h = 1 The cofactor #E(𝔽ₚ)/n; equal to 1 for secp256k1 Ch. 5

A.5 Hash Functions

Symbol / Term Meaning Introduced
H(m) A cryptographic hash of message m (SHA-256 unless stated otherwise) Ch. 6
HASH256, SHA256d Double SHA-256: SHA256(SHA256(x)); used for txids, block hashes, and filter headers Ch. 6
HASH160 RIPEMD160(SHA256(x)); used for addresses Def. 6.4
Tagged hash SHA256(SHA256(tag) || SHA256(tag) || x), BIP-340's domain separation Ch. 8
Birthday bound Collisions in an n-bit hash become likely after about 2^(n/2) evaluations Thm. 9.1

A.6 Keys, Addresses, and Signatures

Symbol / Term Meaning Introduced
d A private key: an integer in [1, n−1] Ch. 5
P = dG The public key: the curve point obtained by scalar-multiplying the generator by d Ch. 5
k A signing nonce: a fresh secret integer per signature (reuse reveals d, Thm. 7.2) Ch. 7
z The message hash being signed, interpreted as an integer mod n Ch. 7
(r, s) An ECDSA signature: r = x(kG) mod n, s = k⁻¹(z + rd) mod n Ch. 7
(R, s) with e A Schnorr signature: nonce point R = kG, challenge e = H(R || P || m), response s = k + ed; BIP-340 serializes x(R) only Ch. 8
x-only key A public key serialized as its 32-byte x-coordinate, with even y implied (BIP-340) Ch. 8
Base58Check, WIF Checksummed encodings for legacy addresses and private keys Ch. 9
Bech32 / Bech32m The SegWit address encodings (bc1q... / bc1p...) Ch. 9
P2PKH, P2SH, P2WPKH, P2TR Standard output types: pay to public-key hash, script hash, witness public-key hash, Taproot Ch. 9–11

A.7 Transactions and Blocks

Symbol / Term Meaning Introduced
UTXO Unspent transaction output: the atomic unit of spendable bitcoin Ch. 10
Outpoint txid:vout A reference to a specific output of a specific transaction Ch. 10
scriptPubKey / scriptSig / witness The locking script on an output, and the unlocking data on an input (legacy / SegWit) Ch. 10
satoshi (sat) 10⁻⁸ BTC, the smallest on-chain unit Ch. 10
WU, vbyte, sat/vB Weight units (weight = 3 × base size + total size, capped at 4,000,000), virtual bytes (⌈weight/4⌉), and the fee rate per vbyte Def. 10.15
Merkle root, proof π The pairwise-hash commitment to a block's transactions; an inclusion proof of ⌈log₂ n⌉ hashes Ch. 12
h (height) A block's distance from the genesis block Ch. 13
target, bits, difficulty The threshold a block hash must not exceed; its compact encoding; and difficulty = target_max / target Def. 14.2, 14.3
chainwork Σ 2²⁵⁶ / (targetᵢ + 1) over a chain's blocks; consensus follows the most-work chain, not the longest Ch. 13, 26
mempool A node's set of valid, unconfirmed transactions Def. 13.16
MTP Median time past: the median of the previous 11 block timestamps, used for time-based consensus rules Ch. 13
H/s … EH/s Hashrate units: hashes per second, through exa- (10¹⁸) hashes per second Ch. 14

A.8 Mining and Attack Probability

Symbol Meaning Introduced
q, p = 1 − q The attacker's and honest network's fractions of total hashrate Thm. 14.2
z (or k) The number of confirmations a transaction has received Thm. 14.2, 17.2
λ = z(q/p) The Poisson intensity in Nakamoto's double-spend analysis: the attacker's expected progress during z confirmations Thm. 14.2
E[X] The expected value (long-run average) of a random quantity X Ch. 14
Geometric, Poisson The trials-until-success and event-count distributions used throughout the mining analysis Ch. 14 (Probability Background)

A.9 Consensus Constants

Quantity Value Introduced
Block subsidy ⌊50 · 10⁸ / 2^⌊h/210000⌋⌋ satoshis (3.125 BTC in the 2024–2028 era) Def. 15.2
Halving interval 210,000 blocks (≈ 4 years) Ch. 15
Maximum supply 20,999,999.9769 BTC (integer truncation keeps it below 21 million) Ch. 15
Retarget window 2016 blocks, adjustment clamped to [1/4, 4] per period Ch. 14
Block weight limit 4,000,000 WU Ch. 13, 15
Coinbase maturity 100 blocks before newly minted coins are spendable Ch. 10

A.10 Filters and Light Clients

Symbol Meaning Introduced
m, k, n (Bloom) Filter size in bits, number of hash functions, and number of inserted elements; false-positive rate ≈ (1 − e^(−kn/m))ᵏ Def. 18.1, Thm. 18.1
N, P, M, F (GCS) Element count, Golomb-Rice parameter, divisor M = 2ᴾ, and false-positive parameter (BIP-158: P = 19, F = 784,931) Def. 19.1–19.5
SPV Simplified payment verification: header-chain plus Merkle-proof validation Ch. 17

A.11 Payment Channels and Lightning

Symbol / Term Meaning Introduced
HTLC Hashed timelocked contract: pays on revealing the preimage r of H(r), refunds after a timeout Def. 23.9
r, H(r) Payment preimage and payment hash, the atomicity anchor of a routed payment Ch. 23, 24
CLTV delta The per-hop decrement in HTLC timeouts along a route (typically 40–144 blocks) Ch. 24
to_self_delay The OP_CHECKSEQUENCEVERIFY delay on a broadcaster's own commitment outputs—the window for penalizing revoked states Ch. 23, 25
msat Millisatoshi (10⁻³ sat), Lightning's sub-satoshi accounting unit Def. 24.8

A.12 Overloaded Symbols

Several letters carry different meanings in different chapters. Context always disambiguates, but the major collisions are collected here.

Symbol Meanings
λ Chord/tangent slope in point addition (Ch. 3–5); Poisson intensity z(q/p) in attack analysis (Ch. 14, 17, 26, 36); value-decay rate (Ch. 27)
k Signing nonce (Ch. 7–8, 29); confirmation count (Ch. 17, 26, 36–37); number of Bloom hash functions (Ch. 18); generic scalar/index elsewhere
p The secp256k1 field prime (Ch. 2, 4–5, 8); honest hashrate fraction 1 − q (Ch. 14+); a false-positive probability (Ch. 18)
P A public key / curve point (Ch. 5+); probability operator P(·); the Golomb-Rice parameter (Ch. 19)
n The order of G (Ch. 5+); Bloom element count (Ch. 18); generic count elsewhere
m A message (Ch. 6–8); Bloom filter size in bits (Ch. 18); a summation index (Ch. 14, 17, 36)
F GCS false-positive parameter (Ch. 19); fraud-provable rule class (Ch. 20)
h Block height (Ch. 13–15); the secp256k1 cofactor (Ch. 5); a hash function (Ch. 18)
CSV OP_CHECKSEQUENCEVERIFY, the relative-timelock opcode (Ch. 11, 23, 25); client-side validation (Ch. 22)

A.13 Conventions