Why Bitcoin Now: David Chaum and Adam Back Reflect on the Crypto Wars - Ep.186

Transcript

Hi everyone. Welcome to Unchained, your no-hype resource for all things crypto. I'm your host, Laura Shin, a journalist with over two decades of experience. I started covering crypto five years ago, and as a senior editor at Forbes, was the first mainstream media reporter to cover cryptocurrency full-time. Subscribe to Unchained on YouTube, where you can watch the videos of me and my guests. Go to youtube.com/c/unchainedpodcast and subscribe today. Crypto.com is waving the 3.5% credit card fee for all crypto purchases until the end of September. Download the Crypto.com app today.

This is the fourth installment in the Why Bitcoin Now series, which takes a closer look at Bitcoin in the context of larger macroeconomic forces, such as the pandemic and geopolitical moves happening in crypto. My guests for today are Adam Back, the inventor of Hashcash and the co-founder and CEO of Blockstream, and David Chaum, the inventor of eCash and the co-founder and CEO of Elixir. Welcome, Adam and David. Hey, it's great to be here, Laura. Nice to see you. Yeah, likewise. Good to be here. So, just a quick note before we begin, I've been a little bit under the weather.

I've managed to to gather the fortitude to do this episode. Hopefully, it will all turn out fine, but I just wanted people to know that's what was happening while I was trying to prepare for this. All right, so let's start with the first question. How did you both become enamored with the idea of digital currency at a time when that was something that wasn't even really on the radar of anybody in the world, and the internet wasn't even really a big thing. And why don't we start with you, David?

Oh sure. Uh Yeah so well, in 1977 in the spring, I moved to Berkeley to start my PhD in computer science and uh I uh well, I was transferring. Actually, I had a Regents for your graduate fellowship at UCLA, but I decided Berkeley was a more my kind of place, so I moved to Berkeley and I, you know, really focused on privacy and the uh trying to foresee how the world would the digital world would play out.

And I realized that privacy was a key ingredient in that, and I started developing you know, a few technologies to see where this would all go, and the first one I started with was actually voting. And which more or less immediately led to what's called mix networks today, and that's something I published in '79 as my master's thesis, and then appeared in CACM in in '82, I think, but is pretty well uh referenced uh work, and many people have implemented this over the years. It was a put in the public domain, and uh it's the only real way that's practical

at all to create what's we call a large anonymity set, which is the figure of merit in any kind of privacy system, right? It's like, how many people are you actually anonymous among, assuming that the bad guys can see everything that everyone sends to everyone else? That's the threat model, you know, and we learned from Snowden now that that's the real threat model. Um so, uh that was kind of where I started. I thought, yeah, this is really important if the government can see who talks to who and when, uh then you don't really have a basis for for being a participant in a democracy. This could be uh a kind of a chilling thing.

And so then the next step, to come to your question about money, was Well, then I thought, well, great. So, I can participate in this upcoming internet thing or this, you know, the future digital world. We didn't know exactly how it was going to play out in in the in the late '70s, but uh I'll need some way to pay things and and and be paid to do things. And uh if if, you know, that payment system allowed the linking of who's paying who to be recognized and you know, by people listening in on the network, then it would undo all of the the what we call traffic analysis

protection, now called metadata shredding. The the the hiding of who talks to who in the messaging system would be uh obviated, would be undone by learning who pays who, because then you would you'd know anyways. So, I I thought, well, we need a payment technology that will work in this privacy uh protected metadata shredding sphere. And so, that's when I uh in the let's say in the early '80s, I had I invented eCash, which was a uh a privacy protecting uh digital bearer instrument.

And that's something that I don't think people have really recognized. It's I mean, it some sense you could call it Bitcoin because but it was it has certain advantages over Bitcoin in that of course there was very strong privacy that you couldn't break even with uh unlimited computing power. And then it also had the the property that when you had this money, no one could take it away from you. So, you know, nowadays you could take uh you could change uh things on the chain if you really want to, sometimes it happens, but with eCash there'd be no way to take money away from you because you would have these digital signatures on serial numbers that you chose at

random, and no one would see them even if they had quantum computers or unlimited computing power, they couldn't figure out which serial numbers you chose at random and have the signatures on. So, you would be protected uh in the holding of your money. So, it was a digital bearer instrument. Uh it's that, you know, no one had ever thought of anything like that, and and that was a really big deal. So, that's how I that's how I came to it. Okay, yeah. Let's uh we'll dive a little bit more into eCash in a moment. Um Adam, what about you? How did you get into digital currency so early on before anything like Bitcoin was on the scene?

So, I started a PhD uh in 1991, and uh I guess the year before that I had a friend who's doing a master's degree, and uh this is at University of Exeter. We had uh distributed systems group with some parallel hardware. So, you know, lots of processors, high-speed interconnects, and it's a kind of interesting challenge to program those things, and that was the topic of my PhD actually. Initially, it was more about distributed systems. So, I came to know about the Byzantine general's problem and things like that before other people who maybe heard about that topic first in Bitcoin or cryptocurrency context.

So, in any case, my uh friend there was um trying to accelerate the RSA encryption algorithm on these parallel hardware because at the time, CPUs were a lot slower than they are now, and so we even to encrypt messages was somewhat slow on a general desktop processor and that kind of thing. So, I got interested in got to know the technology before the kind of you know, the uh the very interesting balance of power change of being able to have end-to-end secure messaging that governments couldn't encrypt and so on.

So, wasn't long after that that PGP came out, and PGP had that very interesting property. I think the internet itself brought a lot of um kind of freedoms and more direct participation, for example, in media and blogging and conversations. It's less hierarchical. Now, some initially some government friction and adapting to the concept that you know, while they could maybe influence a large media organization, it's very difficult to influence millions of independent voices with their own views on things, and you know, of course that's progressed a lot since, you know, the '80s and '90s, but from the interesting PGP, I joined the

Cypherpunks list, which is basically a group of people interested in technology like that. So, um internet technology with some kind of privacy benefit or change in the balance of power. So, the kind of things that Snowden came to blow the whistle on, people were suspicious of, and these were the kinds of people that were suspicious, you know, is is the government really actually recording all this stuff? And there was a whole like campaign called about the banning of encryption actually, or the banning of export of encryption from some countries, or you know, discussion about countries banning encryption software that the

uh national security apparatus couldn't decrypt. And some of those things pop up even decades and decades later, so it's kind of disappointing that that's still ongoing. But I think my my view was that we have in laws and regulations established rights, and it's a kind of natural balance in society that for, you know, respect and privacy and personal independence and so forth that you have various rights, but they become harder to enforce or eroded by the mechanisms of the internet. So, those are the things some of the things that David was talking about that, you know, actually to even hold on to the rights that you naturally assume and expect in the physical world, some of those start

to get eroded because ISPs are keeping logs initially for other, you know, for service reasons, but once they're recorded, then people start to ask for access to the logs, you know, different law enforcement and so on. So, I got interested in privacy technology and you know, spent much of the time when I should have been, you know, working on distributed systems actually reading all kinds of applied cryptography papers including David Chaum's, some of David Chaum's papers, and implemented some of them in cryptographic libraries and actually implemented a an eCash library that implements uh David's eCash protocol, the the online version, not the more complicated Chaum Chaum's

offline version, and also a related system by Stefan Brands, which is just another variety of that. So, I implemented both of those systems in a library. And you know, there was there was a great deal of interest in privacy technology, but all of the networks were operated by volunteers. So, you know, the cost of the servers, the cost of the bandwidth was volunteer. And it was a big gap in the technology that there was nobody to pay for anything. And as David said, you know, as soon as you whip out your credit card and and pay for something, now all the privacy's been undone and gone. So, uh clearly electronic cash was needed.

So, there's a lot of excitement about David's company DigiCash at the time, which which was deploying the technology that he talked about some some decades after he first published the blind signature paper. Now, people wanted to see that deployed in some way or other, and and that was uh for a time deployed in a kind of demo server, but it was I think Bitcoin, which came very much later, struck, you know, approach from from a different angle, which is a it was more distributed but less private. And the reasons for the distribution or decentralization are sort of censorship resistance, survivability. You know, so it didn't

depend for its viability on any any group of individuals or companies, right? It would just keep operating as a fabric. So, there's no new not really any prospect of the internet disappearing because there are so many different service providers and operators. And so it is with Bitcoin that there are, you know, so many different companies offering integration services and wallets, and doing mining, and providing various infrastructure services. So, Bitcoin becomes much more of a fabric, and so more survivable, but it's not as good from um from a privacy point of view. So, you know, with my kind of interested in interest in applied cryptography, when I saw Bitcoin and and started taking more of an interest in it, it struck me that,

you know, now that it was here and it addressed sort of robust survivability, that maybe there would be some way to improve the privacy. And of course there've been incremental improvements over time, but I proposed something called confidential transactions, which um is a way to encrypt the values of the So, so how many coins are being transferred, but still have it be publicly auditable. So, it turns out you can do that using zero-knowledge proofs. And, you know, the challenge is to make it compact and efficient. So, uh that's been implemented in sort of related systems. So, like side chains to Bitcoin, so kind of modular layer twos to Bitcoin and some other systems. And there And

there are a variety of uh uh price technologies in surrounding uh cryptocurrencies which which are interesting. And I hope that, you know, one day as a technology matures, Bitcoin itself will incorporate more strong privacy either in the layer one or in the layer two. Um So, so I came at it from a price technology perspective. I think Bitcoin adds one other dimension which was not something I was focusing on before. I mean, I think that, you know, in the in the early to mid-90s onwards, there were a lot of people interested to try and find a way to deploy electronic cash either, you know, using Chaum's protocols or other protocols or

independently and finding difficult, like technically challenging to do that. And so, I was part of that kind of group of researchers like Hal Finney and Nick Szabo and other people that were discussing these things. One thing that Bitcoin adds that wasn't to my mind the major concern at the time is a digital gold-like aspect, right? That it that it would have also some kind of monetary reform or return to a gold standard but in a digital format. You know, we were looking at it from the point of view we need electronic money with strong privacy and bearer properties. But if that would have been denominated in US dollars or, you know, some other stable

large country currency, we would have been very happy and and felt that we'd achieved the objectives. So, Bitcoin adding that is a is a new dimension and um I I think likely helped its uh you know, popularity and adoption as well. Yeah, uh super interesting points and we'll dive into some of these a bit more later. But one other thing I wanted to ask about those early days was Was there a sense at that time that uh it was kind of like an active group of people that were all working on this or did it have this feeling more of people that were kind of loosely connected on the internet and then each of you were sort of tinkering on your own?

It like you know, I'm just trying to get a sense of the feeling during those days whether or not it was something that felt like it was almost imminent or if it really felt like well, all these people are trying different things but you know, it's probably kind of far off in the future. Let me maybe maybe I could speak to that Adam because I think we're talking about two different time frames here totally, right? Adam's talking about the 90s. I'm talking about, you know, I invented all this stuff in the late 70s and published it in the early 80s and I did another thing which was, you know, really fundamental that opened up this whole discussion. Adam mentioned the crypto wars without

calling them that but that, you know, governments were in this mode of, you know, saying that you couldn't export cryptographic software or that you couldn't In fact, they were putting secrecy orders on researchers in the United States. People I knew independently created ideas and the government comes and says you can't talk about that. It's a national security, you know, you they're going to put you in prison if you talked about it. Well, Adam, I I mean you have your famous t-shirt, the RSA t-shirt. Can you talk about that for a second cuz that Yeah, it's it's related to what David just mentioned. Yeah, so well, I was living in in the UK at the time and so

the I mean, you know, various countries had different export controls and regulations but the US was the largest exporter of software, you know, the the nexus of a lot of internet software development and so the fact that it's had this non-export policy on cryptography. It was a concern that struck me as kind of silly because so I set about making a very small program that would normally be unexportable. And it's, you know, it's like three lines of pearl code or something. So, it's very small. And I made a t-shirt and sold some t-shirts. And there are people who did other things with it, you know, like got a tattoo or you know, put it as a signature line on the email and so on and so and I think there was a law professor who there was

a procedure where you could ask if your software was exportable. So, there was a law professor who was trying to fight this export regulation through the US courts. And he asked for approval to export this, you know, three lines of pearl. And they said he couldn't. And it's also very anachronous because there's the very strong US uh free speech and it and it particularly applies to written, you know, to books. You shouldn't, you know, ban books and things like that. And so, there were people there you know, put the PGP source code in books and freely exported them. But to do it electronically would have been illegal or something. So, it it struck me as kind of sort of silly, but at the same time serious, you know, it was hampering

business and it was meaning that de facto a lot of software wasn't as secure as it could have been. So, it was a way to sort of put some political commentary on it. Like, you know, here's the de minimis thing that they would apparently consider to be unexportable. So, anyway, sorry. Continue with your line of thought there David. Well, but just to make clear for people like you printed it on a t-shirt. And then so, if people flew internationally with that t-shirt on, then they were breaking this law. Is that the case? I don't know. I mean, if you can export a book, can you export a t-shirt? That is a bit of a gray area, I guess. But at least it it people thought it was an amusing kind of way to protest something that they were quite unhappy about. It was a serious thing, you know, because it was

impeding internet commerce basically cuz people didn't feel they could trust encryption and it was also pushing jobs away from the US. You know, now there were people in Europe writing cryptographic libraries because their US counterparts wouldn't be able to export them or, you know, international companies saying our offices in Europe to do apply cryptography implementations and things. So, it was it was quite the inconvenience and it eventually got overturned, but not not before there were, you know, test cases and a lot of drama. So, the the crypto wars as David called it. Yeah, that was a real thing in the in the '90s.

And it's so David, yeah, we interrupted your line of thought. What were you going to Oh, well, I'd like to let's let me just turn the big old heavy TV camera back to you know, when this all was really in play. So, as I was saying uh a number of my uh colleagues and friends had secrecy order placed on them by the United States government which made it a federal crime to uh reveal what they were researching even though they had they weren't drawing in any classified sources. So, that's a doctrine that someone's referred to as born classified which we have as an official policy in the United States when it was relates to nuclear weapons technology.

It makes a certain amount of sense to me, I guess. Uh but you know, to apply that to cryptography seemed uh a bit out of range. And so actually, so I was a graduate student at Berkeley thinking about you know, liberty in the digital world and uh what it would be like because, you know, it's a lot more kind of bi-stable. You know, because if you everything's digital, you could spy on everything pretty easily or I developed these technologies that would allow you to protect your privacy. So, you it could go sort of one of one of the two ways, but all the privacy technology was based on encryption and special kinds of

encryption that I developed, you know, and so I really pioneered a lot of that stuff and I think that's what inspired the Cypherpunk movement. I mean, that's what everyone says. But the other thing that I think really is very significant is that this all could have gone a very different way because the the the National Security Agency, which is our main cryptographic authority in the United States, you know, for protecting secrets and breaking codes, they got a new director and this fellow came in and he started writing letters to all the scientific associations like that, you know, the

ACM and the IEEE, which are the main ones for computer technology, telling them that they should not have conferences or even sessions at conferences that covered cryptography because this was, you know, an illegal export and that they would, you know, he was going to throw the full force of the US government at them and, you know, that unbelievable uh penalties would would would accrue to them because this was totally illegal.

And with my perspective at how how important all this encryption would be to deciding which way the world would go and, you know, being a relatively, I don't know, Berkeley young guy caught up in the whole atmosphere there and everything, I thought there's only one thing to do and that is to organize a conference on cryptography but to do it secretly not to use the phone. So, we I did it all by in-person conversations and by and I mailed out invitations uh to a bunch of you know

basically a guy named Len Adleman was a researcher from from the RSA name or the A. He had a list of we got a printout in those days you know and me and my girlfriend sat in the apartment you know and we uh cut those out and glued them onto these envel you know and we mailed these these things out in the in the in the paper mail and um so there was a a conference and most people interested in the in the field came to it and it was uh in Santa Barbara. I stood up there on the stage and thanked everyone for showing up and I announced that if they you know since they paid 100 bucks or whatever it was 80 bucks to uh for the registration fee that now they were that was the a membership fee

in a new international association for cryptologic research. International scientific associations are protected by the United Nations and so you know there was a bunch of people in the front row uh all uh who had registered for the conference as private individuals not affiliated with any institution but they all would happen to live in Laurel, Maryland. Which if you know anything about the NSA that's where they they are so and so all when I said this you know they just you know these people all turned green. It was that was it. It was over.

I said okay we're having our next event will be in uh Udine, Italy and here's Henry Becker he's going to be the chairman of that that'll be in the spring and you know it was over so you know the government tried to to make cryptography born classified and they they threatened these big organizations and that scared them you know cuz those bureaucrats didn't have a lot you know of skin in the game but I I felt it was just too important so I risked spending the rest of my life in jail to set cryptography free, which I did. And I I'm very proud of it. And at that conference, I published the uh the eCash paper.

Uh and um you know, and that conference, that association, by the way, is very robust and exists to this day. It is the main uh by probably the only real organization in the field of cryptography. It publishes a journal through Springer Verlag. All of its proceedings are published. It has a three annual conference, three conferences every year in different parts of the world, plus half a dozen workshops. So, it's the the International Association for Cryptologic Research, it's called. And uh it's it's it has enough money in the bank, you know, to where weather the pandemic, even if it has to pay for a conference for like a year or two, if no one comes, it's still it can afford that. So, uh we resisted like

joining these other scientific associations. So, it's maintained a very independent and robust uh uh position and done a great deal to uh you know, facilitate and build up the the scientific community in the field. So, this was a a pivotal pivotal thing. It's so fascinating. I love that story. Uh so, in a moment, we're going to talk more about eCash as well as hashcash. But first, a quick word from the sponsors who make this show possible. How much in fees are you paying for your crypto purchases? crypto.com is waiving the 3.5% credit card fee for all crypto purchases, which means you can buy crypto with a 0% fee. Apart from your

crypto purchases, you can also get a great deal on food and grocery shopping, too. Get up to 10% back on Uber Eats, McDonald's, Domino's Pizza, Walmart, and many more when you pay with your MCO Visa card. No card? On the crypto.com app, buy gift cards and get up to 20% back from merchants like Whole Foods, Safeway, Burger King, Papa John's, and Domino's. Download the crypto.com app today and enjoy these offers till the end of September. Back to my conversation with David Chaum and Adam Back. So, David, you did allude to this briefly earlier. You created the eCash system, which had as its currency CyberBucks. How did eCash work? And um and you can also explain DigiCash.

Okay, well, that's a lot. That's Yeah, it's a kind of a a lot of stuff but but if you come to if you go to chaum.com, there's scroll down there's projects and one of them is the eCash project and you can see there's a whole DigiCash museum there. And so, you can see all about the history of it and pictures of the people and all this stuff and you can see uh interestingly the banners of the original CyberBucks accepting shops on the internet. And so, there's a whole bunch of them.

can you want to list some of those for people? really remember them off the top of my head but you go there because you can click if you hover over them, you know, if you're on a laptop then you can it'll show the name and if you click through, you can see like a from the Wayback Machine what their homepage looked like. So, you can see all these different people selling interesting stuff. Uh so, the deal was if you put up a shop and accepted eCash, we would I would give you 100 CyberBucks. And there was okay, it wasn't wasn't a you know, we just said, well, we're going to have like a million. It was limited. So, the idea of a limited issue was something that a lot of people had talked to me about, you know, because it's a a lot of people

feel that's very important to do. So, we did that and and uh you know, it was a it was a pretty successful thing but I think Adam will recall this back in those days, you know, it wasn't that easy to install the client software and get it to work and there everyone had the different versions and different operating systems, and uh it was computers were very slow for processing the you know, all this, and um you know, we were using modems and all that back in those days. It was not uh easy it wasn't easy for us to uh make it a seamless uh you know, experience on your smartphone or something. It was uh it was a really something you had to want to do. So, it was kind of hard to compete with credit

cards and all that when you know, as as the internet it just you know, ex- ex- accelerated. But, what we did license and build for different banks uh also their own system. So, the largest bank in Europe at that time was Deutsche Bank and I went over there and I talked to their board, and they were all excited about it, and they decided to back us, and you know, people say that Digicash failed. Well, it's not really true. It was taken down because they were willing to invest you know, quite a lot more money in it, and and and the people who got control of the company didn't want that. They wanted to kill it. So, it was a sad thing, but the but Deutsche Bank was a very tough customer.

You know, if you could imagine a German bank, you know, the biggest bank in Europe, they had their data center was in an old bunker. It was several stories underground, and they wanted every kind of backup, and you know, recovery, and everything. So, we had to build all this stuff for them. We satisfied them, which I think is quite an achievement. So, the it was a very industrial strength e-cash banking system, if you will, uh that attached to their you know, what are called current accounts, so their uh you know, a regular uh consumer uh bank accounts. And uh and there were shops that were accepting it. In those days, of course, it was before the euro, right? It was in Deutschmarks. And so, you could you could use Deutsche Bank issued Deutschmarks and buy things online with uh and we so, we made all

that for them. It was all Deutsche Bank branded and then we had Mark Twain Bank in the US which offered US dollars and they they were an international currency bank so they had some other they could do various conversions so that was great and then we had Advance Bank in Australia which I think was like the number two or three bank at that time now it's been merged in they were issuing in Australian dollars and we had bunches of people wanting to use it and you starting to use it in various countries and I mean I think my congressional testimony in the US is you know maybe I noteworthy but I also spoke to a bunch of other governments and visited many central banks around the world and

you know I told people at that time what I really told them was you know if your country would take the initiative and issue its money in e-cash you could be the electronic commerce leader of of the world. This would be a tremendous economic opportunity for your country and that's what I was pitching when I had that chance to to speak to those because I was invited to a lot of central banks and you know VC international and Citibank and all these I was sitting there in the boardrooms and meeting the executives that come to visit me and you know all this stuff so I mean there was a lot of interest in what we were doing I I have boxes of press clippings from those days

because when I issued when I announced the you know I did the first e-cash payment the first worldwide web conference from CERN to to Amsterdam and that's when and and then I wrote wrote a little press release and this guy sent it out from the company and it was the New York Times picked it up and was it was all over the global media in about 48 hours and there was so much interest in the idea that a number itself could be worth money you know that I was interviewed in all kinds of languages I don't even know what languages I have all like a whole archive of videotapes all you know those big old videotapes of of TV shows where I was interviewed and there was so much interest in it.

Yeah, and let's just look under the hood and talk a little bit about eCash. Um, so I know I believe that blind signatures were one of the breakthroughs that yeah, so can you just explain that for us? Yeah, absolutely. So I mean there's you know, there are many kinds of digital signature or digital signature is a pretty general term these days in its usage but we have one type is blind signatures and I invented them especially for payments and eCash. Now actually I was hoping that they would be used in a whole range of other applications to do with what I call

credential mechanisms and I wrote this paper that appeared in you know, it was mentioned on the cover of Scientific American. It was also on the cover of the best journal of computer science CACM at that time. You can see it on my website. It's another one of the little project things there at charm.com but you know, I created a whole a concept for how you could use the mixing to have perfect privacy and who you talk to and eCash to make your payments and then the digital the blind signatures could be used to basically prove things about you without revealing who you are.

And so like you know, classic say if a kid is at a bar and they want to or somewhere they want to get in they want to say that prove that they have a they're old enough or they are they have a driving license or whether from a different state or whatever but they don't want to give their address and all this other stuff. Well, that that's what you could do with the credential mechanism. You could prove exactly that you qualify to according to whatever you know, to one way but you wouldn't have to reveal which way that was. You would just reveal the exact one bit that you were qualified, you give a signature that would prove that irrefutably, and that was So, that I found a way to that basically turned the databases that companies would have about you inside out, so that now

you maintained your own information about yourself, and whenever they would normally ask their own database a query, they would ask have to ask you, and you would prove the answer was correct. You give the answer and prove it was correct if you wanted to answer it. So, that was a whole comprehensive thing. So, blind signatures went a little bit beyond So, I was hoping that eCash would be like a Trojan horse, you know, people would start using it for payments, and they start to say, "Hey, wait a minute. I don't have to reveal my identity to make payments. That's pretty But, if I want to, I can prove that that shop got my money, so that's pretty cool. Maybe I could use that to check out library books, or, you know, maybe for these other things." And then it would the credential mechanism would kind of grow

organically, and that's why I went to a lot of effort to publish it in these mainstream publications, to try to really distill it and work with artists to, you know, get the concepts across, and and all that. But, so, the idea of a blind signature is very, very simple. In those days, we had carbon paper. I don't know if people these days know what carbon paper is. it is. Yeah. We have carbonless carbon paper, I guess. You know about that. It copies through. So, basically, the the easy way to understand eCash that's very close to the reality of it, the the blind signature is that let's just say I make I take a piece of paper and I write a random serial number on it that only I know, and I put it in an envelope with some carbon paper inside, or carbonless

lining, or whatever. I give it to my bank, and they and they say, "Here, it's me, you know, take the money out of my checking account, and validate this with your special worth $1 stamp." Well, it's like a signature that they can make, but on the outside of the envelope, they get they return the envelope to me, then I can remove the envelope. Now I have my own random serial number with their the carbon image of their unforgable worth of dollar stamp on it. So now I have this dollar, but no one knows its serial number. And so I I'm sure I have the money. And so when I go and I you know, no one can take it away from me. They can't you know, screw with my account or anything. So then I take

it to a shop and they say that looks nice, you know, but we got to check that you haven't spent that serial number before. So they check with the bank. That's the the so-called you know, what I call the double spending uh problem in those days. And you hear a lot about it these days, right? And so the the bank would then say, "Oh yeah, that's our signature, but we haven't and we haven't accepted that number before. And so we will honor this and put the money on the shop's account." But of course, we have no idea who the payer is. However, you know, the user's very well protected. So I didn't mention this, but that serial number it's actually the result of applying a hash function. So uh you if the bank says, "Oh, we already

saw that number. You know, it's not valid." Then then this the retail the shop would say, "Oh, that's interesting. Can you please show me the number that when you hash it gives you that serial number?" And of course, they wouldn't be able to do it. So only once they sign and say, "Okay, we'll accept it." Then I give that hash pre-image and then they can then they know and then and so that's it's totally secured in that way, but it's there's a so but the privacy is let's say asymmetric. And I was very happy with this. I mean, in those days it really worked well.

Uh you know, we have there's something called the Bank for International Settlements, which is the central bankers uh central bank, you know, where I visited and I spoke there, you know. It's a whole thing. And but they promulgated it. They said it They have a publication those days called, you know, definition of criminal use of payments. And they listed them and they were, you know, very strong about it all. And it was basically extortion, black markets, and bribery. And it so it turns out in any of those scenarios, as the if you used e-cash instead of a suitcase full of $20 bills, right? But if you used e-cash, then no criminals would accept it because since you knew the serial number that you created, you could always kind of tell

the bank or the government or something, "Look out, these guys are going to be spending that." Or, you know, so no ex- no no blackmailer would take payment by check or, you know, no black market's going to accept Fedwire or, you know, these things. So, it was a a way to protect the privacy of the individual, and we say that unconditionally because the blinding in the blind signature is not just cryptography. It's It's what we call uh information theoretic statistical security. There it With unlimited computing power, quantum computers, whatever, you cannot learn anything about what's blinded in there. It's so it's uh uh unconditionally uh protects you as a consumer, your privacy was

uh and the protection of your money that you held was perfect. But, on the other hand, it wasn't really a suitable currency for, you know, paying bribes to politicians and things like that. So, I felt it was a really superior form of money. And in fact, if we could get rid of paper money and switch to this, we could get rid of a lot of uh corruption and problems which are, you know, pretty big deal. Let's also briefly just go over what happened with DigiCash. You did talk about that a little bit. Um you know, it had offers of investment from places like ING Investment. Um there was even a plan, I think, for ING Barings and Goldman Sachs to bring DigiCash to the

stock market. And Bill Gates expressed interest in integrating it with Windows 95. Uh Netscape expressed interest. Visa wanted to invest $40 million. And none of these potential deals happened. And in subsequent reporting, I guess some sources say that you wanted too much control. And employees also felt you were too paranoid or greedy or stubborn. And that's why these deals fell through. Well, that's the thing. Yeah, you know, that's how great What's your Yeah, what's your No, it's No, I've Look, I I'm doing this to make the world a better place. And that's why I put my life on the line.

And that's what I've been working on all along. And you know, I think it's really true that the powers that be wanted to kind of you know, stop this from being what it could have been. And I really wanted to give it a chance. Do you mean Microsoft and Visa and Netscape? Or what do you mean by with the powers that be? Cuz they were interested in in you know, using this and integrating it with their businesses or investing in it. Well, I mean, what about like policy makers, regulators, things like that? I presume it was I don't think they were the ones who stopped these deals, were they?

Well, I think it's a it's a you know, one thing I'd like to say is that it's a it's a testament to the significance of the ideas that I developed. And that there was so much interest. And we had very serious conversations with a number of these organizations. It's true. Um and uh you know, we were represented by investment banks and you know, and so forth and so on. But if I if there was ever a scenario in which I felt that the potential of this was going to be uh taken forward and used it to really plant that seed of privacy that I'd hoped for. I I'd uh you know, that was last thing in the world I'd want to do would be to stop that.

So, um yeah. When you When you start to really see the you know, you're invited into the corridors of uh uh massive power, it's quite an eye-opening experience and uh uh you know, I I was at the uh invited to I spoke at a conference of central banks in in uh Milan and um I mean in Rome and um uh they told me that you know, I mean, it was a the airport was clogged up with senators. Like the private planes, I mean, they closed off avenues and we walked uh across a bunch of streets. Police had blocked it all off. We walked right in the Vatican. You know, it was only for us. I mean, they said no one has non-settleable record ever been even allowed to attend any of their meetings. And I I had me

speak there. I mean, people recognized the significance of what this was, but I I'm not sure that anyone was really interested in the uh disruptive uh power of it. Um yeah, and uh and there you know, and it's not like I had a monopoly on so that as Adam mentioned, there were other kinds of blindable signatures that were contorted in a way that they they didn't really fall under our uh control. So, I think that I mean, this is you know, I don't want to get too uh broad a perspective to answer your specific question, but what I would say is that the I mean,

just a little bit more generally, you know, if we want cryptography to rise to its potential to make the world a better place for people, then probably we need to do that in a way that is a more of a works in a more comprehensive manner and is not more or less a guerrilla action on the side. And that's kind of uh what I've been really trying to do. And that that puts the burden on on us to figure out how you could really use this in a way that you know would address legitimate issues of society and at the same time you know liberate people and

human potential. You know this is the thing that will take civilization to the next level. Yeah, it's interesting cuz that description of a gorilla action on the side is almost a description of Bitcoin. But anyway No no no no no it's not not at all. I wouldn't say that. No no. I'm I'm a huge fan of Bitcoin. I think Bitcoin changed the whole landscape. Yeah I would say eCash is Bitcoin zero, Bitcoin one is Bitcoin made a lot of people rich no question and Bitcoin two that's that's coming. You know and maybe it'll it it needs to be a little more hard to take down and a little more a little bit real privacy and maybe integrated with some other features.

Yeah we're so just to give people a sense of the timeline. So you left DigiCash in 1996. DigiCash went bankrupt in 1998 and meanwhile right in the middle there in 1997 Adam sent an email to the Cypherpunk mailing list about hashcash. So David do you want to dispute the what I just said there? I'm sorry I Laura I timeline right? Such a pleasure of speaking with you but I'm not sure I feel like I've been cross-examined. I'm you know a lot of what you said has been said none of it's exactly accurate and what you said is not exactly accurate. I don't want to be put a position to criticize any of this but I mean uh No I mean if if I don't have the facts I didn't leave DigiCash in 96.

Oh you didn't? Okay. No no in 94 I don't know what you're referring to. I mean the hashcash was just something that Adam developed as you know for to protect against spam by using computational cost and this was something that was already you know with the remember I mentioned the cryptography conferences that I created. So, years before Adam's mention of that, it was already, you know, published by Dwork and Naor at the conference, you know, of work, proof of work. Proof of work for preventing spam. So, yeah, it was already, you know, I was so I mean, what do you mean that Adam wrote a letter to what?

I already knew about this years earlier. I was there when Cynthia presented, you know, Moni Naor was my co-author on the the offline eCash article. Right. So, just So, just for our listeners, Cynthia Dwork and Moni Naor wrote the proposed proof of work much earlier than Adam wrote the hash proposed hashcash to the Cypherpunk mailing list. I'm just published it. They They presented it at the the flagship conference Yeah, I believe they presented it in 1993.

I'm just I'm just trying to make the transition for us to talk about hashcash, that's all. And to show that all of these things were happening right around the same time. That's all. So, that's fine. Yeah, it's really true. And I I think that proof of work You know, let me say this. I There were a lot of people, you know, a lot of Cypherpunks that I invited to visit us and work for us at eCash. It was a very open company. We had a research component. So, I had a lot of interaction with people like us. Zooko, you know, was there for quite a while. And I worked with him. Yeah.

Yeah, to on you know, try to help him develop his own systems while he was there in my under my employ, on my nickel. And I mean, later Zooko wrote to me He wanted to come to Crypto. He had no money. I said, "Sure, I'll pay for you to come." Yeah. And you know, and I picked him up at the airport or whatever it was. I, you know, I helped him out. I I mean, you know, then and and Nick was there. Yeah. And Nick Szabo. Yes. You know, it was a very open company. hashcash. So, Adam in 1997, you sent an email to the Cypherpunk mailing list proposing hashcash. What problem were you trying to solve and how did hashcash do that?

Uh yeah, so I was running remailer, so a way to send anonymous email and communicate on Usenet discussion groups with anonymity. And as I mentioned earlier, the the technology for these things is basically operated by volunteers. So the problem, or one of the problems as an operator of these things, it wasn't that expensive to operate in terms of bandwidth and server resources, but it seemed that some people didn't like free speech or you know, ability to communicate privately or anonymously and had taken it upon themselves to spam through through the systems. And it it wasn't even commercial spam. It was

just, you know, random numbers, just just trying to be disruptive. And we think, cuz it was happening to multiple remailers, there were probably about 30 to 50 of them at various times, that the people doing this were trying to annoy system administrators who operated Usenet servers. So Usenet's distributed discussion groups and they use a lot of bandwidth. Like a university site or a big ISP, it would use enormous amounts of bandwidth. And so, you know, it it would start to annoy the system administrators if people were spamming through the remailers, the reaction would be maybe to block remailers or something like that. And I think that's what they were trying to achieve.

So it occurred to me that it would be good if there was a way to combat this spam problem and because it was involving privacy, I had to think about it in a different way because the usual anti-spam technique that system administrators use, I've heard you give the same presentation I'm just wondering I mean but work and Laura already published proof of work as a as an anti-spam mechanism. Sure. It was this was at the premier conference everyone in the field knew about it. It was in published in the Springer lecture notes and it was in every library computer science library in the world practically as very widely disseminated. So

why did you have to think so deeply about it? Well, I wasn't two two things here, right? One is but I have one of the questions for you. I'm sorry. I don't mean to I'm I know you made some look I value what you were doing and I know it's tough to operate a remailer in those days. Were there also mixmasters? Were those running in those days and yeah, they were the real deal that was the large anonymity set so because because you put yourself in a very difficult position knowing the linkings, right? But if you would cooperated with us in a more open system using the mixing technology, you would have been maybe there were two generations of remailers. So how funny wrote the first one which was just a kind of nested onion but because it didn't standardize the message sizes. You could say that a

globally you know, that that wasn't very good for passive traffic analysis. If you if you like I guess you Yeah, I see. I get it. The second generation was a mixmaster. So I was running actually it's backwards compatible but I was running a mixmaster remailer for a few years. Oh great. And yeah, and I mean so in terms of hashcash, I was not aware of Dwork paper until somebody sent me a link to the publication a couple of months after I had posted the source code for hashcash. And so some years later I got around to kind of writing a paper about the experiences of people using hashcash for various things and in there I cited a

number of things. Obviously it was paper as I was aware at that point, but also there were some other related things, I think, in in a way of thinking the sort of very invention of public key cryptography with Merkle puzzles is is a kind of proof of I mean, it's not exactly proof of work, but it's related, right? interesting. Yeah. Yeah. And if you look around, there's a lot of linkages and reinventions in this space, you know, so there have been other things where uh people have published something.

Like, there were, for example, client puzzles, which was another kind of hash-based uh proof of work by uh Ari Juels and Brainard. I've probably also in one of the cryptography papers. And they were not aware of Hashcash, for example, right? So, the original Dwork and Naor was using asymmetric techniques. There's a lot of reinvention. Of course, I didn't publish it in an academic paper, and I So, I just published it on a website, so if, you know, fair enough, they wouldn't have been aware of it. But just to say that there's a lot of kind of reinvention and in my experience, the um building things in an applied way sometimes brings together new ideas, right? So, Yeah.

you can have an idea you can work on it and exactly, right? So, so that was the kind of general uh thrust of it. So, then I have uh you know, done general publications of things, but more in the uh distributed systems space. So, because it was a kind of applied thing for me, I just put it on a, you know, like a tech report on a website kind of thing. So, anyway um Oh, yeah, go ahead, finish. Yeah, so I mean, the the idea there was to to think about it in a way that could preserve privacy. So, there are a few features about it that uh privacy-related. So, it adds uh it has a timestamp, but there's some randomization of the timestamp so that

you wouldn't reveal, you know, from a black box. If you're looking at it from the outside, seeing all the messages that was going in, you wouldn't reveal who's likely sender by looking at the timestamp. So it had some features like that. So then just the idea is to as same as it works in in the kind of concept level, which is to to create cost. Uh that's the basic observation there. The The problem with commercial bulk spam is that costs effectively zero. But I think the advantage of that kind of system is that it doesn't you know, it's it's not as attractive cuz it's not re-spendable.

But it's uh it's more scalable. It doesn't require any infrastructure really. You can just attach it to an email. And actually much later in 2004, Hal Finney kind of got a bit closer to uh assembling these different parts together. So he used Hashcash as the uh proof of work and he used a Chaum uh blind signature based token server. And he assembled it in a IBM tamper-resistant secure processor that he ran. So it had it kind of had the central point of failure risk.

But the But he introduced mining effectively into the conversation. So he was using Hashcash. So I I guess it was a You you can find the website online somewhere. Somebody's archived it. So basically you would do some work. You would send it to this IBM processor that was running in his server and it would send you back a Chaum token. And because of the kind of trustworthy computing aspect of this card, if you assumed that that he wasn't colluding with IBM, which would be a you know, a big stretch to say that they you know, they designed this card and colluded with him, right?

So it's it's a it's a serious piece of hardware that banks buy. And it can provide a kind of signature of execution. So you get Now you can verify what code it's running with reasonable security. Not Not as much as the Bitcoin network because that's you know, anybody can fully verify and you don't really on this kind of you know, trusted hardware uh sequence. But nevertheless, it's kind of interesting assemblage of of parts. So, again, you could call that kind of Bitcoin uh 0.5, if you like, in the uh you know, the Bitcoin zero without a proof of work.

I mean, he's kind of Well, he's got proof of work in there and he's and he's bridging technologies, right? So, it's it's centralized. It's got the strong privacy because you get, in exchange for your work, the charm token. And the scarcity is there. So, it's introducing digital scarcity to And I think that Hal Finney and Nick Szabo and a few people were uh more interested in monetary reforms. So, you know, return to the gold standard or reestablishing something like that. So, people were looking at the electronic cash uh problem from different directions.

You know, some from a monetary reform perspective, some from a privacy perspective. I was a little bit more on the kind of privacy bearer cash perspective. I would have been okay with, you know, dollars or reasonably stable currency. But then Bitcoin, you know, if you scroll forward to Bitcoin, it you know, it loses some of the privacy, but it does plus or minus what Hal Finney is He he called it RPOW, reasonable proof of work. So, basically, it does that, but in a distributed setting. And the privacy it loses is is a side effect. I think, you know, most people who are involved would like to establish a way to to bring it back, but it's more tech technically challenging to do that.

As David would you know, have a lot of experience in protocol design around to to do that in a way, you know, if you have you end up with bigger zero-knowledge proofs and more cryptographic assumptions. So, Bitcoin is using actually quite basic cryptographic assumptions. So, it doesn't really do anything advanced with zero-knowledge proofs and things like that. And so, for both of you, when did you hear about Bitcoin and how and what were your initial thoughts? So, do you want Do you want to go, David? Well, you know, I I'd rather not comment on that exactly. Uh I I don't think I've done so publicly. Could I we just go back before we ask answer that often asked question because I think it's a very interesting conversation about you know, these early days and

you know, one of the things that's colored my thinking Adam on this and I don't I'm curious on your thoughts on this but was really you know, in the in the mid-90s the as I think you pointed out the computing power and the network connections and all this you know, wasn't really up to doing a lot of stuff and the idea that you know, you'd have all these servers running all around the world, you know, supporting payments. I think it was something inconceivable to us. We were we were happy that we could get the client side, you know, to just make a payment in a couple minutes, do any cash payment and that we could get the servers to be able to handle their side of it. So instead of having, you know,

replicating that server so to speak many times. But what we did consider and I think it's not I don't believe it's ever been discussed publicly but several of us in the DigiCash company were working on a more distributed version of of e-cash that was not you know, it was somewhere in between. So it was I mean you can think it's very easy to imagine distributing e-cash in a simple-minded way, right? Where you say, well, we've got, you know, 10 servers now and if a majority of them agree that it has, you know, they all sign and then they all check the double spending and if a

majority say it's okay, then it's okay. You know, if you were to combine that with, you know, what I published as my dissertation at Berkeley, right? Which was a the blockchain, everything about blockchain except for the proof of work part right? Then you you you know, because that was a majority rule network, right? So, that's kind of what we were thinking of as a as a step to distribute this uh, process because there was there wasn't really the resource to just uh, it I don't think uh, you know, it was uh, at that point. So, that would be the would have been something that would have been uh, achievable to make them somewhat more decentralized. You know, more in the

uh, classic BFT kind of model. Right. Yeah. I mean, I think I never heard them talk about it. We didn't That's our That's on us, I guess. No, yeah. So, we um, I think Greg Maxwell had a look at doing that as well. Uh, so just just to kind of make a threshold, you know, like K of N Yeah. Yeah. of the signers. And you you can see in a straightforward way that that work I mean, that should that should work, you know, if you can do a single single blind signature, you can make K of N inefficiently, maybe more efficiently with some more And I think state chains, which is another kind of Bitcoin layer two is contemplating doing the same thing.

The the I think with Greg had some source code but hadn't published it for the uh, kind of threshold blind signature approach. But, I think the the challenge and and a blockstream actually has a kind of federated blockchain, which is also K of N, so it kind of fits into our thinking for a layer two security. But, the the advantage for Bitcoin itself in the layer one is it's a kind of uh, we we published a paper on side chains and and coined the word dynamic membership signature because you could think of the proof of work as sort of evolving and signing in some way with the work

the you know, the the most work the longest chain with the most work signing off the majority of the work signing off and you know, each signature or each addition of a proof of work, you can have a freshly anonymous participant. So, I think Bitcoin stumbled across and then nobody knows who Satoshi is or how he hit upon this idea, you know, whether he came at it from the Byzantine generals uh fixed membership uh BFT protocols, or whether he started, you know, straight from anonymous proof of work.

But, it it doesn't have the membership challenge. And something with a membership is never going Oh, yeah. I know. I know. Yeah. No. That was the That's the big breakthrough of of of Bitcoin, and thank God that it happened. And it's a fantastic, you know, it's changed the world in a dramatic way, and So, yeah. So, let's let's talk about Bitcoin cuz we're well over time, and we're running out. So, um yeah, just how did you learn about Bitcoin? When was that? And what were your initial thoughts?

Uh so, I learned about it in I think it was like August 2008. So, I got an email from Satoshi Nakamoto with you know, the abstract, and asking for the correct citation for hashcash, and I sent him a couple of other papers to look at, one of them being B-money. And I looked at it in more detail actually well when Hal Finney started posting his experiences running it, and uh you know, understanding how it works. So, he posted some longer commentary on I think the cryptography mailing list or the Cypherpunks mailing list. You know, I supposed for somebody who's you know,

spent much of his professional career working on applied cryptography, you know, with libraries and privacy enhancing technologies and things, the thing that will strike you initially until you become accustomed to it is well, that's that hasn't got very strong privacy assurances at least compared to the previous systems and that the security margin on a double spending is kind of 50/50, right? So you're you're sort of trusting that the the economic majority is honest to some extent. Not not in all it depends on the aspects of the system you're protecting.

And so you know from the normal cryptographic kind of asymmetric crypto you typically have an enormous benefit as a defender versus the attacker. You know, you're going to do some computation that takes a fraction of a second and the attacker's going to sit there for, you know, thousands of years with using up enormous amount of compute and probably going to fail to decrypt your message. So you're used to this kind of enormous asymmetry and Bitcoin is like, well, it's you know, it's the good guys versus the bad guys. It's the fair fight kind of thing, right? So it takes you a while to get to get over that, but you know, you then you reflect on it and you say, well, you know, on the other hand it has proposed a novel new solution to the kind of dynamic membership and Byzantine generals like problem space.

And as I mentioned I was somebody who'd read Leslie Lamport's paper while I was doing my computer science PhD. So something interesting and new in that space and it's here. It's bootstrapped, you know, after a while it had a value and so forth when there were exchanges I guess over a year in before there was a price at all, right? It's just people playing with it to start with. So the bootstrap story is kind of interesting. But you know, the fact that it's deployed and it's decentralized so there's no really identifiable nexus of you know, a company or an individual that you would ask to switch off a server or you know, block something. So I think it's an interesting trade-off, right? Because with the DigiCash and related blind

signature based protocols you've got a very strong assurance that you can't selectively block transactions. And the only thing that a party operating it could do is shut down, right? They could say, "Well, I refuse I mean, I can't block anything selectively, so what do you want me to do? Like, they're all indistinguishable to me." Assuming that the the sender wants privacy. Whereas Bitcoin is in not not so much in that vein. It's more that, you know, people are transacting, there's sort of pseudonymity, like the coins are kind of pseudonymous. There's no kind of wallets identifier tracking at all. It's kind of imperfect, but there's a de facto fungibility and privacy and an assumption that there's an economic incentive that sooner or later

some miner somewhere will process your transaction, even if the first one chooses not to for policy reasons. And that's like plus or minus held up. It's a bit of a gray area, you know, there are uh companies that specialize in tracking coins that have been stolen, so those ones are kind of a bit gray, but, you know, some of them move once in a while in small numbers. And there are mixers in the network doing kind of coin mixes or coin joins and things like that. So, it's an interesting system in which to try and deploy privacy improvements. So, you know, the Lightning Network, which is another layer two, has some mix-like onion routing technology.

And the the layer one uh coin joins and Liquid, which is a layer two that my company Blockstream is uh working on, has confidential transactions. So, a different kind of privacy, not sort of linkability privacy, but privacy of the amount of value being transferred. And uh David, what about you? Just briefly. We're going to move on to some other questions in a moment. Like I said, uh you know, I was pretty familiar with all the different aspects of it. So, uh I don't really uh comment on that, but uh what I what I could say would uh I'd like to say, I think, is that I mean, to Adam's point, yeah, that you know, I think there are now the technology is out there both on

the bad guy side because of the quantum computers and all this possibly percolating and then um you know some of the new stuff that has been done to speed up mixing by pre-computation very dramatically and to make real quantum secure BFT uh you know those things uh can come together and create something that has all the the the the real goodness it's more much much more definitive far higher uh barrier against being taken down uh and even by national adversary and the privacy then you get the full

anonymity sets uh and you know you might have also privacy in the messaging who talks to who that's uh that's a great thing so I think there's a whole there's another shoe to drop in this space and but you know I'm the I I would never want to be thought of as someone diminishing uh the significance of Bitcoin I mean to me that is like this game-changing uh world-changing thing and it's uh as you know technologically it's quite of a complex beast but and I think it's showing it's pointing the way to you know different things that we could try to improve and I I I appreciate the way you're you're tackling it Adam this like uh you know

trying to uh add things on to it to make it better and I think that that's that's promising and but one could also you know take it all to the next level and that's something that uh I think it's also I you know Laura your viewers should you know keep their eyes open for something uh really dramatically uh different you know I think there's there's another there's there's room there to really take it to the next level so uh So Bitcoin has gone from a value of nothing basically to currently having a market cap of over $200 billion, and meanwhile, we have this pandemic going on, which is causing this economic freeze that has led to governments

printing more money. And there's all kinds of other factors going on, like China launching its own digital currency and these other central banks, you know, eyeing the same idea. So, when you look at these different forces, where do you think Bitcoin is headed next? To the stratosphere. Adam, did you recently say $300,000? Yeah, I mean, actually, there's been some recent discussion on a different track, which is this stock-to-flow model, which is a kind of um just a curve fits on previous years' price movement, but actually, I think the 300,000 comment was before, which was just um you know, you got you can't make

predictions about these things, but just looking at the use case and the similarity with digital gold, so I was just looking at, well, you know, go look up the metrics. Well, how much gold is there in the world? And people are not exactly sure how much physical gold there is in the world, but they have a rough idea. And, you know, so what's the market cap of gold? And divide that by the eventual supply of Bitcoin, and you come out with a number that's like 300 to 500 per thousand per coin, but then that depends on the gold price, which is also a moving target. And of course, with all this pandemic, economic uncertainty, gold is typically a kind of macro hedge, so gold prices are suppressed price, but uh you know, Bitcoin price is up, too.

And I have to suppose that while a lot of people have heard about Bitcoin, there's probably you know, many people who haven't taken the plunge. Bitcoin has differences to gold, you know, you can send it a distance, you can verify. There's a lot a lot of sort of more transactional value, a utility value, I guess. Um so, we'll see. I mean, I think it's it's certainly a very interesting experience to, you know, send some Bitcoin. I think, you know, in our company, we send uh Bitcoin transaction, I don't know, like $100,000 or something. It involves multiple people, you know, decrypting and signing different things. And you end up with a small blob of text, and you're like,

"Wow, this is, you know, $100,000 of bearer money." It's just the amazing phenomena, right, to to contemplate as a as somebody from a computer science background. That's really a a very interesting artifact for the world. So, you know, as technologists, we're very enamored by, you know, the potential of this building block, I think. Um, and what it what it can do for society to have, you know, the kind of um dependable electronic money from a monetary reform perspective. Of course, that I It seems that the economic commentators are saying that, even though there's been a lot of money printing, it hasn't translated into much price inflation yet. Obviously, there's, you know, there's more money in the system, but the economic downturn has suppressed

price inflation. People are not spending money, and so the uh suppliers are having to, you know, coax people to buy things by reducing prices to what they would do in a robust economic situation if you printed this quantity of money. So, we don't know if and when that will take effect. I think the experience in Japan has shown that countries can have, you know, low inflation rates for a very long period of time. So, you know, some people are looking at the US, for example, uh as a major economic factor in the world, to say that might be in the future. But, uh I think more recently, the US has even said that it has a an economic is considering an economic policy of

creating or targeting the creation of price inflation. So, I don't know. It's uh We live in interesting times, I guess, is the thing we can say there. Yeah, and just for listeners who don't know, I have mentioned this before on the show, but stock-to-flow is this ratio of the existing supply versus the new supply. So, for instance, with Bitcoin, um you know, it's relatively small, but actually it's still a greater than the ratio for gold, um but after the next having, it will actually drop below that of gold. Um however, one interesting thing is that somebody um took that and applied it to the price of gold over the course of history, and there was not a correlation. So, then they felt that that disproved the

stock-to-flow theory. So, we will see how this bears out. Um you know, I'm not sure uh whether or not that will apply to Bitcoin. Um but David, what about you? Where do you think this is all headed? Well, I I I I I'm extremely optimistic about the, you know, the future, but all the trends that you mentioned, Laura, seem to indicate that uh you know, I mean, if if if you're afraid to go places in person, and you want something you can transact with uh online, and you know, these there's a ton of uh of uh crazy stuff going on with governments uh you know, uh these days, so I I it it it must all be pointing in a very positive

direction, but we're not seeing it right now that dramatically because, you know, as as was said, we're not people aren't really spending that much. So, I think it's yeah, this it this bodes extremely well for the whole space uh Bitcoin uh especially, and um yeah, so I I it's this is uh I mean, it's a you know, it's a sad to have to I mean, I'd rather not think that something that I care about, like Bitcoin, is is going to benefit from, you know, all these bad things that are happening to the planet, but uh in fact, yeah, I think it it it it it seems like it will really uh uh yeah, this this all should be very positive for it, but uh

yeah, I'm also I'm rooting for the planet too, you know. Yes. I think we all are. And for humanity so we can all go out and hang out. Yeah. Yeah, so the ethereal next next time, yeah. Okay, well, this has been so fun chatting and I really enjoyed learning about your early work in digital currencies pre-Bitcoin. That was very fun. Where can people learn more about each of you and your work? Well, I would like to suggest people also could look at the XX network. You know, we we're live in beta and we've got a lot of good stuff running and it's a look at the white papers. It's it's

really solid stuff. I'm extremely it's best stuff out there by far. I think I'm very extremely enthusiastic about it and we've got a lot of good backing. So, please yeah, have a look at that and but if you're wondering about the historical stuff, look at at chom.com and look at the eCash museum and different other things multi-party computation we didn't get a chance to talk about that's another interesting vector on all this like kind of generalizing the smart contracts and and the ICR and the history of it and if you're interested in all that stuff it's all up there and I guess the one aspect that I would like to also draw your attention to is, you know, this kind of cryptographic technology can also be used in elections and voting and online

voting and so on and that is a very much related to you know, to payments and messaging and I think this is a an area where I'd like to see a lot more uh I think there's a lot of potential there and so I've I've been pushing working on that for for a long time and you can read about some of the stuff up on my side that I've been doing on that. So, we're we're making great strides in that actually. There will be some new work coming up very soon. So, uh yeah, charm.com and xxnetwork xx.network is the URL. Yeah.

All right. And Adam? So, I have a personal webpage on cypherpace.org, c y p h e r s p a c e .org, which has for example, pictures of the t-shirt that you mentioned and various cryptographic libraries and things I've implemented over the years. And on Twitter, I'm Adam 3 US. And Blockstream, which is the company I co-founded uh some years ago now, is uh blockstream.com. I think, you know, we were talking about the um Dwork proof of work and hashcash. So, I think if that's been something that's there's been discussions about various times. And so, one kind of question I've turned my mind to

as well, you know, is there, you know, why are people using hashcash for the proof of work and not other proofs of work, right? So, you know, there's the client puzzles that uh Jules and Brainard produced. There's the original proof of work by uh Dwork and Naor. Oh, I see. So, the mech- the hashcash mechanism itself is the one that's prevailed. Yes. Well, I think there's there's a specific reason in hindsight. So, at the time I did it, it wasn't used for that purpose. It was just used for one one-use stamps.

But, the the result is that you get a compact proof of work cuz it's fixed size. Whereas, the Dwork and Naor's were like broken asymmetric signatures. Those signatures were low key sizes so that you could brute force them and create forgeries and things like that. So, there's there's three variants. Um two of the variants have progress. So, you need like a Poisson process for fairness, like a level playing field in the crypto mining. The third one, which is based on in in Dwork and Naor is based on uh this square roots in large prime fields.

and there's an algorithm in that called Tonelli-Shanks which has some randomness but it's not clear if that's sufficient to have a level playing field because there may be other slightly less optimal square root algorithms that the single lost fast as computer can tend to win and that would be a problem again and then the other side effect is that those systems have they're not as easy to scale in terms of the difficulty so with hash cash they the the stamp was you know computer a million tries so you know uh uh 20 binary digits of zero at the front but these days it's enormous right it's 70 80 leading zeros and so if you scale some of those

kind of broken signature based schemes you end up having to increase the prime size of the feature mirror transform size and you get an enormous uh proof so the proof of work might itself be bigger than the block transactions you're trying to prove about plus the fact that they're not Poisson is like a stumbling block if you saw what I mean so anyway this sort of like in hindsight so it's good curious like a curiosity right so well you know given that there were these parallel different variants and and the the other one by Jules and Brainard is actually interactive so it's not you know it's a proof with respect to a server so that's not amenable to uh you know independent verification let's say to the audit function so

I'm really glad we had a chance to speak about it thanks that's so interesting yeah and so you I'm I'm now I'm glad to hear that the approach you took is really really uh it's turns out to be the superior one and congratulations on that that's excellent I'm going to mention that going forward I I was unclear I was looking forward to this chance to you know we've met before but I never I wanted to ask you about this because I thought it was going to come up Yeah yeah I mean it's um I think it's also you know very simple so simple things win. So, when I was designing it, I was thinking about, you know, should I introduce floating point to make it harder to make an ASIC. You know, it's already I was thinking about spammers are very determined economically.

They'll make ASICs. So, should I make it complicated? Should I involve memory? I looked at I looked at I was like, you know what? I think simple is better. So, so I like kept it to, you know, a standard SHA-1 function at the time. So, you'd be able to verify it even with a shell script using a SHA-1 function, right? So, anyway, simple wins and it and it happened to have the Poisson function, which I was actually determinedly trying to eradicate cuz it was a nuisance for spam purposes, but turned out to be an advantage for distributed fairness or something like that.

All right. Well, you know, I'm not going to even try to pretend to translate all that for my listeners, but hopefully the more technical ones will have understood and at least now we have an understanding of why your proof of work was perhaps more widely used than the original version. Um okay. Well, this has been so fun chatting with you both. Thank you both so much for coming on Unchained. Thank you, Laura. This was great. I really enjoyed it. Thank you again. Thanks so much for joining us today. To learn more about the history of digital currency and David and Adam, as well as their various inventions, check out the show notes for this episode. Don't forget, you can now watch video recordings of the shows on the Unchained

YouTube channel. Go to youtube.com/c/unchainedpodcast and subscribe today. Unchained is produced by me, Laura Shin, with help from Anthony Yoon, Daniel Nuss and the team at CLK Transcription. Thanks for listening.