{"id":22222,"date":"2018-04-24T19:21:36","date_gmt":"2018-04-24T19:21:36","guid":{"rendered":"http:\/\/ci027cfe7870052697"},"modified":"2025-01-28T17:09:02","modified_gmt":"2025-01-28T17:09:02","slug":"genesis-files-how-david-chaums-ecash-spawned-cypherpunk-dream","status":"publish","type":"post","link":"https:\/\/bitcoinmagazine.com\/culture\/genesis-files-how-david-chaums-ecash-spawned-cypherpunk-dream","title":{"rendered":"The Genesis Files: How David Chaum\u2019s eCash Spawned a Cypherpunk Dream"},"content":{"rendered":"
<\/div>
<\/figure>\n

\u201cYou can pay for access to a database, buy software or a newsletter by email, play a computer game over the net, receive $5 owed you by a friend, or just order a pizza. The possibilities are truly unlimited.\u201d<\/p>\n

This quote is not from a 2011 Bitcoin introduction video. In fact, the quote is not about Bitcoin at all. It is not even from this millennium. The quote<\/a> is from cryptographer Dr. David Chaum, speaking at the first ever CERN conference<\/a> in Geneva in 1994. What he\u2019s talking about is eCash.<\/p>\n

If the cypherpunk movement has a forefather, the bearded, ponytailed Chaum is it. To say that the cryptographer \u2014 now 62 or 63 years old (he won\u2019t reveal his exact age) \u2014 was ahead of the curve is an understatement. Before most people had heard of the internet, before most homes had personal computers, before Edward Snowden, Jacob Appelbaum or Pavel Durov were even born, Chaum concerned himself with the future of online privacy.<\/p>\n

\u201cYou have to let your readers know how important this is,\u201d Chaum once told<\/a> a Wired<\/em> journalist. \u201cCyberspace doesn’t have all the physical constraints. [\u2026] There are no walls \u2026 it’s a different, scary, weird place, and with identification it’s a panopticon nightmare. Right? Everything you do could be known to anyone else, could be recorded forever. It’s antithetical to the basic principle underlying the mechanisms of democracy.\u201d<\/p>\n

Chaum, who started his career as a computer science professor at Berkeley University, was not just a digital privacy advocate. He designed the tools to realize it. First published in 1981, Chaum\u2019s paper \u201cUntraceable Electronic Mail, Return Addresses, and Digital Pseudonyms<\/a>\u201d laid the groundwork for research into encrypted communication over the internet, which would eventually lead to privacy-preserving technologies like Tor.<\/p>\n

But privacy of regular communication was not at the top of Chaum\u2019s priority list. He arguably had an even bigger idea. The Berkeley professor wanted to design a privacy-preserving digital money.<\/p>\n

\u201cThe choice between keeping information in the hands of individuals or of organizations is being made each time any government or business decides to automate another set of transactions,\u201d Chaum would explain in the Scientific American<\/a> in 1992. \u201cThe shape of society in the next century may depend on which approach predominates.\u201d<\/p>\n

Ten years prior, by 1982, Chaum had already solved the puzzle, which he had published in his second major paper: \u201cBlind signatures for untraceable payments<\/a>.\u201d At a point in time when today\u2019s Bitcoin veterans like Dr. Pieter Wuille, Erik Voorhees or Peter Todd had yet to take their first breath, the cryptographer had designed a solution to realize an anonymous payment system for the internet.<\/p>\n

Blind Signatures<\/h2>\n

At the heart of Chaum\u2019s digital money system lies his innovation of \u201cblind signatures.\u201d<\/p>\n

To understand blind signatures, it\u2019s important to first remember how public key cryptography works and, in particular, what (regular) cryptographic signatures are.<\/p>\n

Public key cryptography uses key pairs. Such a pair consists of a public key, which is a seemingly random string of numbers that is mathematically derived from the other, truly random string of numbers: the private key. With the private key, it\u2019s trivial to generate the public key. But with only the public key, it\u2019s practically impossible to generate the private key: it\u2019s a one way street.<\/p>\n

Public key cryptography can be used to establish private communication between two people \u2014 in academic circles usually referred to as \u201cAlice\u201d and \u201cBob\u201d \u2014 who only share their public keys with one another. Their private keys remain private.<\/p>\n

But private communication is not all Alice and Bob can do. Alice can also cryptographically \u201csign\u201d any piece of data (and so can Bob). To do so, Alice must mathematically combine her private key with this data. The result will be another seemingly random string of numbers known as the \u201csignature.\u201d Once again, it\u2019s impossible to recreate Alice’s private key from the signature (with or without the piece of data). It\u2019s all still a one-way street.<\/p>\n

The interesting thing about this signature is that Bob (or anyone else) can check it against Alice\u2019s public key. This tells Bob that it was indeed Alice that created the signature with her private key (and the added piece of data). This can, in turn, mean whatever Alice and Bob want. For example, it can mean that Alice agrees with the content of the data (just like a handwritten signature).<\/p>\n

A blind signature then takes all this one step further. This time, Bob first generates a random number, called a \u201cnonce,\u201d and mathematically combines this with the piece of data. This \u201cscrambles\u201d the piece of data to make it seem like yet another random string of numbers. Bob can then give the scrambled data to Alice for her to sign. Alice cannot tell what the original data looks like, so she is \u201cblind signing\u201d it. The result is a \u201cblind signature.\u201d<\/p>\n

Now, the interesting thing about this blind signature is that it\u2019s not just linked to Alice\u2019s keys (like any signature would be) and the scrambled data. The same blind signature is also linked to the original, unscrambled data. Using only Alice\u2019s public key, anyone can check that Alice signed a scrambled version of the original data \u2014 including, of course, Alice herself, if she does get to see the original data later on.<\/p>\n

eCash<\/h2>\n

This blind signature scheme is the trick that Chaum used to create a digital money system.<\/p>\n

To realize this, Alice from the above example would actually be a bank: Alice Bank. This is a regular bank, like banks exist today, where customers have bank accounts with (in this example) U.S. dollar deposits.<\/p>\n

Let\u2019s say Alice Bank has four customers: Bob, Carol, Dan and Erin. And let\u2019s say that Bob wants to buy something from Carol.<\/p>\n

First, Bob requests a \u201cwithdrawal\u201d from Alice Bank. (Ideally, he had already made this withdrawal earlier \u2014 but never mind that for now.) To make this withdrawal, Bob actually creates \u201cdigital banknotes\u201d himself, in the form of unique numbers: \u201cserial numbers.\u201d On top of that, he scrambles these banknotes, as shown above. These scrambled banknotes are sent to Alice Bank.<\/p>\n

Having received the scrambled banknotes from Bob, Alice Bank then blind signs each scrambled banknote and sends them back to Bob. For each signed, scrambled banknote that she sends back, Alice Bank subtracts one dollar from Bob\u2019s bank account.<\/p>\n

Now, because Alice Bank blind signed the scrambled banknotes, her signature is also linked to the original, unscrambled banknotes. So, Bob can now use the original, unscrambled banknotes to pay Carol by simply sending them to her.<\/p>\n

As Carol receives the banknotes, she should forward them to Alice Bank. Alice Bank then checks that she indeed blind signed each of the banknotes, which her blind signatures allow her to do: they are linked to her own keys. Alice Bank also checks that the same banknotes (serial numbers) haven\u2019t already been deposited by someone else in order to ensure that they haven\u2019t been double-spent.<\/p>\n

As the banknotes check out, Alice Bank adds the equivalent number of dollars to Carol\u2019s bank balance, and lets Carol know. Upon this confirmation, Carol knows she\u2019s been paid valid banknotes by Bob and can safely send him whatever he was buying from her.<\/p>\n

<\/figure>\n

Of key importance, Alice Bank will see the unscrambled banknotes for the first time only when Carol deposits them! As such, Alice Bank has no way of knowing that the banknotes were Bob\u2019s. They could just as well have come from Dan or Erin.<\/p>\n

As such, Chaum\u2019s solution offers privacy in payments. This was not new in itself, of course: private payments were the norm in those days. But it was new in digital form. Hence, Chaum\u2019s analogy: cash. Electronic cash. eCash.<\/p>\n

DigiCash<\/h2>\n

By 1990, a little under 10 years after finishing his first papers (younger cryptocurrency developers like Matt Corallo, Vitalik Buterin and Olaoluwa Osuntokun still hadn\u2019t been born), David Chaum founded DigiCash<\/a>. The company was based in Amsterdam, where Chaum had been living for a couple of years, and specialized in \u2014 indeed \u2014 digital money and payment systems. These included a government project to replace toll booths (which was eventually cancelled) and smart cards (akin to what we call hardware wallets today). But DigiCash\u2019s flagship project was its digital cash system, eCash. (The system was called eCash, while the money in the system was dubbed \u201cCyberBucks,\u201d comparable to using capital-letter Bitcoin for the protocol and lower case bitcoin for the currency.)<\/p>\n

<\/figure>\n

At a time that Netscape and Yahoo! were leading the tech industry to new heights, and where some thought micropayments, not advertisements, would be the revenue model for the web, DigiCash was considered a rising star by tech entrepreneurs of the day. Of course, Chaum and his team had much faith in their technology as well.<\/p>\n

\u201cAs payments on the network mature, you\u2019re going to be paying for all kinds of small things, more payments than one makes today,\u201d Chaum told the New York Times<\/a> in 1994, of course, emphasizing the importance of privacy in such a world. \u201cEvery article you read, every question you have, you\u2019re going to have to pay for it.\u201d<\/p>\n

That year, after four years of development, the first successful payments were tested<\/a>, and later that same year eCash trials began<\/a>: Banks could acquire a license from DigiCash to use the technology.<\/p>\n

Interest was significant. By late 1995, eCash was licensed<\/a> to its first bank: the Mark Twain Bank in St. Louis. Moreover, by early 1996, one of the biggest banks in the entire world got on board<\/a>: Deutsche Bank. Credit Suisse<\/a>, a second major player joined later, and several other banks across different countries \u2014 including the Australian Advance Bank<\/a>, Norway\u2019s Norske Bank<\/a> and Bank Austria<\/a> \u2014 would follow suit.<\/p>\n

Yet, what\u2019s perhaps more interesting than the deals DigiCash struck are the deals it did not. Two of the three major Dutch banks \u2014 ING and ABN Amro \u2014 are said to have<\/a> made DigiCash partnership deals worth tens of millions of dollars. Similarly, Visa reportedly offered a $40 million investment, while Netscape had interest as well: eCash could have been included in the most popular web browser of that era.<\/p>\n

Still, the biggest offer of all probably came from none other than Microsoft. Bill Gates wanted to integrate eCash into Windows 95 and is said to have offered DigiCash some $100 million to do so. Chaum, so the story goes, asked for two dollars for each version of Windows 95 sold. The deal was off.<\/p>\n

While a rising star in the minds of technologists of the day, DigiCash seemed to have trouble making a financial deal that would help it to realize its full potential.<\/p>\n

By 1996, DigiCash employees had seen one failed deal too many and wanted a change in policy. This change came in the form of a new CEO<\/a>: Visa veteran Michael Nash. The startup also got a fund injection, while MIT Media Lab founder Nicholas Negroponte was made chairman of the board. (Through its Digital Currency Initiative, the MIT Media Lab employs several Bitcoin Core contributors today.) The DigiCash headquarters were moved from Amsterdam to Silicon Valley. Chaum remained part of DigiCash, but now as CTO.<\/p>\n

It wouldn\u2019t make much difference. After several years of trials, eCash wasn\u2019t catching on with the general public. The banks that got on board were experimenting but did not really push the technology; by 1998, Mark Twain Bank had only enrolled 300 merchants and 5,000 users. While a final deal with Citibank came close \u2014 it could have given the project a good push \u2014 this bank ended up walking out for unrelated reasons.<\/p>\n

\u201cIt was hard to get enough merchants to accept it, so that you could get enough consumers to use it, or vice versa,\u201d Chaum told Forbes<\/a> in 1999, after DigiCash had finally filed for bankruptcy. \u201cAs the Web grew, the average level of sophistication of users dropped. It was hard to explain the importance of privacy to them.\u201d<\/p>\n

The Spawning of a Cypherpunk Dream<\/h2>\n

DigiCash failed, and eCash failed with it. But even though the technology did not succeed as a business, Chaum\u2019s work would inspire<\/a> a group of cryptographers, hackers and activists, connected through a mailing list. It was this group \u2014 which included DigiCash contributors like Nick Szabo and Zooko Wilcox-O\u2019Hearn \u2014 that would come to be known as the cypherpunks.<\/p>\n

Perhaps a bit more radical than Chaum himself ever was<\/a>, the cypherpunks kept the dream of an electronic cash alive, proposing alternative digital currency systems throughout the 1990s and early 2000s. In 2008, about 10 years after DigiCash\u2019s demise, Satoshi Nakamoto sent his proposal for an electronic cash to the de-facto successor of the then-defunct cypherpunk mailing list: Bitcoin.<\/p>\n

Bitcoin and eCash have little in common from a design perspective. Crucially, eCash was centralized around DigiCash and could not really be its own currency. Even if every single person in the world would only use eCash for all their transactions, banks would still be necessary to offer account balances and confirm transactions. This also means that eCash \u2014 while providing privacy \u2014 was not as censorship resistant. Where Bitcoin was able to keep WikiLeaks funded even through a banking blockade, for example, eCash could not have done the same thing; banks could still have blocked WikiLeaks\u2019 accounts.<\/p>\n

Still, Chaum\u2019s work on digital currency, dating back to the early 1980s, remains relevant. While Bitcoin itself does not employ blind signatures, scaling and privacy layers on top of the Bitcoin protocol could. Bitcointalk<\/a> forum and r\/bitcoin<\/a> subreddit moderator Theymos, for example, has been a champion of an eCash-like scaling sidechain for Bitcoin<\/a> for some time. Adam Fiscor, a leader<\/a> in the domain of Bitcoin transaction privacy today, is realizing<\/a> coin-mixing services utilizing blind signatures, as once proposed<\/a> by Bitcoin Core contributor Greg Maxwell. And yet-to-be-announced Lightning Network technology could utilize blind signatures to improve security.<\/p>\n

And Chaum himself? He returned to Berkeley, where he is responsible for a long list<\/a> of publications, many in the field of digital elections and reputation systems. Perhaps, some 20 years from now, an entirely new generation of developers, entrepreneurs and activists will look back at these as the groundwork for a technology that is about to change the world.<\/p>\n

This article is partly based on two articles published in the 1990s: \u201c<\/em>E-Money (That\u2019s What I Want)<\/em><\/a>\u201d by Steven Levy for Wired, and \u201c<\/em>Hoe DigiCash alles verknalde<\/em><\/a>\u201d (Translated: \u201c<\/em>How DigiCash Blew Everything<\/em><\/a>\u201d) by an unknown author for Next! Magazine. There is also a wealth of information on<\/em> chaum.com\/ecash<\/em><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Bitcoin and other cryptocurrencies can trace their roots to this earlier, privacy-focussed payment system for the internet.<\/p>\n","protected":false},"author":2509,"featured_media":22225,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[1560,2095,174,889],"class_list":["post-22222","post","type-post","status-publish","format-standard","has-post-thumbnail","category-culture","tag-cypherpunks","tag-david-chaum","tag-ecash","tag-genesis"],"author_data":{"id":2509,"name":"Aaron van Wirdum","nicename":"aaron-van-wirdum","avatar_url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2024\/12\/aaron-van-wirdum-96x96.jpg"},"featured_image_url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2024\/11\/the-genesis-files-how-david-chaums-ecash-spawned-a-cypherpunk-dream.jpg","_links":{"self":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/22222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/users\/2509"}],"replies":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/comments?post=22222"}],"version-history":[{"count":0,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/22222\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/media\/22225"}],"wp:attachment":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/media?parent=22222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/categories?post=22222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/tags?post=22222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}