From: hnash@mason1.gmu.edu
Date: Tue, 24 Aug 93 13:25:30 PDT
To: cypherpunks@toad.com
Subject: Digital Gold
Message-ID: <9308242023.AA12227@mason1.gmu.edu>
MIME-Version: 1.0
Content-Type: text/plain


-----BEGIN PGP SIGNED MESSAGE-----


I tried to imagine a digital currency which is not backed by 
any bank, but just exists by mathematics and convention, like 
gold.  The result is the following currency system which 
could be called digital gold.  It involves three conventions, 
(1) a convention for valuing coins, (2) a convention for 
claiming coins, (3) a convention for transfering coins.  

I believe the resulting currency is unforgeable, 
uninflatable, and untraceable.  Let me know where I've gone 
wrong (gently).


Digital Gold
 -----------

Let's associate one digital gold coin with each positive 
integer.  Let's agree that the coin for each integer N is 
worth half as much as the coin for integer N/2.  

integers:   are each worth:
 --------   ----------- 
1 - 1       1    ounce  
2 - 3       1/2  ounce 
4 - 7       1/4  ounce 
8 - 15      1/8  ounce 
16 - 31     1/16 ounce  

The total amount of digital gold is infinite.  However, the 
amount in circulation will always be finite because the 
lowest denomination coins aren't worth claiming or to 
spending.  (Claiming and spending of coins will be described 
shortly.  For the time being, let's just assume that each 
requires a certain amount of computation.)  

For example, if it costs 1/10 ounce of digital gold to spend 
a digital coin, then 1/16 ounce coins will not circulate.  
The total amount of digital gold in circulation will then be 
4 ounces.  

The supply of digital gold is similar to the supply of real 
gold.  As the value of real gold increases (relative to the 
cost of mining), more real gold can be mined profitably.  

If the demand for digital gold doubles, its value will 
roughly double, and a lower denomination can then circulate.  
Similarly, if the cost of computation halves, a lower 
denomination of coins can circulate.  In either case, the 
number of coins doubles, but the supply of digital gold 
increases only slightly.  

Each denomination represents an equal fraction of the digital 
gold in circulation.  Therefore, as new denominations come 
into circulation, the supply of digital gold remains 
relatively stable.  However, the number of coins increases in 
proportion to the demand for digital gold, and to the supply 
of computation.  This seems appropriate.  

Also, only a small fraction of the digital gold is in the 
smallest denominations.  This is important since the smallest 
denominations are always inefficient to spend.  


Claiming Digital Gold
 --------------------

Let's agree, by convention, that the first person to sign a 
particular integer, owns the digital gold corresponding to 
that integer.  This is the law of initial acquisition of 
digital gold.  

In order to claim a digital gold coin, the claimer must 
publicize a "claim certificate", containing the signed 
integer and the public key required to recognize the 
signature.  The first person to publicize a claim certificate 
will be recognized as the owner.  

A claimer can use a new alias for each new claim.  In this 
way, he can claim coins without revealing his identity.  


Spending Digital Gold
 --------------------

In order to spend a coin, the payor signs a claim certificate 
from the payee.  This voids the payor's ownership of the 
coin, and validates the payee's ownership.  The payor uses 
his old alias to sign the payee's claim, so that he does not 
identify himself.  The payee can generate a new alias for 
each new claim certificate, so he can accept coins without 
identifying himself.  

The law of property transfer for digital gold is the same as 
the law of property acquisition.  The first person to 
publicize a new claim certificate signed by the previous 
rightful owner, rightfully owns the coin.  

The payee should have the claim confirmed (signed) by some of 
the agencies where he might like to spend the coin.  A 
confirmation indicates that the agency is willing to accept 
the coin from the new alias.  Before confirming a claim, an 
agency should establish that the payer owned the coin at one 
time, and that he has not yet granted it to anyone but the 
payee.  If the claim is good, the agencies should take note 
of the new owner.  If the claim is bad, the payee can 
confront the payer.  

Agencies can do enough research to avoid confirming most bad 
claims.  For each coin, there exists a chain of claim 
certificates extending all the way back the the original 
owner of the coin.  The backward chain proves that each alias 
has owned the coin at one time.  The forward chain proves 
that each alias no longer owns the coin.  Agencies can also 
sign claims with timestamps, in order to settle disputes over 
coins claimed by multiple owners.  

The result is ownership by consensus.  If the agencies I wish 
to do business with agree that my alias owns a particular 
coin, then I own a certain amount of digital gold.  


 ------- Yours Truly, ][adon Nash ---------------------
in founding a family or a state, or acquiring fame even, 
we are mortal; but in dealing with truth we are immortal, 
and need fear no change nor accident. 
 --------------------------- ][enry David Thoreau -----


-----BEGIN PGP SIGNATURE-----
Version: 2.3

iQCVAgUBLHo/dTIwr9YMSTuBAQE2yAQAqOXczfGi0SffaNoPj294bQQSoSTMkiTU
Ko62ELCoshD729+2Qin5NqS+eFcW5zL+o/KZU4c1OZYa5Bt5PqlZIq29kjuNiNSr
Z/E6++HyaLO0S4ivjUhWRqOorT5b8WwL+a37zk2cNEdXG8sfsyS6Hn+xhHHhUmgD
2E4dGeMeftY=
=HWaS
-----END PGP SIGNATURE-----