Friday, September 30, 2016

In praise of anonymous money

A while back I was paying for gas at a nearby gas station when the clerk fumbled my credit card. When he bent down to pick it up he momentarily disappeared behind the counter. Because credit card transactions are always such repetitive affairs, this slight break from routine raised my hackles. Might the clerk have done something with my card while out of sight, perhaps taken a quick photo of it?

Credit and debit payments require the relay of personal information. But this information-richness is also their weakness, since valuable data can be "skimmed" and used to attack the payer later on. That's why an anonymous payments medium is so important; it provides buyers with a shield from everyone else involved in a transaction. The next time I payed for gas at the nearby station, I bought myself some peace of mind by handing the clerk a few $20 notes instead.

Like banknotes, bitcoin is a (near) anonymous payments medium. My gas station doesn't accept bitcoin, however, nor would I be able to pay for a tank of gas with bitcoin since I'm wary of holding more than a few dollars of the volatile stuff. There is no inherent reason that an anonymous digital money must be volatile. David Chaum's eCash, first proposed in the 1990s, was a monetary product that, unlike bitcoin, offered stability while still allowing for anonymity.

Here's a broad-brush description of how eCash worked. A customer would kick the process off by creating $x worth of digital coins, each with a unique serial number. The bank would in turn sign the coins and debit the customer's bank account for that amount. Thanks to Chaum's invention of blind signatures, the bank would not be able to see the serial numbers of the coins it had signed, and thus could not match those coins to a specific person. This 'blinding' provided a measure of anonymity.

What about the double spending problem that bedevils digital cash? Because digital coins can be copied ad infinitum, a mechanism must be introduced to prevent a dishonest actor from buying up the entire world. Chaum solved this by having the bank rig up a database of already-spent coins. When the customer spent $x at a merchant, the merchant would call up the bank and provide it with each coin's unique serial number. The bank would check the number against its database to ensure that the coins had not been spent. If they hadn't, the transaction was free to proceed. The merchant in turn had to return the $x to the bank to be redeemed.

Bitcoin's creator(s) Satoshi Nakamoto doesn't seem to have been a fan of Chaum's eCash. In his famous white paper, Nakamoto says (not referring to eCash in particular) that the "problem with this solution is that the fate of the entire money system depends on the company running the mint, with every transaction having to go through them, just like a bank." Later on in a forum post Nakamoto talks about the "old Chaumian central mint stuff," noting that:
a lot of people automatically dismiss e-currency as a lost cause because of all the companies that failed since the 1990s. I hope it's obvious that it was only the centrally controlled nature of those systems that doomed them. I think this is the first time we're trying a decentralized, non-trust-based system.
Nakamoto thus designed Bitcoin so that it had no central points of control. There is no third party database to record serial numbers; instead, the task of validating transactions is outsourced to a distributed network of anonymous miners and nodes. As for the money supply, there is no "Chaumian central mint" that issues and redeems tokens; rather, the evolution of bitcoin supply is set ahead of time by the Bitcoin protocol.

By sacrificing this last central point of control, Nakamoto condemned bitcoin to being a permanently volatile instrument. Unlike eCash, which is stable because the issuing bank pegs its price to that of bank deposits at a 1:1 rate, bitcoin's purchasing power is left entirely to the whims of market demand. Should market demand suddenly rise, bitcoin can double in price. Should it collapse, bitcoin will be worth $0.  

Sacrificing the Chaumian issuer/redeemer leads to another, more nuanced, trade-off. Because bitcoin is not pegged to the dollar, retail prices will always be expressed in dollars with the bitcoin equivalent bobbing up and down every few seconds or so. Put differently, bitcoin users must get accustomed to the unit of account and medium of exchange being divorced from each other.

Contrast this to eCash. Thanks to the peg, the two functions of money—unit of account and medium of exchange—are married. Anyone who owns eCash can relax knowing that they possess the same exact unit that all other economic actors are using to express prices. This provides eCash users with a degree of certainty. As a service to their customers, retailers tend to keep prices sticky in terms of the unit of account for days, even months. So if carrots are going for $2 today, an eCash owner knows that they'll be going for that same amount next week. This fixity makes planning one's life a much easier affair. Those who own bitcoins enjoy no such certainty. Carrots that cost 0.005 bitcoins today may cost 0.01 next week.

So these two monetary products provide users with a degree of anonymity while asking them to make very different sacrifices. Bitcoin foregoes both stability and the convenient marriage of unit of account and medium of exchange. Chaum's eCash retains both stability and a marriage but introduces several central points of control that might render it subject to attack. Pick your poison. My gut feeling, however, is that over the long term, the public will prefer to stomach some degree of centralization in return for a stable anonymity product that doesn't suffer from medium of exchange/unit of account divergence. But I could be wrong.


  1. JP, what do you think of current projects to square the anonymity-stability-decentralization triangle? The websites and technical papers of the zcash anonymity protocol and the Maker dai stablecoin are surprisingly readable.

    There's a fascinating discussion of four different approaches to pegging synthetic commodities to the value of real ones on this Ether Review episode with Dominic Williams. Curious if you think any of the four will work. It's a tough nut to crack.

    1. Hi Jason, thanks for the link, great podcast.

      Of the four approaches, I've written about the second one here, specifically bitUSD, which seems very close to Maker dai:

      I'll have to read more about the third option, didn't quite understand what the interviewee was saying.

      I think that anonymity + stability + decentralization is certainly the holy grail. The biggest challenge that Maker dai and bitUSD face is that the underlying collateral is a highly volatile cryptocoin, and this makes for bad backing. One hopes that more stable assets can eventually be used as collateral. The interviewee touches on this problem in the podcast.

      One advantage of eCash over Maker dai is that the former can be a full reserve currency, and thus 100% safe. For each $1 in eCash, the bank holds $1 in banknotes. Maker dai can recruit as much collateral as it wants to back its stablecoin, but that collateral can never be actual U.S. banknotes.

  2. Would it be possible to have a currency that was both decentralized and fixed in value ?

    I think the the bitcoin algorithm simply pegs the number of new bitcoins that can be mined every year and then it exchange varies with changes in demand to hold it. But in theory couldn't you have a currency identical to bitcoin except its value was fixed to a bundle of goods, or another currency? When the demand to hold it increased the algorithm could make mining less costly and get the supply to increase. When the demand to hold falls then it would be harder - but decreasing the supply by imposing a transaction "tax" would probably work, with the tax being a surplus over the agreed sales price paid by the buyer, which is just destroyed to decrease the quantity in circulation.

    1. Hi Rob,

      "Would it be possible to have a currency that was both decentralized and fixed in value ?

      That's the holy grail, as I said in response to Jason. Maybe something like Maker Dai or bitUSD can get there.

      I believe Ferdinando Ametrano implemented a version of what you describe, assuming I have understood you properly.

      Nubits implements "parking," or a higher interest rate in order to counteract falling demand.

      I am wary of solutions that don't try to utilize some sort of backing. If the demand for a stablecoin suddenly disappears, a backed stablecoin will retain its peg. However, in the scheme you suggest, if the demand falls to 0, there is nothing that can be done to prevent the price from also falling to 0.

    2. Thanks for the link to that paper, which is excellent - the author suggest that the electronic currency could be pegged to whatever external variable required just by varying the quantity of electronic currency units held in people's wallets. This is a way simpler and better idea than my suggestion, once you get your head around the idea of the number of units you hold in your wallet varying day-by-day.

      I agree that with no actual backing an electronic currency would rely on transactional demand for it to maintain any value. If demand to hold it fell then the algorithm would reduce the number of units in circulation. But beyond a certain point if people really didn't want to hold it nothing could prevent its value falling to value no matter what its algorithm did.

  3. It's unsporting to send little infant Bitcoin up against the reigning heavyweight champion of the world, and arguably the heaviest heavyweight in all of history, the U.S. Dollar.

    How about we start with Bitcoin vs. the Venezuelan bolívar? How does your price-stability metric look in that comparison?

    (I worked on DigiCash Ecash and I'm the founder of .)

    1. Hi Zooko,

      "How about we start with Bitcoin vs. the Venezuelan bolívar? How does your price-stability metric look in that comparison?"

      Yes, bitcoin certainly comes out looking better against the bolívar. However, the competition for Venezuelan unit of account is being waged between the bolívar and the US dollar, with Bitcoin only a long shot. I admit that it's unsporting to send Bitcoin up against the reigning heavyweight, but it can't be helped; the U.S. dollar is the world's back-up medium of exchange and unit of account.

      "(I worked on DigiCash Ecash and I'm the founder of .)"

      Yes, I've been following your work with Zcash and was also aware of your involvement with DigiCash. I hope my explanation of Ecash wasn't too far off!

  4. Mervyn King proposed the divorce of payments from credit in his 2010 Bagehot speech. In light of Fishers 100% money trend reflected in Marc Carney's "broad money" implementations of late, the so-called "convenient marriage" is taking up separate residences and that debt "money creation In the modern economy" mint will likely be broken up into so-called mintettes of equity coin in the greatest debt-for-equity swap ever witnessed. The discomfort of monetary system divorce may be tolerable if the citizen's dividend is sufficiently large... albeit volatile.

    1. Hi Dave,

      The divorce you're talking about--the separation of the granting of credit from the provision of a payments medium--is a different divorce than the one I'm talking about. I'm talking about the medium of exchange no longer being the unit in which prices are expressed in contracts and by retailers.