The cypherpunks: the mailing list and the ideas that came before Bitcoin

A mailing list, a manifesto and the line “Cypherpunks write code”

The cypherpunks were programmers, cryptographers and privacy activists who organized around an email list in the early 1990s. The group’s founding meeting was held in September 1992; we know that because the archived copy of Tim May’s manifesto notes it was read aloud there. What held them together was a conviction: privacy in a networked world would have to be built out of mathematics, by volunteers.

Eric Hughes put that conviction into words on 9 March 1993 in “A Cypherpunk’s Manifesto.” It opens with a distinction: “Privacy is necessary for an open society in the electronic age. Privacy is not secrecy.” Privacy, he argued, is the power to choose what you reveal about yourself, and that power needs tools. He named three: anonymous mail forwarding, digital signatures, and electronic money.

Money is where the manifesto gets specific. “Privacy in an open society requires anonymous transaction systems,” Hughes wrote, and “until now, cash has been the primary such system.” Then comes the line the movement is remembered for: “Cypherpunks write code.” Someone has to write the software that defends privacy, and since nobody gets privacy unless everyone can, they would write it.

Tim May imagined markets nobody could police, and money was the missing piece

Timothy C. May’s “Crypto Anarchist Manifesto” is older than the group. According to the notes on its archived copy, he wrote it in mid-1988, handed it out at conferences that year, read it at the cypherpunks’ founding meeting in September 1992, and posted it online on 22 November 1992. It opens with a deliberate echo of Marx: “A specter is haunting the modern world, the specter of crypto anarchy.”

May’s claim was that cryptography would let people deal with each other without revealing who they were. “Two persons may exchange messages, conduct business, and negotiate electronic contracts without ever knowing the True Name, or legal identity, of the other.” He did not pretend it was all upside: the same document says an anonymous computerized market could make possible “abhorrent markets for assassinations and extortion.”

Notice what the vision needs. If you are going to do business with someone whose legal name you will never learn, you need a way to pay them that does not run through a bank that knows you both. The proposals discussed below explore different parts of that problem; this comparison is a technical lineage, not proof that every author shared one motive.

David Chaum showed how to make digital cash untraceable, and then built it

An influential answer came before the cypherpunks group existed. David Chaum published “Blind Signatures for Untraceable Payments” in 1982. If a third party sees the payee, amount and time of every payment you make, he wrote, it can learn “a great deal about the individual’s whereabouts, associations and lifestyle.” But cash, the anonymous alternative, “suffers from lack of controls and security.” He wanted a system where nobody could see whom you paid, yet you could still prove that you had paid.

His trick was the blind signature, and he explained it with carbon paper. Put a slip inside an envelope lined with carbon paper, have an official sign the outside, and the signature transfers to the slip without the official ever seeing what is written on it. A bank could sign a digital coin the same way: it certifies that the coin is real without being able to recognize it later when it is spent. The result is a bank-issued token that the bank itself cannot trace.

Chaum did not leave it on paper. His company, DigiCash, recorded what his own timeline calls the “world’s first electronic cash payment over computer networks” on 27 May 1994, partnered with Mark Twain Bank of St. Louis in 1995, and later worked with Deutsche Bank and Credit Suisse. The catch was structural. A blind signature still needs a signer, so Chaum’s cash was private but issued by an institution. Bitcoin’s announcement, fourteen years later, would list “no mint or other trusted parties” as a design goal.

Adam Back made computers pay for email; Wei Dai imagined money made of work

In May 1997, Adam Back proposed Hashcash as a way to throttle abuse of “un-metered internet resources such as email, and anonymous remailers.” A sender’s computer must solve a small puzzle before a message is accepted, one that takes real effort to solve but a fraction of a second to check. Back’s 2002 paper calls the puzzle a “cost-function” that must be “efficiently verifiable, but parameterisably expensive to compute,” and describes its output as “a token which can be used as a proof-of-work.” Satoshi’s 2008 announcement would say new coins are made with Hashcash-style proof of work.

Wei Dai’s “b-money,” circulated in November 1998, brought the pieces together on paper. It opens by declaring, “I am fascinated by Tim May’s crypto-anarchy,” and describes a community whose members “cannot be linked to their true names or physical locations.” Such a community needs money, so Dai proposed a currency in which “anyone can create money by broadcasting the solution to a previously unsolved computational problem.” Every participant would keep a record of how much belonged to each pseudonym, and payments would be broadcast to everyone.

Dai was candid about the problems. His first protocol, he wrote, “is impractical, because it makes heavy use of a synchronous and unjammable anonymous broadcast channel,” and his second handed the record-keeping to a set of servers. He closed by hoping the idea was “a step toward making crypto-anarchy a practical as well as theoretical possibility.” Money created by computation, held by pseudonyms, tracked by a shared record: that is most of Bitcoin’s vocabulary, ten years early. What was missing was a way to make thousands of strangers agree on one copy of the record.

Nick Szabo’s bit gold got close, but its pieces were not interchangeable

Nick Szabo’s proposal, “Bit gold,” sits on his blog under a December 2005 address, though the page itself now displays a date of 27 December 2008. It starts from a complaint that “our money currently depends on trust in a third party for its value,” and points to the twentieth century’s inflations as proof that this is “not an ideal state of affairs.” Gold is scarce without anyone’s say-so. Could bits be?

His answer was a chain. Take a public “challenge string,” compute a proof of work from it, have the result timestamped by several independent services, and register it in a distributed registry of titles, a public record of who owns what. The most recent piece of bit gold provides the challenge for the next one, so the pieces link together in order, and anyone can verify a piece and trace its owner through the chain of title.

Szabo saw the flaw himself. Because computers get faster, a piece of bit gold made this year costs less to make than one made last year, so “unlike fungible atoms of gold,” the pieces would trade at different values and dealers would have to bundle them into standard units. Bitcoin’s consensus amounts do not assign different face values according to mining year, although maturity, spending conditions and market treatment can still differ; how the design gets there, and how it picks between competing versions of the ledger, is the technical story told in our origins dossier.

On 31 October 2008, Bitcoin arrived by email, on a list where these people were still talking

At 2:10 in the afternoon, US Eastern time, on 31 October 2008, a message with the subject line “Bitcoin P2P e-cash paper,” from a sender named Satoshi Nakamoto, reached the cryptography mailing list hosted at metzdowd.com. “I’ve been working on a new electronic cash system that’s fully peer-to-peer, with no trusted third party,” it began, followed by a link to a nine-page paper and a short list of properties: double spending prevented by a peer-to-peer network, no mint or other trusted parties, participants who can be anonymous, and new coins made with Hashcash-style proof of work.

Read against the previous fifteen years, that list is a checklist of the cypherpunk problem. Chaum’s privacy goal, without Chaum’s bank. Back’s cost function, put to a new use. Dai’s money-from-work and pseudonymous balances, with a mechanism for agreement. Szabo’s chain of proofs, with interchangeable units. The email did not claim to have invented the pieces; it claimed to have made them work together. Our walk through the white paper follows that argument and the debate it started.

One thing the record does not tell you is who Satoshi Nakamoto was, or whether that person had ever posted to the cypherpunks list. The announcement went to a list of cryptographers and used the vocabulary these people had built. That is a lineage, not an identification, and this site does not treat it as one; see what is actually known about Satoshi. Hughes had written that cypherpunks write code. Fifteen years on, somebody did.

Separate a precursor, an implementation and an identity claim

Compare the proposals by the problem each addresses. Blind signatures concern what an issuer can learn when signing a payment token. Hashcash attaches computational cost to an action. B-money and bit gold consider ways to organize digital value and records. Those are related questions, but the proposals are not interchangeable descriptions of Bitcoin.

A shared idea does not identify a pseudonymous author. Read an original proposal for its mechanism, a release or working system for evidence of implementation, and correspondence for what its author actually said. The fact that Bitcoin draws on this intellectual history does not establish which earlier writer, if any, used the name Satoshi.