Episode 89: B-money and RPOW

Aaron van Wirdum Live from Utrecht, this is Bitcoin,

Sjors Provoost Explained.

Aaron van Wirdum Sjors, are you ready for book shill episode 2 out of 2?

Sjors Provoost Absolutely.

Aaron van Wirdum So today we're going to discuss two more electronic cash proposals that predated Bitcoin that I've also written about in my brilliant... No, I'm not.

Sjors Provoost So should we call these things shitcoins or is that not fair because they are pre-Bitcoin?

Aaron van Wirdum Well, no, they're definitely not shitcoins then, right?

Sjors Provoost Right.

Aaron van Wirdum I don't think that wouldn't qualify as shitcoin.

Sjors Provoost We'll have to ask Giacomo.

Aaron van Wirdum Yes, good idea. So we're going to discuss b-money and RPOW. But first, dear listener, do you always lose your coins? Have you tried everything? Have you tried passwords, firewalls?

Sjors Provoost Brain wallets.

Aaron van Wirdum Have you tried hiding your computer under your mattress? Nothing works well. there's a solution for you. It's called the COLDCARD, produced by Coinkite, which happens to be our sponsor, a hardware wallet, completely offline, where you can store your Bitcoin. Sjors, what's great about the COLDCARD?

Sjors Provoost PSBT.

Aaron van Wirdum There you go.

Sjors Provoost All righty. Thank you, COLDCARD, for sponsoring the show.

Aaron van Wirdum Indeed. So.

Sjors Provoost b-money.

Aaron van Wirdum b-money yes, um, so a little bit of I'll start with a little bit of context right so in the previous episode we discussed uh what was it Hashcash and bit gold right? And then in another episode I don't remember the episode number we did e-cash as well because these are sort of the five main digital cash projects that I detail in my book there's a couple more that are sort of mentioned in passing, but the main sort of ones that are highlighted are eCash Hashcash bit gold and b-money and RPOW. So today we're going to discuss— we're going to do sort of a deep dive, deep dive into b-money and RPOW.

Sjors Provoost Sounds good. What's the name of the book?

Aaron van Wirdum It's called the Genesis Book: The story of the people and projects that inspired Bitcoin. Nice. By Aaron van Wirdum. He just bought it. It's right here on his table.

Sjors Provoost Exactly. He's going to need to sign it.

Aaron van Wirdum So one more sale for this guy. Yes, I'm going to give you some little bit of context on b-money. If you want to know more context on b-money.

Sjors Provoost Yeah, tell me about b-money.

Aaron van Wirdum You can read it.

Sjors Provoost Was it code?

Aaron van Wirdum Okay, let's start here. So b-money was a proposal. It was proposed by Wei Dai shortly after bit gold. So bit gold, we discussed in the previous episode, proposal by Nick Szabo. If you haven't listened to that episode, this would be a good time to maybe pause this episode and go back one. one episode, listen to how b-gold, sorry, bit gold works. b-money was, it was sort of, so Nick Szabo and Wei Dai and a couple of other people, they had this separate mailing list where they were discussing digital cash ideas as well. So there was the Cypherpunks mailing list and then it was also the libtech mailing list. And so it's pretty... Basically, they were discussing these ideas with each other. So bit gold and b-money are fairly similar because of that. They were sort of just discussing how to realize this, so they were coming up with similar designs, essentially. Now, we're not going to repeat how bit gold worked, but b-money... Okay, so here we reach that point again. Who's going to take the lead on...

Sjors Provoost You're going to explain this one.

Aaron van Wirdum I'm going to take the lead on this one. Well, what I will say, one thing about b-money, yeah, you just asked, was there code, I think?

Sjors Provoost Yes.

Aaron van Wirdum So the answer is no. So b-money was actually never implemented. It is mentioned in the Bitcoin white paper, by the way, but it was never actually implemented, like bit gold, which was also never actually implemented.

Sjors Provoost Yeah.

Aaron van Wirdum And I would say b-money, even more than bit gold, there's definitely some... There's significant hand-waving going on with several parts of the design.

Sjors Provoost Right, so we don't exactly know how it works because it wasn't described in a lot of detail and there were a lot of unsolved problems.

Aaron van Wirdum Yeah, it was a rough sketch of a digital cash system. It was an idea, it was almost sort of brainstorming, but it was getting there, but a lot of problems sort of unsolved. So to sort of get to the essence of how it works, it is good to have listened to the bit gold episode because it's similar in several ways, as I mentioned. But the way it works essentially is the coin creation would probably have been similar. That's a safe assumption, even though that's not really fleshed out in the proposal either. But that seems sort of...

Sjors Provoost I thought you mentioned there were two kinds of coin creation mechanisms.

Aaron van Wirdum uh well what I'm referring to is mostly the the the actual proof of work like the proof of work system would have probably been similar.

Sjors Provoost It's just they're just hashing something. Yeah, yeah.

Aaron van Wirdum And it would have probably started with a candidate string in the same way that bit gold did and then you hash on that candidate string. Okay, so b-money it… It's not even really one proposal. It's sort of several proposals wrapped into one. It's like an idea and there's several ways to do it. Now, what I think was the most interesting thing about b-money is how double spending is prevented. Or at least one of the ways. This is getting tricky to explain this because of all the possibilities if you fork the different design options. So if you want to send coins from one public key to another, similar like bit gold or Bitcoin, I guess, if you want to send coins. Now, the problem, of course, is how do you prevent double spending? How do you prevent that one coin is sent to multiple people at once and there's a discrepancy there? Wei Dai's proposal essentially was everyone's going to keep track of the state of the ledger. So again, you know, everyone who's been listening to Bitcoin Explained for a while knows that this is essentially how Bitcoin works.

Sjors Provoost Exactly.

Aaron van Wirdum Everyone's keeping track of who owns what. So this was an idea that b-money introduced, that Wei Dai introduced, which is very relevant to Bitcoin. Now, unfortunately, Wei Dai also concluded pretty quickly that this doesn't actually prevent double spending, of course, because you can still do the double spend and then people will just have...

Sjors Provoost Yeah, they'll have different versions of history. They don't know which is the real one, especially if they got it after the fact, I guess. Because if you're following it live, you can at least say, well, you know, whichever comes first. But even that can split it up if it happens at the same time. But at least if there's like two weeks between it, you could say, well, clearly this one was first and this one was second. But if you're coming online a year later, you have no idea, right?

Aaron van Wirdum Yeah, pretty much. So the only way it could work, Wei Dai mentioned it in this proposal, if you have an unjammable, you know, instant communication network or something like that, which...

Sjors Provoost Magic.

Aaron van Wirdum Yeah, essentially. So that is...

Sjors Provoost Yeah, but I guess, yeah, if everybody knows about it at the exact same time and with no delay, then you can, everybody can see who's first. But it does require everybody not just to store all the transactions, but to be online all the time.

Aaron van Wirdum Right. So I would qualify this, and the way I sort of describe this in my book is I think it was, you can sort of see it as a breakthrough in thinking, like it was a novel approach to do it this way. However, it wasn't actually possible. But then Wei Dai had a second idea, and this actually very much resembles what Nick Szabo proposed for bit gold, which is to have some sort of, you know, server. a group of servers that maintain this registry. So there's sort of two types of participants in the network. One type of participant that's just a user and one type of participant that's keeping track of the state of the ledger. And then regular users would have to inquire by these special servers. And what Wei Dai specifically proposed is you inquire with a number of these servers. And if a great enough number of them all say, yep, this transaction is valid, then you accept the transaction. So say there are 20 of these servers, then Wei Dai may have said, I don't think he mentioned, I'm sure actually he didn't mention specific numbers, but he may have said, check with. two-thirds, and then if two-thirds of them say yes, then it's good. So in that case, it would have been 14, I guess, my example. Yeah. Now, again, this sort of reintroduces the problem that Nick Szabo had, which is who gets to be one of these servers? How do you prevent Sybil attacks? And then Wei Dai, again, came up with sort of his own solution here, which is these servers would have to deposit like stake so they would have to have a certain amount of b-money tokens and then if they would try to cheat then these tokens could be taken from them. By whom exactly? So again it's sort of this hand wavy thing where it's sort of an interesting idea but who's gonna decide that you're that you've been cheating if it's not these servers themselves like how how can you or I don't think Or it's not clear to me if he had an answer for it that he just didn't spell out, or...

Sjors Provoost Or maybe he didn't have an answer for it.

Aaron van Wirdum Yeah, that sort of seems to be the case, as I mentioned in the beginning. The way I'm reading it, it's sort of, here's this idea, here's what I come up with, do with it what you want. And it kind of makes sense in a way as well. This is also something I describe in my book, is that Wei Dai had sort of, actually by the time he published b-money, he'd sort of already given up on the idea of digital cash. He'd become disillusioned with the whole concept, in particular because he thought people don't actually care. So there was this cypherpunk group. I'm not going to get into all of that. But they were building all these privacy technologies. But then... When people start to go online in greater numbers, they were just using, you know, centralized, non-anonymous services and credit cards online to make payments. So this sort of vision of the cypherpunks that they were building privacy tools for the people wasn't really coming through because no one seemed to care. And for that reason, Wei Dai also, he became kind of disillusioned. So from that perspective, it might make sense that he sort of reached this point of, all right, this is what I came up with. I'll just post it in case someone wants to, you know, build on this, but I haven't got all the solutions.

Sjors Provoost Yeah.

Aaron van Wirdum Even the way he posted the proposal, like on the Cypherpunks mailing list anyways, like it's not even an email about the money, the digital cash system itself. It's like an email about an upgrade to PipeNet he was building, which is some other. Anonymity tool. And then there was like this, by the way, I also came up with this b-money thing.

Sjors Provoost But wait, there's more. Yeah.

Aaron van Wirdum Was this a reference? Were you referring to me telling more about b-money?

Sjors Provoost No, I was referring to Steve Jobs here.

Aaron van Wirdum Yeah, okay. There is something else that's interesting to say about b-money, which is that Wei Dai had this idea of he wanted to build... introduce a monetary policy in b-money. So we discussed with bit gold or with Hashcash before that, that the problem is inflation, essentially. It becomes easier and easier to produce valid hashes. So there's more and more coins, if we want to call them coins, in circulation. And so there's this sort of inflation because of that and the money is not very desirable. So bit gold, solve this as we discussed I think we discussed this right with the second layer with banks and these buckets and that whole thing, by the Wei Dai instead he proposed that he wanted the monetary purchasing power to be stable like in a CPI type of way although he doesn't define this as either he doesn't define what is stable actually specifically or— but then importantly who's gonna decide it?

Sjors Provoost But the idea was then that the amount of proof of work needed depends on the supply that's out there and then the desire for keeping the price at a certain level.

Aaron van Wirdum So there's two proposals. So the first idea was, again, let's for simplicity just take this. It doesn't really matter, but let's take this registry, like the version of b-money where there's this group of servers that sort of decides, you know, prevents double spending. Now then this group of servers would have to kind of come to some kind of consensus of how hard or expensive it is to produce a valid hash of a certain value. And then they would sort of take this basket of goods and then they would match, like, okay, so this is now how expensive a hash is to produce to match this basket. And they would, so in a way, they would sort of set the difficulty of b-money. So there would be sort of a committee, if you will, setting the difficulty. So there's not a difficulty algorithm.

Sjors Provoost Yeah, so it's not even an oracle. It's really a committee that has to look at how difficult it should be.

Aaron van Wirdum Yeah, pretty much. So that's how they keep... what's the best way to put it? I think I've been pretty clear, right? Yeah, yeah. Producing a difficulty should be as expensive over time compared to this basket.

Sjors Provoost I mean, the eventual breakthrough was to realize that if you want to have a constant amount of new supply every so much time, then you just use time as a way to decide how much you should, how high the difficulty should be. That was the insight by Satoshi. So you don't need a committee. but you can actually just use a clock.

Aaron van Wirdum Yes.

Sjors Provoost He was getting there, but he didn't make it all the way.

Aaron van Wirdum Well, but it is very different because Bitcoin does not have this goal of a stable, you know, stable in quote marks, I guess, because we define stable, but stable purchasing power, at least not in a CPI type of way.

Sjors Provoost That's a separate thing right? So there's two things you want to do is you want the supply itself to be at least predictable. And that's, I think, what they both have in common. And Satoshi figured out how to make the supply predictable. But then the secondary goal is like how to make the purchasing power stable. And that is something that Bitcoin simply has not solved. Some people see that as a feature. Other people see it as a bug. Stablecoins solve that problem, but then they have all the other problems.

Aaron van Wirdum I mean, this to an extent comes down to the definition of stable, right?

Sjors Provoost Stable purchasing power, basically. I think you can objectively see that the purchasing power of Bitcoin is less stable than that of the euro, at least so far. Maybe in the long run it becomes more stable.

Aaron van Wirdum That I would probably agree with. However, that doesn't— you're always stuck with defining stable, which is never...

Sjors Provoost No, that's what I'm saying. Stable compared to purchasing power. You have to pick something.

Aaron van Wirdum No, sure.

Sjors Provoost It doesn't have to be CPI.

Aaron van Wirdum Purchasing power of what? What are you purchasing?

Sjors Provoost Yeah, of whatever lifestyle you're having. But I agree, there's all sorts of factors that decide that, right? So that's a whole economics discussion.

Aaron van Wirdum Yeah, so let's sidestep that. But I do get into that aspect in my book as well, at least for part, especially Hayek's ideas about that is sort of what I highlight. Anyway, sidestepping that. Wei Dai had this idea of stability in this kind of a CPI type of sense, basket of goods type of sense. And so, yeah, there's this committee that says, okay, that means that right now the difficulty should be X. Alternatively, b-money had this other idea, or Wei Dai had this other idea, which was, okay, to keep the value stable, we now need X amount of new coins to come into circulation today or tomorrow, per day, say. And we're going to auction this off to the highest amount of proof of work. So whoever is willing to produce the highest, you know, most difficult string, highest proof of work, they'll get the new coins. That's sort of an auction system.

Sjors Provoost And interestingly, that is also very close to what Bitcoin is doing. It lets the market figure out how much hash power there is and who is willing to mine and who is not. But it's not a winner-takes-all system, right? This proposal would have been a winner-takes-all system. Like, you win the auction, you get to make the coins.

Aaron van Wirdum Well, Bitcoin is that as well, right? There's only one winner of a block, essentially.

Sjors Provoost Per block, yeah. But on average, everybody can contribute hash power. And it's not the case that any given hash is predetermined to go to you, right? With this proposal, I think, if you win the auction, then you are doing the mining. for a certain period of time.

Aaron van Wirdum I mean, I think the way b-money, I think this proposal would have been, okay, we're going to bring 100 coins into circulation today. How much hash do you want to show for it? And then people would produce different hashes and there would be only one winner.

Sjors Provoost Oh, okay, but that's more of a race then, where everybody has to put in effort. Because an auction is something where only the winner pays or has to do something.

Aaron van Wirdum Yeah, but how do you know?

Sjors Provoost So what I thought, he was doing, but I haven't read it, so maybe that's why I'm wrong.

Aaron van Wirdum Well, it's not detailed, but it's hand-wavy, so that's why I can't.

Sjors Provoost It's like a [unclear], right? Where you say, okay, who wants to, for the next week, produce hash power? And then somebody says, okay, I have like a 10 tera hash machine, I'll turn it on for a week. And then it's okay, okay, you get this job for the next week, and then next week, somebody else gets a job.

Aaron van Wirdum Yeah, yeah, yeah.

Sjors Provoost Because otherwise, a lot of people are wasting, well, wasting, yeah, basically doing a lot of effort, but they're not winning at all, because they are not the... The very best. They are the second best.

Aaron van Wirdum Yeah, but I do suspect that that is how it would have worked in Wei Dai's mind. I don't know. That was my assumption. So yeah, you have to sort of factor in the probability that you'll be the highest one. I don't know. It introduces an interesting dynamic to an auction.

Sjors Provoost Yeah.

Aaron van Wirdum Like it could work, right? There's no technical reason it can't work.

Sjors Provoost Yeah.

Aaron van Wirdum And it's sort of simpler to implement it that way.

Sjors Provoost I don't think it's an auction because in an auction you only pay if you win. Whereas here, you always have cost as a miner. You're always spending energy, but you may or may not get the reward based on whether you're the highest bidder. So it's not proportional.

Aaron van Wirdum Yes. Yes, it is a bit different in that sense. Anyway, so this stuff is kind of hand-waved. Like, these details are not fleshed out in the b-money proposal. Again, to clarify this, the b-money proposal is not like... a white paper like Bitcoin was it's more like a post of you know one or two pages sort of on a on a web forum so to say. Yeah, so yeah.

Sjors Provoost Which which brings my question is why given that it was just a side note why is it then still remembered?

Aaron van Wirdum um well for one it's of course in the Bitcoin white paper referenced uh I think what I emphasize in my book as sort of the breakthrough step that b-money in a way introduced is this idea that everyone's going to keep track of balances even though he didn't actually propose a way to do it that's you know consensus robust it was still the first time that this was proposed in a digital currency context and you know is used in Bitcoin today so that I see a relevant step there. Although it's a smaller part of my book than, for example, something like bit gold. I do see that sort of this intermediate thing a little bit, but it's still interesting. It's still, you know, a thing that people were thinking about. You know, it was one of the notable digital cash proposals before Bitcoin. The last thing I can mention about b-money, which I'm not going to get into detail on, is that it was very heavily focused on smart contracts as well. bit gold was kind of as well, but b-money as well. There was this idea with like an arbitration system and there was a bigger idea than just cash. It really was sort of meant to be a platform for smart contracts. So it's kind of, it's also, you could argue, sort of a pre-echo for Ethereum because you've got both. sort of a pre-proof-of-stake kind of thingy going on, even though it's not fleshed out. And then there's sort of heavy emphasis on smart contracts, even though it's not actually purely smart contract because there's still a lot of arbitration going on. But anyways, it's interesting to see that these ideas kind of pre-existed as well, maybe.

Sjors Provoost Yeah. All right. Sounds like there was another proposal.

Aaron van Wirdum Yes, so now we're going to take kind of a jump in time, actually, because bit gold and b-money were both proposed in 1998. Of course, both not implemented. And then for a couple of years, actually, interest in this whole domain sort of died down a little bit. The Cypherpunk mailing list itself sort of went defunct. But then in 2004, Hal Finney pops up and he... Actually, I believe he explicitly says that he wants to implement something like bit gold and b-money, but he's going to use a simplified version of it. I would say that's even kind of a misnomer. He just sort of comes up with his own thing. But there's some similarities, sure.

Sjors Provoost But it was inspired by these ideas. But what was very unique about this proposal is that it had code.

Aaron van Wirdum Yes, yeah, that's right. RPOW was actually implemented by Hal Finney and run by Hal Finney. So shall I take the lead on this one again?

Sjors Provoost Yes, please.

Aaron van Wirdum Okay, so RPOW, it's sort of interesting. It starts with eCash, which was centralized, and then that failed and that sort of made Cypherpunks move to a more decentralized direction of thinking, so both bit gold and... well, Hashcash before that, even bit gold, b-money, they all have this idea of how can we centralize the protocol.

Sjors Provoost Decentralize.

Aaron van Wirdum Oh, sorry, yeah, decentralize. And then RPOW actually sort of goes back to just doing it centralized. Now, there were some ideas, or Hal Finney had some ideas, where it could be also kind of decentralized or multiple servers. But the system he implemented was essentially centralized.

Sjors Provoost But it was transparent, right?

Aaron van Wirdum Yeah, yeah. So I'm getting there. So let me first just mention real quick how it works, essentially. It's also worth mentioning at this point, for example, Tor has been invented, the Onion router. So now it's possible to connect to the server anonymously, which sort of did away with some other... anonymity technologies that, for example, eCash used. So actually, what you did with RPOW is you connect with the server. The server then gives you a proof of work assignment. And if you perform this proof of work, you get coins. So the server issues coins to you. Now, these coins are just numbers, essentially. And then if you want to pay someone, you just send that person these numbers and that person sends these numbers to the server. And then the server says, yep, these are indeed numbers that I generated. Like the server keeps track of what numbers it issued essentially. And at that time, it also makes these numbers invalid and gives new numbers in return.

Sjors Provoost Yeah.

Aaron van Wirdum Does it make sense so far?

Sjors Provoost Well, yeah, the making things invalid and giving new ones in return is something you see with the eCash as well.

Aaron van Wirdum Yes, indeed.

Sjors Provoost Except that these are not blinded at all.

Aaron van Wirdum Right. So the privacy in this case, as I mentioned, is you can just connect with the server through something like Tor and then the server doesn't know who you are anyways. Yeah. So instead of like this. you know, blind signature technology that eCash uses. RPOW kind of takes a simpler approach and the server just doesn't know who you are anyways.

Sjors Provoost Yeah, which has, I believe, one of the benefits is that it's easier to check the supply.

Aaron van Wirdum Yeah, I guess that's a good point. Well...

Sjors Provoost How was the supply created?

Aaron van Wirdum Well, hang on. So the server, there's two ways that the server essentially issues coins, right? So one way is in return for proof of work. And another way is in return for other valid coins. Now, there's no actual limit on the supply, or at least the way Hal Finney implemented it. There's no limited supply, if that's your question.

Sjors Provoost Yeah, it was completely inflationary, but you can at least check the amount of proof of work that goes in. I don't know if you can check it, actually, because you'd have to ask for the whole transaction log, and I don't know if the server will give you the entire transaction log.

Aaron van Wirdum I don't think it would. No, I don't think so. Not that I know of. I haven't looked at the code itself, but I've not read that this would have been the case.

Sjors Provoost No, I think then the model was different, right? But we'll get to the transparency side of it later. But I think you rely on understanding what code is running, and you can see that that code is not creating inflation, therefore you're trusting extra inflation. I mean, it's not like printing money for the owner. but only because you know that that code should do what it says it does.

Aaron van Wirdum Yes. Well, that's the next point where we're getting at. So the part of creating coins makes sense, right? It's just proof of work. So it's called RPOW, which stands for reusable proof of work. And really, if you read Hal Finney's comments on it, it was more supposed to be kind of like Hashcash, kind of like postage, just reusable postage. So there wasn't, again, there wasn't like this big idea of monetary reform or scarcity, or it was really just, let's make proof of work reusable, you know, sort of Hashcash.

Sjors Provoost Yeah, because the idea of being able to get change for the work, that's new here. I think.

Aaron van Wirdum Change?

Sjors Provoost Well, so what we talked about last week, or last time, which other systems was it again? bit gold?

Aaron van Wirdum Mm-hmm.

Sjors Provoost That one, you didn't have change. So you would send a piece of proof of work, and you could not get change back. You'd have to go to this bank and work with these buckets and all that stuff. Whereas now, with RPOW, you do have change. The server can give you change.

Aaron van Wirdum Yeah, with RPOW, you don't own the hashes themselves. The hashes are just a way to earn coins.

Sjors Provoost Yeah.

Aaron van Wirdum So the server will just issue you coins if you perform proof of work or if you give coins to the server. Like if you receive a coin, then you get new coins.

Sjors Provoost Okay.

Aaron van Wirdum Okay, so it's pretty simple so far. Now, what was important for Hal Finney, though, was that he did want RPOW to be trustless. So it was centralized, but he still wanted it to be trustless. So the trick he used for that is that remote attestation. So essentially... The code he was running on this server was free and open source software. And this was just published online. So anyone could read the code, could read how this product worked, could read that the only way new coins would be brought into circulation is either through proof of work or in return for other coins. So even the owner of the server, Hal Finney in this case, couldn't just issue himself free coins, right? Because it's free and open source software. Now, how do you know that the server is actually running this software? So this is the remote attestation trick.

Sjors Provoost Yeah, because, of course, in open source, the big problem is you have no idea what code is actually running.

Aaron van Wirdum On someone else's server, yeah.

Sjors Provoost Yeah, or even on your own computer. That's what we talked about in an earlier episode about Guix and deterministic builds.

Aaron van Wirdum Yes.

Sjors Provoost But ignoring the problem of build systems, which he ignored, I believe, the binary that's running on that machine... how do you know that that's actually running on the machine? And that's where, indeed, remote attestation comes in. which is a pretty cool concept. I can try and explain it.

Aaron van Wirdum Yes, we're getting close to your wheelhouse now. I know the concept, but yeah, let's go for... Let's give you the short special on this one.

Sjors Provoost So I believe this was the first or one of the first computers created by IBM that did this feature. So he was excited about that, presumably, and probably that's why he used it in the proposal. So you can basically connect to this machine and say, please tell me what code you're running. and it will tell you, okay, here's a hash of the code I'm running, not the actual code, but it will give you a hash, and it will sign it with a signature, and then, and this is where the, you know, murkiness starts coming in, you trust this signature because IBM signed something that says this person, you know, this computer can sign on my behalf. So there's a private key on the computer, not a Bitcoin private key in the sense that you can spend with it, but a private key that can sign a secret. So IBM has said, okay, this key on this computer, you can trust it. It's a computer that we sold. And then if this key signs anything, then you believe what it says. And then the question is, what does it sign? Yeah, it basically makes a hash of whatever program is running right then, and that's what it signs for. There's a lot of caveats here.

Aaron van Wirdum Yeah, well, the private key is really embedded in the chip itself.

Sjors Provoost Yeah, and a secure enclave, basically. So very much like a hardware wallet in the sense that the assumption there is that the owner cannot get that private key out. So the owner cannot sign another message pretending that there's a different program running on the computer. However, of course, we know from hardware wallets that sometimes they are compromised. And this is 20 years ago, so they were probably less secure. But I don't know if that ever happened to this particular computer. But the assumption is that the owner cannot get the key out. Therefore, you can trust that the computer is talking to you. That's the public key cryptography at work. And that the computer is maybe not lying because IBM says that their computers don't lie.

Aaron van Wirdum Yeah. You're trusting IBM, essentially. Now, you could make the argument that you're kind of trusting IBM anyways if you're running their hardware. Yeah. Whatever you're doing.

Sjors Provoost The owner is, but you as the person using the money system have to trust IBM and not just trust them for not being malicious, but also trust them for not, you know, having a vulnerability in there and not disclosing it or something like that.

Aaron van Wirdum Right. So yeah, that's the, that's the essence of RPOW. There's free and open source software running on the server and you as a user can verify with some caveats. Caveats.

Sjors Provoost Caveats.

Aaron van Wirdum Caveats. That this is actually the free and open source software running on that server, and therefore you're not being cheated on, double-spent on, Hal Finney [unclear] making himself a millionaire for RPOW.

Sjors Provoost And so the funny thing about Bitcoin then is that saying, okay, well, we'd rather not trust this one computer running all the things, so we're going to run the same program. Everyone is going to run the exact same software, and it should produce the same result, giving the same data. So that's kind of a fun way back.

Aaron van Wirdum Right. What else can I say about RPOW? Because that covers most of the technical part of it. Fun fact is maybe that Greg Maxwell worked on it for a bit. You know, the Bitcoin Core developer, the Bitcoin Core wizard.

Sjors Provoost One of the funny things is I briefly looked at the source code like several months ago. But it has something like a difficulty adjustment algorithm in there. Because when you are selling work to the main house, so anybody can sell work essentially to the server to get the RPOW tokens. And the code is there that produces the work that you can then sell. And that code actually makes sure that it's producing roughly the same number of coins every 10 minutes. So that is, it's not like, it's not a requirement in consensus, but it's just some, for some reason, there's already difficulty adjustment in there.

Aaron van Wirdum Right, right, right. What else? Yeah, so it never really took off. It always remained sort of this very small niche plaything that almost no one cared about, probably in large part because it had this inflationary effect to it, like there was no...

Sjors Provoost And it was also quite risky from a centralized point of view, right? If the government says, hey, Mr. Finney, what are you doing here with all this money? Please turn it off. Because, yes, it's transparent, but if he turns it off, it's off.

Aaron van Wirdum Yeah, that's very true, of course. He couldn't cheat, but their server could still be shut down.

Sjors Provoost Yeah, and a government can, of course, also force IBM to produce fake signatures and all that stuff.

Aaron van Wirdum Right.

Sjors Provoost But I don't know if that's the reason why people didn't use it.

Aaron van Wirdum Well, Greg Maxwell and I think it's just there was no economic incentive for anyone to use it. Like, why would you use something if you know for sure that next year it's going to be worth less?

Sjors Provoost So purely the inflation was holding people back.

Aaron van Wirdum I mean, it could still be useful in a hash cash type of way, like to use it as postage. But even then you're dealing with this chicken and egg problem, right? Like in the case of an email, why would you require people to produce proof of work? If no one does it, that means you're never getting any emails.

Sjors Provoost No, but you could even imagine using it as money, but only for very short term transactions where the volatility is acceptable. But yeah, so maybe it was the inflation, but also maybe it was just ahead of its time or there was something about Bitcoin that made it take off.

Aaron van Wirdum I mean, I think it's the economic incentives. I think it's a limited supply of Bitcoin.

Sjors Provoost I'm just thinking the QWERTY keyboard classic story, right? It wasn't necessarily the best keyboard out there purely from an economics point of view, but it's just the thing that took off. Sometimes in technology, something takes off because it takes off. But it could also be for the reasons that you mentioned.

Aaron van Wirdum True. Okay. Is there anything else you want to mention about RPOW?

Sjors Provoost No, I would just say that it's very cool that the Nakamoto Institute has published the source code for RPOW, including the older versions of it. I don't know if you can still compile it, but maybe with some effort. It could be fun to play with it and see if you can run it and see what it actually does in a modern world. And it also has quite an elaborate FAQ and descriptions of how Finney thought the privacy would work. So that's all I have on it, but very cool.

Aaron van Wirdum Okay.

Sjors Provoost In that case, thank you for listening to Bitcoin,

Aaron van Wirdum Explained.