# Digital Gold

```-----BEGIN PGP SIGNED MESSAGE-----

I tried to imagine a digital currency which is not backed by
any bank, but just exists by mathematics and convention, like
gold.  The result is the following currency system which
could be called digital gold.  It involves three conventions,
(1) a convention for valuing coins, (2) a convention for
claiming coins, (3) a convention for transfering coins.

I believe the resulting currency is unforgeable,
uninflatable, and untraceable.  Let me know where I've gone
wrong (gently).

Digital Gold
-----------

Let's associate one digital gold coin with each positive
integer.  Let's agree that the coin for each integer N is
worth half as much as the coin for integer N/2.

integers:   are each worth:
--------   -----------
1 - 1       1    ounce
2 - 3       1/2  ounce
4 - 7       1/4  ounce
8 - 15      1/8  ounce
16 - 31     1/16 ounce

The total amount of digital gold is infinite.  However, the
amount in circulation will always be finite because the
lowest denomination coins aren't worth claiming or to
spending.  (Claiming and spending of coins will be described
shortly.  For the time being, let's just assume that each
requires a certain amount of computation.)

For example, if it costs 1/10 ounce of digital gold to spend
a digital coin, then 1/16 ounce coins will not circulate.
The total amount of digital gold in circulation will then be
4 ounces.

The supply of digital gold is similar to the supply of real
gold.  As the value of real gold increases (relative to the
cost of mining), more real gold can be mined profitably.

If the demand for digital gold doubles, its value will
roughly double, and a lower denomination can then circulate.
Similarly, if the cost of computation halves, a lower
denomination of coins can circulate.  In either case, the
number of coins doubles, but the supply of digital gold
increases only slightly.

Each denomination represents an equal fraction of the digital
gold in circulation.  Therefore, as new denominations come
into circulation, the supply of digital gold remains
relatively stable.  However, the number of coins increases in
proportion to the demand for digital gold, and to the supply
of computation.  This seems appropriate.

Also, only a small fraction of the digital gold is in the
smallest denominations.  This is important since the smallest
denominations are always inefficient to spend.

Claiming Digital Gold
--------------------

Let's agree, by convention, that the first person to sign a
particular integer, owns the digital gold corresponding to
that integer.  This is the law of initial acquisition of
digital gold.

In order to claim a digital gold coin, the claimer must
publicize a "claim certificate", containing the signed
integer and the public key required to recognize the
signature.  The first person to publicize a claim certificate
will be recognized as the owner.

A claimer can use a new alias for each new claim.  In this
way, he can claim coins without revealing his identity.

Spending Digital Gold
--------------------

In order to spend a coin, the payor signs a claim certificate
from the payee.  This voids the payor's ownership of the
coin, and validates the payee's ownership.  The payor uses
his old alias to sign the payee's claim, so that he does not
identify himself.  The payee can generate a new alias for
each new claim certificate, so he can accept coins without
identifying himself.

The law of property transfer for digital gold is the same as
the law of property acquisition.  The first person to
publicize a new claim certificate signed by the previous
rightful owner, rightfully owns the coin.

The payee should have the claim confirmed (signed) by some of
the agencies where he might like to spend the coin.  A
confirmation indicates that the agency is willing to accept
the coin from the new alias.  Before confirming a claim, an
agency should establish that the payer owned the coin at one
time, and that he has not yet granted it to anyone but the
payee.  If the claim is good, the agencies should take note
of the new owner.  If the claim is bad, the payee can
confront the payer.

Agencies can do enough research to avoid confirming most bad
claims.  For each coin, there exists a chain of claim
certificates extending all the way back the the original
owner of the coin.  The backward chain proves that each alias
has owned the coin at one time.  The forward chain proves
that each alias no longer owns the coin.  Agencies can also
sign claims with timestamps, in order to settle disputes over
coins claimed by multiple owners.

The result is ownership by consensus.  If the agencies I wish
to do business with agree that my alias owns a particular
coin, then I own a certain amount of digital gold.

------- Yours Truly, ][adon Nash ---------------------
in founding a family or a state, or acquiring fame even,
we are mortal; but in dealing with truth we are immortal,
and need fear no change nor accident.
--------------------------- ][enry David Thoreau -----

-----BEGIN PGP SIGNATURE-----
Version: 2.3

iQCVAgUBLHo/dTIwr9YMSTuBAQE2yAQAqOXczfGi0SffaNoPj294bQQSoSTMkiTU
Ko62ELCoshD729+2Qin5NqS+eFcW5zL+o/KZU4c1OZYa5Bt5PqlZIq29kjuNiNSr
Z/E6++HyaLO0S4ivjUhWRqOorT5b8WwL+a37zk2cNEdXG8sfsyS6Hn+xhHHhUmgD
2E4dGeMeftY=
=HWaS
-----END PGP SIGNATURE-----

```