Bitcoin has no new parts
My university notes on blockchain open with a claim I ignored for years: blockchain are pre-existing technologies that were combined to make something new. Underneath it is a timeline, 1960s to 2009, thirty-odd entries long. I skipped it every time I studied, the way everyone skips the history chapter, and went straight to the block header.
That was a mistake, and the whitepaper says so. "Bitcoin: A Peer-to-Peer Electronic Cash System" is nine pages long and ends with eight references. All eight predate 2003. One of them is a probability textbook from 1957. Whatever Bitcoin is, it is not a thing that arrived from nowhere in 2008 — it is an assembly, and the parts have names, dates, and papers. Some of the parts had already been running in production for thirteen years by the time Satoshi wrote them down.
So this post is the history chapter, done properly: every predecessor as a runnable algorithm rather than a bullet point. You'll mint a coin the bank cannot trace, using the 1982 protocol. You'll break a chain of blocks from 1991. You'll grind a real hashcash stamp with real SHA-1 and watch the counter climb. Then you'll watch identity-based voting collapse, which is the exact hole that swallowed the two 1998 proposals that came closest. And at the end, the whitepaper's own reference list, clickable, with the four components that trace back to nothing at all.
Nothing here is a mockup. The RSA is textbook RSA over BigInt, running in your tab; the blind signature really is verified against a coin serial the bank never saw. The hashcash figure verifies Adam Back's own published example stamp — 1:20:1303030600:adam@cypherspace.org::McMybZIhxKXu57jd:ckvi — and if you don't believe the figure, echo -n that line into sha1sum yourself and count the zeros. The probability table in section 06 is recomputed live and compared, digit for digit, against the numbers printed in the whitepaper. And the eight citations are transcribed verbatim.
One more thing before the history: my notes get parts of this wrong, and I've left the errors in rather than quietly fixing them, because the way a set of notes fails is informative. Three corrections are marked as we go.
01 · The arithmetic was a weapon
Blockchain is a child of cryptography and the cypherpunks, and the cypherpunks existed because of an export regulation.
Until 1996, strong cryptography was legally a munition in the United States, sitting in Category XIII of the munitions list next to weapons. Publishing a good cipher was, on paper, arms trafficking. Mass-market software could export 40-bit keys, which was chosen to be exactly weak enough: enough to stop your neighbour, not enough to stop a government. The relevant fact about a cipher is how many keys an attacker must try, and 2⁴⁰ was a number the NSA was comfortable with.
Then, in the same decade, the primitives arrived anyway. Diffie and Hellman published New Directions in Cryptography in 1976 and showed that two people who had never met could agree on a secret in public (that handshake, and the elliptic-curve version Bitcoin's signatures are built on, get their own post). RSA followed in 1977. Merkle's tree of hashes appeared in his 1979 thesis — the whitepaper cites its 1980 write-up. Goldwasser, Micali and Rackoff formalized zero-knowledge proofs in 1985: proving a statement while revealing nothing but its truth, which is the strange, load-bearing idea that you can have a driver's licence without showing one.
And in 1985, David Chaum published a paper in Communications of the ACM with a title that reads like a manifesto and a first line that reads like a prediction:
The large-scale automated transaction systems of the near future can be designed to protect the privacy and maintain the security of both individuals and organizations.
— David Chaum, Security without Identification: Transaction Systems to Make Big Brother Obsolete, 1985
Around this went a political project. Tim May's Crypto Anarchist Manifesto circulated at Crypto '88; Eric Hughes' A Cypherpunk's Manifesto followed on 9 March 1993 with the line the movement is remembered by — "Cypherpunks write code." The bet was that privacy is not granted by policy but built with mathematics, and that the mathematics was now available to anyone.
Correction one. My notes tell the export-control story like this: Phil Zimmermann printed his cryptographic algorithm and handed a copy to every attendee at his conference, nearly went to prison for it, and then won a lawsuit against the United States establishing that publishing crypto was constitutionally protected. Three things are tangled there. Zimmermann released PGP in 1991 and did route around the regulation by publishing on paper — but as a book, PGP: Source Code and Internals, MIT Press, 1995, exploiting the fact that a printed book was protected speech while the same bytes on a floppy were a munition. Copies were carried abroad, scanned back in with OCR, and recompiled. He was criminally investigated for three years, and the investigation was dropped in early 1996; he never won a case, because there was never a case to win. The lawsuit that established source code as First Amendment speech was Daniel Bernstein's, filed in 1995 with the EFF and decided by the Ninth Circuit in 1999 — the court's reasoning being that cryptographers use source code to express ideas the way mathematicians use equations. Two people, two mechanisms, one memory.
The same toolkit went somewhere else too. My notes spend a page on onion routing, and the mechanism is worth stating correctly because the notes garble it: you encrypt a message in layers, each layer with the public key of one relay, so each relay peels exactly one layer and learns only the previous hop and the next one. No relay ever knows both who you are and what you said. (The notes describe the first step as encrypting with the sender's private key so the recipient can decrypt with the public one — that's a signature, not encryption, and it's the single most common conflation in the whole subject. Signing proves who wrote something; encrypting decides who can read it.) That branch of the tree became Tor and, less charitably, half the deep web's plumbing. It is not part of Bitcoin's lineage. It is part of the same argument.
02 · Money the bank cannot follow
Chaum did not just argue. In 1982 he published Blind Signatures for Untraceable Payments and shipped the mechanism, and it is so simple it feels like a trick.
You want a bank to certify a coin without the bank learning which coin it certified. So you pick a serial number m, and a secret blinding factor r. You hand the bank m · rᵉ mod n — your coin, multiplied by noise only you can remove. The bank signs that, which costs it one exponentiation and tells it nothing. And because RSA is multiplicative, the signature on the product divides cleanly: (m·rᵉ)ᵈ = mᵈ · r, so dividing out r leaves you holding mᵈ — the bank's valid signature on a number it never saw.
Do it yourself. Edit the serial, roll a new blinding factor, walk the coin through the bank and out to a shop:
The last panel is the one worth sitting with. Three withdrawals happened; the bank logged the blinded value of each; your coin arrives at a shop, and the figure asks which withdrawal produced it. The answer is that every logged withdrawal is consistent with your coin, and the figure proves it constructively: for each entry in the ledger it computes the blinding factor that would map your serial onto that entry, then checks it. All three check out. The bank's records don't narrow the field, because they can't — anonymity here isn't a promise about data retention, it's a property of modular arithmetic.
Which leaves the obvious hole. If the coin is a number and nobody can tell whose it is, what stops you spending it twice?
Chaum, Fiat and Naor answered that in 1988, and the second tab of the figure runs it. The coin carries your account number, split into pairs of shares that XOR back to it. Every shop challenges you to reveal one side of each pair, chosen at random. One payment reveals nothing — a single share is a one-time pad. Two payments almost certainly disagree somewhere, and the bank XORs the two halves back into your name. Spend once, you're anonymous; spend twice, you're identified, by arithmetic, with no surveillance anywhere in the system. Set the coin to 4 pairs and double-spend a few times and you'll eventually watch a cheat escape — a 1-in-16 shot — then set it back to 16 and watch the odds vanish.
It is a beautiful piece of work and it was never enough, for a reason worth naming precisely: detection is not prevention. Chaum's scheme identifies the double-spender afterwards, which requires that someone eventually sees both deposits, which requires a bank. Chaum founded DigiCash in 1989 and by 1995 the Mark Twain Bank in St. Louis was issuing real ecash to real customers. It had cryptography nobody has improved on and about five thousand users, and it went bankrupt in 1998. My notes have the reason exactly right, and it isn't technical: Chaum wanted to sell privacy to the banks, while the cypherpunks wanted a system with no banks in it. He built the better product for a customer that had no urgent reason to buy.
03 · The chain of blocks, 1991
Here is the fact that reorders the whole story. The data structure people call "the blockchain" was published in 1991, in the Journal of Cryptology, by Stuart Haber and Scott Stornetta, and it was designed to solve an unglamorous problem: how do you prove a document existed on a given day, when the document is a file and files have no age?
Their answer: don't trust the timestamping service. Make it issue a certificate that commits to the certificate before it. Then the certificates form a chain, and altering a document in the middle invalidates every certificate issued since — including the ones already in other clients' hands. The service cannot quietly backdate anything, because backdating means rewriting a chain that other people are holding pieces of.
That is Bitcoin's core structure, seventeen years early, and the whitepaper cites this paper and its two successors — three of its eight references. Submit some documents, then go back and edit one, the way a client wanting a favourable timestamp would:
Watch what breaks and what doesn't. The edited document no longer hashes to its certificate, and every certificate above it is now vouching for something that isn't there. But the signature still verifies — the service's key was never the problem. What the chain protects against is the service itself, and only because clients keep their own copies.
The second tab is the 1993 upgrade (Bayer, Haber & Stornetta, reference [4]): batch a whole period's requests into a Merkle tree and publish a single root somewhere that cannot be quietly revised. Their company, Surety, chose the New York Times classifieds, under "Notices & Lost and Found," and has run that ad every week since 1995. It is still running. Which means the longest continuously-operating hash chain on Earth is not Bitcoin — it's a weekly small ad, six years older, sitting in a newspaper. Pick any document in the figure and it will produce the ⌈log₂ n⌉ sibling hashes that fold your leaf up into the published root, proving inclusion while trusting nothing but newsprint.
One detail in that tree differs from Bitcoin's on purpose. When a level has an odd number of nodes, this tree promotes the lonely one. Satoshi's hashes it with itself — a shortcut that later became CVE-2012-2459, where two different blocks could produce the same Merkle root. The 1993 design didn't have the bug. Bitcoin can't remove it now; the whole chain validates under it.
04 · Postage stamps for email
Two threads left. Bitcoin needs the appending to be expensive, and that idea also came from somewhere unglamorous: spam.
In 1992, Cynthia Dwork and Moni Naor presented Pricing via Processing or Combatting Junk Mail at CRYPTO. The proposal: make the sender compute something moderately hard before you accept their mail. A human sending twenty emails a day won't notice. Someone sending a million will.
Adam Back turned that into a shipping artifact. On 28 March 1997 he posted hashcash to the cypherpunks mailing list — a "partial hash collision based postage scheme" — and the format is one line of ASCII whose SHA-1 must begin with a stated number of zero bits. The paper everyone cites came in 2002, but the code was five years earlier.
The figure below does two things. First it checks Back's own published example stamp, the one in his documentation, and finds exactly the 20 leading zero bits it claims. Then you mint your own: pick a recipient, pick a difficulty, and watch your CPU grind a counter:
Correction two. My notes date hashcash to 2002 and list "2004 — Development of B-Money by Wei Dei using hashcash." Both wrong, and the second is wrong twice: b-money is 1998, six years earlier, and the man's name is Wei Dai. He is reference [1] of the whitepaper — the first citation in the paper — and my notes misdated him by six years and misspelled him. This is what happens when you copy a timeline instead of reading it.
Look at what the stamp is, though: a string you grind a counter through until its digest is small enough. That's a block header. Bitcoin changes SHA-1 to double SHA-256 and swaps "count leading zero bits" for "compare against a 256-bit target," and those are refinements, not ideas. The idea that matters is what happens to the stamp afterwards. Hashcash spends it once and throws it away, so no matter how much work the world does, none of it accumulates into anything. Bitcoin keeps every stamp and chains them, and the pile of discarded work becomes a ledger whose history has a price. Same primitive, one structural change, entirely different object.
05 · 1998: two proposals, one hole
By 1998 the parts were all on the shelf: hash chains, Merkle trees, proof-of-work, blind signatures, public-key signatures, and a decade of cypherpunk argument about why any of it mattered. Two people tried to put them together, in the same year DigiCash went bankrupt.
Wei Dai's b-money (November 1998) proposed money created by solving computational problems, broadcast to everyone, with no mint — participants maintaining the ledger collectively. Nick Szabo's bit gold proposed a chain where each puzzle solution becomes the challenge for the next, with ownership recorded by a Byzantine quorum of servers.
Read those descriptions and you can feel how close they are. Both hit the same wall, and it isn't cryptographic.
The wall is: who counts as a participant? b-money settles disputes by a vote among servers. Bit gold records ownership through a quorum of unforgeable identities. Neither can say where an unforgeable identity comes from on a network anyone can join by opening a socket. John Douceur gave this hole its name in 2002 — the Sybil attack — but it was fatal in 1998 without a name. Here it is as a slider:
In the first mode a vote costs a socket, so an attacker buys a majority for approximately nothing; drag it past a thousand and the network's history is whatever the attacker says. Then switch to "one hash, one vote" and drag the same slider. Nothing happens. Nothing can happen, because nothing in that tally counts nodes. Splitting the same hashrate across a million fake identities gives you exactly the hashrate you started with. That single change — a vote that costs work instead of a vote that costs an introduction — is what makes an open network survivable, and it's the sentence in the whitepaper everyone quotes without noticing it's an answer to a specific 1998 failure.
The right-hand panel is the follow-through. If the attacker has real hashrate, how deep does a payment need to be buried? That's a gambler's-ruin problem, and it's section 11 of the whitepaper — the reason reference [7] is a 1957 probability textbook. The figure recomputes every row of Satoshi's published table with its own arithmetic and puts the two side by side; all twenty rows match to seven decimals. At 10% attacker hashrate, six confirmations puts the risk at 0.0002428.
Bit gold had a second problem worth mentioning because Bitcoin fixed it silently: bit gold wasn't fungible. Puzzles got harder over time, so each bit of gold embodied a different amount of work, and money whose units aren't interchangeable isn't money. Bitcoin's retargeting difficulty and fixed block subsidy make every satoshi identical regardless of when it was mined.
06 · Everything else was already lying around
Two smaller threads, both in my notes, both real contributions.
The peer-to-peer thread. Napster arrived in June 1999 and was P2P in name — the transfers were direct, but the index was a company, which is why shutting down the company shut down the network. Gnutella (March 2000) removed the index and showed what actual decentralization costs in bandwidth. BitTorrent (July 2001) made large-file distribution work, and 2001 was also the year four distributed-hash-table papers landed at once — Chord, CAN, Pastry, Tapestry — with Kademlia in 2002. By 2008, "how do you gossip data across an untrusted network of strangers without a server" was solved engineering with a decade of deployment behind it. Bitcoin's networking layer is the least novel thing about Bitcoin.
Reusable proof-of-work. In 2004 Hal Finney built RPOW: hashcash tokens you could exchange instead of spending once. Which is exactly Bitcoin's problem statement, arrived at four years early by someone who would go on to receive the first Bitcoin transaction. His solution was a trusted server whose integrity you verified through attestation hardware — an IBM 4758 secure coprocessor. It worked. But it answers a social problem with a piece of hardware, and it leaves you trusting the server, its manufacturer, and the attestation chain. Satoshi's answer needed no hardware and no server, and that difference is the difference between a clever system and one that's still running.
Correction three. My notes date the genesis block to 11 February 2009, and repeat it under "Bitcoin history." The whitepaper went to the cryptography mailing list on 31 October 2008; the genesis block was mined on 3 January 2009; the v0.1 client was announced days later; and the p2pfoundation post my notes link is from 11 February 2009, over a month after the chain started. The notes read the date on a forum post as the birthday of the system. It's a small error with a large moral: this history is recent enough that its primary sources are still online, and I still got it secondhand.
07 · So what was actually new?
Here's the whitepaper's reference list, verbatim and in its own order, next to the components Bitcoin is made of. Click a part to see where it came from; click a citation to see what it supplies:
Seven of the eleven components trace to a citation. The chain of blocks is Haber and Stornetta. The Merkle tree is Merkle. Proof-of-work is Back, out of Dwork and Naor. Naming things by their hash is 1997 — the same primitive the git posts are built on. Issuance without a mint and broadcast-to-everyone are Wei Dai's. The safe-depth calculation is Feller's textbook.
Four are cited to nothing, and they are the same four thing seen from different angles:
- the longest chain is the truth — the tiebreak that turns a pile of timestamps into one agreed history;
- one CPU, one vote — consensus weighted by work instead of by identity, which is what makes the participant set open;
- double-spend prevention with no bank — Chaum could detect, this prevents, with nobody in charge;
- difficulty that retargets itself — the thermostat that holds ten minutes however much hashrate shows up, and makes the units fungible while it's at it.
That's the invention. Not a new hash, not a new signature scheme, not a new data structure — a rule for choosing between competing histories, priced so that lying costs more than it pays. Every other part was on a shelf, most of them for over a decade, several of them in production. The genius was assembly, plus one missing bolt that nobody else had thought to machine.
And the omissions in that reference list say as much as the citations. Click "show the omissions": DigiCash, bit gold, RPOW and the Byzantine Generals problem appear nowhere in the paper, despite being its closest relatives. The bit gold omission is the strangest, since it's structurally nearest of all. So is the total absence of politics — nine pages of engineering with no manifesto in them, from a project whose first block has a newspaper headline about bank bailouts welded into it. The argument went into the data, not the prose.
08 · Where this goes
My notes were right, then, in the sentence I kept skipping: pre-existing technologies, combined to make something new. What they couldn't convey — what a timeline structurally cannot convey — is that each of those entries is a machine, and that you can run every one of them in a browser tab in a few hundred lines. Chaum's blind signature is four lines of modular arithmetic. The 1991 blockchain is a hash and a loop. Hashcash is one line of ASCII and a counter. The reason these ideas took twenty-six years to become Bitcoin isn't that any of them was hard to build.
Which is the right frame of mind for part one, where the assembled thing gets taken apart: an 80-byte header, four real blocks from 2009, and the same double-SHA-256 you just used to mint postage — this time with every stamp kept.
There's one loose end I'll admit to. Reading this history in order makes 2008 look inevitable, a last brick in a wall built by twenty people over three decades. It didn't feel that way in 2009, when the thing was worth less than a cent and the first real purchase was two pizzas for 10,000 BTC. Assembly is the invention, but somebody still had to believe the pile of parts was worth assembling.