Dar Scott proposes some extensions to digital cash to deal with the issues being discussed here. He mentions "money orders" and "escrowed money orders," and he alludes to "trustees," or agents that would behave in certain well-defined ways. This is as good a place as any to address a point I've been thinking about for a long while, and which I've touched on before. Namely, that the "ontology" of digital money, the instruments and forms it can take, are _impoverished_ compared to the real world. In my eight years of following digital cash work, I've been struck with how little _economics_ enters the fray. Many of the protocols that seem to have problems from a purely cryptographic point of view seem to get fixed when additional _economic_ considerations are included (the consideration we cite the most is "reputation," and we debate this endlessly). The PGP "web of trust" is a kind of example of this additional consideration, if we make certain fairly reasonable assumptions about the nature of collusion. (Lots of stuff to get into here, but I want to make some other points and not get too sidetracked.) "Digital money" currently has only a few ways of dealing with transfers of value in transactions. A lot of the problems come, in my view, from this relatively spartan set of "primitives." Where are the cryptographic equivalents of: - money orders - promissary notes - receipts - warrants - lockboxes - bearer bonds - options - time deposits - coupons - escrow - IOUs - zero coupon bonds - checks ...and so on. The terms in any good dictionary of financial terms (such as the "MIT Dictionary of Modern Economics," ed. by David Pearce, 1992). (Many of these things are built up out of more basic things, with mix-ins from other classses, or with modified methods.) A look at any book on money and finance shows a rich "microworld" of "things" and "procedures" (classes and methods attached to classes). The classes have subclasses, and the methods have various behaviors and "expectations" attached (more than just simple class behavior, more of an AI or agent flavor, in my view). (AI is somewhat of a dirty word these days, due to hyped expectations. But many of the methods have been useful in limited domains. The domain of financial transactions, with the classes and methods hinted at above, involve a lot of formal manipulations and expected behaviors.) In the real world, as the "base class" of "things traded" (tangible assets) reached various limits, a new class of "money" was created, where money was gold, silver, spices, etc., that could be more easily transported and stored. And so on, through levels of abstraction (marks on clay tablets, entries in ledger books, issuances of certificates, bonds, derivatives, etc.) My point is not to recap views of the history of money in its many forms, or even to give my views on the "ontology of money," but to say that many of the problems we think are present in current digital money systems may largely result from the impoverished set of base classes of digital money. To me, an exciting project is to take the basic cryptographic protocols and build up more structured objects (blobs, envelopes, seals, etc.), and then incorporate these into even more complicated financial instruments. There have been proposals for crypto class libraries, most recently in Ray Cromwell's detailed plan for C++ crypto classes. Others I have been in communication with have expressed interest in doing the same thing in Smalltalk, given that many financial companies are doing a lot of their complicated transactions in Smalltalk. And Java has just entered the scene.... My point is not to argue for any particular language approach, or even to argue for this "ontology of digital money" as a Cypherpunks project, but to share with you some thoughts. I think significant progress will have been achieved when these "financial objects" can be launched and used without a lot of hand-tuning and human intervention. In fact, an "economic microworld" of agents/actors interacting and trading in various forms of digital cash and derivatives would be an exciting "artificial life" example, and one which would test the robustness of protocols. I don't think this is beyond the current state of the art by too much. I'm working on bits and pieces of this, but progress has been slow.... --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."