David Chaum

David Lee Chaum (born 1955) is an American cryptographer who founded the field of anonymous digital cash and privacy-preserving cryptography. In a series of papers beginning in 1981 he introduced the mix network for untraceable communication, the blind signature for untraceable payment, and the dining cryptographers protocol for unconditional sender anonymity, and his 1982 doctoral dissertation set out a system that anticipated much of the later blockchain. Through his company DigiCash he built eCash, the first working electronic-money system, which depended on a bank as a trusted issuer and went bankrupt in 1998. The Cypherpunks built directly on his work, and the trustless designs that became Bitcoin were in part an effort to remove the central issuer his system required.¹²

Mix Networks and the Dining Cryptographers

Chaum earned a doctorate in computer science from the University of California, Berkeley, and taught there and at New York University before moving his research to the Netherlands. His 1981 paper "Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms," published in Communications of the ACM, introduced the mix network, a chain of relay servers each of which receives a batch of encrypted messages, decrypts one layer, shuffles the order, and forwards them, so that no single relay and no outside observer can link a message entering the chain to one leaving it. The design is the conceptual ancestor of later anonymity systems including the onion-routing network Tor.³⁴

In 1988 Chaum published "The Dining Cryptographers Problem: Unconditional Sender and Recipient Untraceability" in the Journal of Cryptology, which posed a puzzle: three cryptographers at dinner want to learn whether one of them paid the bill or whether their employer did, without revealing which of them paid. The protocol he derived, in which each participant shares a secret coin flip with a neighbor and announces the parity, lets the group compute whether any member sent a message while hiding which one did, with anonymity that holds even against an adversary with unlimited computing power. The construction, known as a DC-net, became a foundation of research into anonymous communication.⁵⁶

Blind Signatures

Chaum presented "Blind Signatures for Untraceable Payments" at the CRYPTO '82 conference, published in the proceedings in 1983, building on the idea he had set out in his 1982 dissertation. A blind signature lets a signer certify a message without seeing its contents. In Chaum's payment scheme a customer generates a digital banknote with a serial number, multiplies it by a random blinding factor so the bank cannot read it, and sends the blinded value to the bank; the bank signs it and debits the customer's account, the customer divides out the blinding factor to recover a valid signed note, and when a merchant later deposits that note the bank sees its serial number for the first time and cannot connect it to the withdrawal.²⁷

The result was electronic money that was anonymous like physical cash yet unforgeable like a bank-signed instrument, since the bank's signature could not be reproduced without its private key and any attempt to spend the same note twice could be detected at deposit. The blind signature solved the central problem that had blocked anonymous digital payment, and it became the cryptographic core of every system Chaum built afterward. His 1985 paper "Security Without Identification: Transaction Systems to Make Big Brother Obsolete" extended the approach into a broader scheme of pseudonymous credentials.²⁸

The 1982 Dissertation

Chaum's Berkeley dissertation, "Computer Systems Established, Maintained, and Trusted by Mutually Suspicious Groups," completed in 1982, described how a group of parties who do not trust one another could jointly operate a record-keeping system whose integrity none of them could subvert. The design specified a data structure in which entries were chained together by cryptographic references and replicated across the participants, so that the history could be audited and could not be altered after the fact without detection, and it included the code to implement the protocol.⁹¹⁰

Commentators who later compared the dissertation to the 2008 Bitcoin white paper observed that it contained most of the structural elements of a blockchain, including a chained, tamper-evident ledger maintained by a set of mutually distrustful participants, and that the principal element it lacked was proof-of-work, the mechanism by which an open, permissionless network reaches consensus without a fixed membership. The Satoshi Nakamoto Institute republished the dissertation in its library as an antecedent of the blockchain.⁹¹⁰

DigiCash and eCash

Chaum founded DigiCash in Amsterdam in 1990, after his cryptographic group at the CWI research center, to commercialize anonymous electronic cash. Its product, eCash, used Chaum's blind signatures to issue digital coins that a customer withdrew from a participating bank, stored on a personal computer, and spent at merchants, with the bank unable to trace where its issued coins were spent. DigiCash also ran a free trial currency called CyberBucks. In October 1994 the company demonstrated the first live payment over the World Wide Web.¹¹¹

Adoption never reached the scale the system needed. The Mark Twain Bank of St. Louis became the first licensee to offer eCash in 1995, followed in 1996 and afterward by Deutsche Bank, Credit Suisse, Bank Austria, and a handful of others, but by 1998 the Mark Twain program had signed only about 300 merchants and 5,000 users. Reported negotiations with larger partners fell through, including a Visa investment and a Microsoft proposal to bundle eCash with Windows 95 over which Chaum and Bill Gates reportedly could not agree on terms. DigiCash filed for bankruptcy in November 1998. Chaum told Forbes the following year, "It was hard to get enough merchants to accept it, so that you could get enough consumers to use it, or vice versa."¹¹²

eCash differed fundamentally from the cryptocurrencies that followed. A customer's payment was anonymous, but a bank had to issue every coin, validate it, and maintain the account ledger, so the system could not operate without a trusted central institution and could be shut down by removing that institution. The proof-of-work currencies that the cypherpunks went on to design, beginning with Adam Back's Hashcash, Wei Dai's b-money, and Hal Finney's reusable proof-of-work and culminating in Satoshi Nakamoto's Bitcoin, replaced Chaum's trusted issuer with an open network that mints and validates its own units, removing the single point of control that had defined eCash.¹³²

Later Work

After DigiCash, Chaum continued to work on cryptographic systems, concentrating heavily on verifiable election technology. He designed end-to-end verifiable voting schemes including Punchscan and the in-person system Scantegrity, which was used in a binding municipal election in Takoma Park, Maryland, in 2009. In the cryptocurrency era he returned to digital money with the Elixxir and Praxxis projects and the xx network, and he proposed eCash-style privacy designs for central bank digital currencies, work in which his original blind-signature approach reappeared decades after DigiCash.¹⁴⁴