Hacker News Reader

This doesn't make any sense. Can only preordained organizations print the notes? Then we’re back to centralized cash. Can anyone print the notes? Then they can also print duplicates. Do we verify electronically when we transact to prevent that? Then we're back to electronic transactions.

What am I missing? How is this not fatally flawed?

Today, Kong's printing is centralized to the Kong project (similar to a premine) because we cannot guarantee that someone else will use a secure element which conforms to section 2 of the paper (which would preclude the creation of duplicates). If anyone else wants to print Kong, and we can verify they source a secure element conforming to section 2 of the paper, then we'll share "printing rights" with them. The Kong recurring lockdrop, section 4.2, is outside of our control and open to anyone.

We start to explore how someone could participate in printing Kong freely, without our influence, in section 5.1 but there are massive unsolved challenges to tackle here.

There is a significant distinction between verifying a note electronically and conducting an electronic transaction. The former can be done in an offline fashion; the latter cannot and, in the case of credit card networks, Ethereum and, Bitcoin, incurs a fee.

Is this not strictly worse than cash, then? It’s still a centralized physical currency, but instead of a government with checks and balances that is ostensibly accountable to its citizens, Kong is controlled by an opaque organization accountable to nobody.

After reading the paper, I’m still not exactly sure how the lockdrop works. Could you elaborate on it?

As for verifying transactions offline, I’m skeptical of how useful that is. If you can lock down printing, the supply of fake or duplicate Kong should be low anyway. If you decentralize printing (or a lot of counterfeit/duplicate Kong gets introduced into the market some other way) then offline verification seems insufficient. What’s to stop me from printing and spending two copies of a note if I know the other parties won’t veriify the transaction online until much later?

We can only print Kong; we cannot remove it from circulation. We're limited in the total amount of Kong we can print.

We likely will need to have another document detailing how the lock drop works. The short version is that you lock up Ethereum in a smart contract for between 30 and 365 days; when you prove that fact to a given Kong lock drop contract instance you receive Kong token (at the end of the period).

> If you decentralize printing (or a lot of counterfeit/duplicate Kong gets introduced into the market some other way) then offline verification seems insufficient. What’s to stop me from printing and spending two copies of a note if I know the other parties won’t certify the transaction online until much later?

Here's how I see offline verification working:

(1) I sync up directly with an Ethereum node and cache all the Kong note smart contracts (ideally my own would be the most trustworthy). Most importantly this contains the public key for each Kong note known at the time and the token associated with that note (2) I accept any notes that I can electronically verify from that cache. That's done by challenging the note to sign a message and verifying the response. (3) I don't accept any notes not in my cache. The downside is that I can't accept very new notes, but we suspect that if we continue to produce Kong that we'll do so in large batches infrequently.

> We can only print Kong; we cannot remove it from circulation.

This isn't strictly true; you can buy notes from people.

> We likely will need to have another document detailing how the lock drop works. The short version is that you lock up Ethereum in a smart contract for between 30 and 365 days; when you prove that fact to a given Kong lock drop contract instance you receive Kong token (at the end of the period).

It sounds like the basic idea is that you "preorder" Kong with Ethereum, and then you visit a physical location (the "contract instance") to receive your cash ("Kong token"). If my understanding is correct, then this isn't outside of your control at all — you (or the "contract instance") can simply refuse to issue the cash.

Re: verification, here's my issue:

> Most importantly this contains the public key for each Kong note known at the time and the token associated with that note

What if someone counterfeits Kong not by wholesale faking currency, but by duplicating valid notes in circulation? The public key would be the same, so they would both pass offline verification.

> This isn't strictly true; you can buy notes from people.

Haha, sure.

> It sounds like the basic idea is that you "preorder" Kong with Ethereum, and then you visit a physical location (the "contract instance") to receive your cash ("Kong token"). If my understanding is correct, then this isn't outside of your control at all — you (or the "contract instance") can simply refuse to issue the cash.

Nope, it's in a smart contract that can be deployed into perpetuity.

> What if someone counterfeits Kong not by wholesale faking currency, but by duplicating valid notes in circulation? The public key would be the same, so they would both pass offline verification.

Section 2 in the paper explains how difficult this would be do. You need to duplicate the private key from a secure chip designed not to reveal the private key.

> Nope, it's in a smart contract that can be deployed into perpetuity.

But I would be receiving a physical object, correct? Which means one of the following must happen:

- you give me notes in a manner that is not controlled by you (e.g. in the mail) assuming I'll fulfill the contract in good faith

- you give me notes in a manner that is controlled by you (e.g. at a bank-like location) to prevent theft

- we introduce an oracle (i.e. centralization in a third party)

> You need to duplicate the private key from a secure chip designed not to reveal the private key.

Yeah, this is an example of a problem that becomes much more likely if you share "printing rights".

Ultimately, I remain unconvinced — this is as proposed today a centralized currency that is almost strictly worse than a government currency, with the possibility of new drawbacks were printing ever to become decentralized.

> But I would be receiving a physical object, correct?

Incorrect. The lockdrop is for completely virtual Kong token.

> Yeah, this is an example of a problem that becomes much more likely if you share "printing rights".

Correct, as elucidated above. Likewise each Kong self generates its own private key by design, as outlined in section 2 of the paper. By design, the key is non-extractable.

> Ultimately, I remain unconvinced — this is as proposed today a centralized currency that is almost strictly worse than a government currency

We can't inflate Kong infinitely unlike every other paper fiat currency. We can only print Kong for four years. After that the only digital Kong produced is via lockdrop.

> We can't inflate Kong infinitely unlike every other paper fiat currency. We can only print Kong for four years. After that the only digital Kong produced is via lockdrop.

So what? As soon as you share printing rights the other party can. So can anyone else who has the private key. Not even by minting new Kong but by physically duplicating existing Kong. That's a much bigger problem than a well controlled 2% rate of inflation.

It's a zero coupon bearer bond, that's all. With some very elaborate anti forgery. Nothing wrong with an organization printing bonds, it's just that these aren't a debt but represent locked up economically inactive etherum.

This might sway me if they didn't repeatedly refer to it as "cash" on their website.

There's a distinction that Kong is not payable on demand, until after expiry, but I'm not sure it's a useful distinction. Unlike a conventional bond, there isn't a question of default by the issuer; the Etherium is locked up in a smart contract, rather than relying on the issuer honouring the bond at maturation.

Rarely do users of cash care about the property of it being payable on demand by the issuer (conventionally a central bank), only the property that it be practical for physical commerce.

Here the risk is that the note becomes physically damaged in some trivial way and the value is lost forever. Maybe it's bent too far over in one direction, maybe something heavy falls on it, etc, etc.

That physical cash can become damaged is nothing new. Maybe this implementation could be easily damaged in some way, I don't think this threatens the concept of silicon cash generally.

Physical cash is both very resilient and if damaged can be replaced. This is neither.

The notes are more durable than linen currency and less durable than polymer currency. We found this to be an acceptable tradeoff. Most of the note can be destroyed but the funds still claimable. There is an envelope of durability properties associated with physical cash - Kong fits within most of these. Of course there is opportunity for improvement which we hope to address in future versions.

I'm not sure what you're making that assertion on the basis of. The note has redundant electrical connectors. You could melt the bulk of the note down and still claim the Etherium from the secure element. Hypothetically you could have redundant SEs.

A user accepting these "verifies" them by assuming that two properties hold if they connect over NFC or via pogo pins to the "gold elements", send a challenge over this connection, and receive in response the challenge signed with a public key associated with locked Kong tokens.

1. the relevant private key is known to only a Kong note's secure element. this is (hopefully) enforced by the secure element's, uh, security, and by the issuer.

2. the relevant private key is known to the secure element on the specific physical Kong note the user has been given.

2 is unenforced in your current design, from what I can see. A crafted note can relay all communication to the secure element of another note (e.g. over low-power RF from a single-use battery or small ultracapacitor).

better, a "dead" Kong note which performs no NFC communication can be given to a merchant; then, a high-power NFC transceiver can be used to pretend to be the note wirelessly (from a handful of meters away, but in a lot of situations that's more than enough). Of course, this one only works if the verifier is using NFC, but... This one is particularly nasty because it's relatively straightforwards to "weaponise" - imagine buying a "kit" off AliExpress which contains fifty dead notes, a ProxMark, and an amplified antenna. Then, in any situation where you're close enough to the person who'll be verifying your notes... just give them a dead one and relay communications. Verification passes, but what the merchant ends up putting in their cash drawer is worthless.

Is it more risky than getting a fake cash from someone? Is it difficult to validate NFC with say...your phone (make sure the NFC signal changes when you bring it close to your phone)?

For 2) I get the part about relaying communication but regardless of that, what makes you think any sort of communication will cause it to output the private key? As far as high powered NFC, I am not sure that would work to begin with (someone who knows radio explained it to me but I cannot recall) but even if it did how is it different than existing mobile phone NFC payment?

You also gotta keep in mind,this is in-person. If someone defrauds you, they face several risks including law enforcement,legal,phsyical altercation(violence) and more.

Better would be nice but I can live with "as good as cash" or "as good as mobile nfc payment" when it comes to security.

Are there any solutions to the relay attack you describe?

Perhaps by having the secure element "lock" and "unlock" each time the note changes hands, so that an attacker who uses a a relay will still have his note locked in a way that makes it useless unless he gives it to the recipient to unlock?

Depending on how much jitter there is in the time it takes to countersign the challenge, RTT might be one way.

Put a bit more "N" in their NFC. They can be tuned to work from millimeters to meters.

You could fix 2 by having a verifier that puts the note in a Faraday cage. While that's more work than just scanning with your phone it could still be cheap and worth it if you were receiving a lot of notes.

This specific man in the middle attack is risky in that it requires very close range, face to face interaction with your target, a fairly unreliable chance of success, and may only work on one of the four validation mechanisms. If effective the money is unlikely to propagate much further as the next user will fail to validate.

I don't understand any of this.

Admitting that is often a good start

It’s incumbent upon everyone here to consider how powerful that can be for the people who’re trying to sell Kong.

I'll try to sum it up: Kong notes are electronic devices which allow whoever has access to them to use a smart contract which after a given date can retrieve a given amount of cryptocurrency. They hold a key which allows them to operate on this smart contract, but don't reveal it, and are designed to be physically impractical to tamper with (https://en.wikipedia.org/wiki/Secure_cryptoprocessor).

> with a fixed face value

So how does a transaction work? Do I exchange a 500 kong note for a 10 kong item and 490 kong worth of notes?

Just like cash.

So if you use a 500 Kong note to someone for a 10 Kong item, they will have to make 490 Kong in change. 4x 100 Kong notes, 1x 50 Kong note and 2x 20 Kong notes...etc.

How do you expect to get this into the market? And what market do you expect to get this into?

Cash has an inherent agreement as to locality. When I'm in Australia, I use Australian dollars, when in the US, they have US dollars.

Though you may be solving this problem, I can use Kong everywhere, you need to somehow seed the market. How do you see that happening?

As you state, crypto is mostly a store of value atm. The benefit of not having physical crypto is that, in theory, I can trade my crypto for goods anywhere in the world. How will having a physical currency solve for this?

I went to my corner store at about 10:30 a few weeks ago to pick up a late dinner. I took out cash to pay, and the guy behind the register had already entered my purchase into his FPOS (credit card) machine. He looked at me and said "wow...old school. First time I've seen cash all day". You clearly feel that you are not fighting against a dying mode of payment, what makes you believe that? Or is there a piece I am missing?

I use almost exclusively cash and never get that response. Usually a smile as I sail out of the cashiers way faster than our abrtion of a chip+pin system customers possibly could. What part of the world are you in?

Much of the world has contactless payment (no pin, no physical card insertion).

It is more or less instant. Common in .au, .nz at least.

I'm actually noticing some cultural changes as a result of this, cash is starting to seem "dirty" since you often have to touch other people's hands to exchange it.

Pay with a card at a busy bar in the UK 15 years ago and everyone would sigh as the barman reached for the card terminal, did his thing, waited for you to type in your pin, etc etc. Paying with cash was far quicker.

Pay with cash at a bar now and everyone will sigh as the barman counts it up, puts it in the till etc etc. Contactless is so fast, the barman will be pouring the next drinks while you're tapping the machine.

Also anecdotally, many London cafes/restaurants are entirely card payments now. They just don't do cash.

Yeah I’m in NYC and I find it frustrating when people force a bartender to deal with cash at a busy spot.

Can they even not accept cash? It’s legal tender anywhere in the UK right?

Of course, why wouldn't they?

Because bills and cash are the cornerstone of all in-person payments? I honestly have a hard time imagining it as a secondary form of payment.

People are allowed to refuse cash for goods and services whenever they want for pretty much any reason other than discriminating against a protected class of people, including not wanting to handle cash as a form of payment. Amongst other things, this allows ecommerce to exist.

The legal tender laws just mean that if you offer a sufficient quantity of legal tender in settlement of debt, your debt is discharged and they can't sue you for non-payment. This ensures cash has value, and means that most shops will take most forms of cash, even if it means queueing up for counter service because the kiosks are card only

Legal tender is only required to be accepted for debts already incurred.

For instance, if you are at the bar and they pour you 3 drinks then ask for payment, they have to take your cash.

On the other hand if you are at the bar and, ask for a drink, and they say that'll be $10, they are not required to take your cash (the debt has yet to be incurred) and are also of course not required to provide you that drink if you pull out a $10 bill.

Not OP, but I can vouch that this is a common occurrence now in Australia. Contactless payment is now so ubiquitous, when you go to pay with cash it's often received with surprise. The vendor has indeed already readied the EFTPOS machine for your payment, and has to cancel that and put the transaction through as cash.

Only last year I always carried cash. I like cash. Now, I have a $10 note in my wallet and I can't even remember where it came from. I've stopped actually carrying my wallet, thanks to Apple Pay on my watch.

(I live in a major metropolitan area. It might be different elsewhere.)

Yesterday I bought coffee in a place that doesn't accept cash. Tapping a card is always faster than paying cash in my experience.

I'm in Australia, so we just have tap, only need to enter a pin for large purchases.

I just spent a few months in the US and didn't use cash once (LA, SF, NYC).

I went to many places that no longer accepted cash in the US, maybe we're just in different areas.

> To date we’ve handed out close to 2,500 Kong notes; we’re now exploring more ways to distribute physical crypto.

Are you in a non extradition treaty country? This could be a relevant question for you soon enough

Hi,

I love this. I have been wanting something like this for a while. Personally, I desired a coin instead of a bill. 2-3CM thick coin made with material good for radio security and longevity would be neat. A phsyical 'coin'. Any plans for something like that? Any reasoning against it?

What's the value of 1 Kong in USD, showing that would be helpful on your website front page.

Kong is very new. Only a few thousand are out there. Frustratingly, or perhaps amusingly, it doesn't yet have an agreed upon value. I don't think it's appropriate for us to set one.

Uh, well, then how do you know what denominations to print? What if the exchange rate ends up by 10,000 Kong per dollar? Are you going to issue Zimbabwe-style bills? What about as the exchange rate fluctuates wildly?

Lol, might as well use monopoly money then.

Which "secure computing element" are you using?

From the description I suspect it's a standard smartcard chip of the type used in SIM, EMV, and other access control/authentication cards.