Chaum "coins" behave a lot more like bearer instruments or "free banking" notes; they're IOUs issued by a bank that can be traded.
The advantage over a database is that there's some ability to do offline transactions, although the double-spend prevention is done through the originating bank.
The advantage over bitcoin is that is uses a tiny fraction of the energy. It's also naturally a "stablecoin", rather than highly volatile.
Also, double-spending detection can be defined in several ways. My view is that the best definition includes the no-frame-up property and the "full tracing" property. A system that supports full tracing allows a cheating user to be blacklisted completely, since the double spending detection procedure produces a value that can be used to check if any coin was spent by the cheating user (basically, users have secret keys they use to spend; double-spending will reveal the secret key used for double spending). This is a nice property because it allows the bank to issue blacklists of cheating users, which are enforced by the bank's refusal to accept any coins that were spent by that user (even those not double spent), and thus no other party is willing to accept payments from blacklisted users since the coins are effectively worthless (as the bank will not accept them for deposit). In other words there is a meaningful way to punish a cheating user.
Finally, there is no reason these systems must naturally be "stablecoins." The bank need not peg the coin's value to anything, it can float freely like any other currency and the bank can choose any monetary policy, including one that results in significant volatility. The bank could even emulate Bitcoin by setting a fixed limit on coins in circulation (the different between the number of withdrawals and number of deposits) and periodically releasing more coins (maybe giving them in fixed amounts to randomly chosen users to simulate mining). If the coins did have stable values or were pegged to a currency with stable value, that would only be because the bank itself thought it was a good idea (perhaps in response to customer demand), not because there is something inherent in ecash that promotes stability.
That property consequently allows a bank to black list any user, not just cheating users. There are many situations where that can be not so nice. In bitcoin, cheating isn't even feasible. It's better to prevent cheating entirely than to black list cheaters after the fact.
Also, this may seem pedantic, but cheating is entirely feasible in Bitcoin. In Bitcoin the honest users must perform more computation than the attackers, but that means that an attack must be feasible (as the effort of honest users must be feasible for anyone to use the system).
Bitcoin on the other hand is, at best, pseudonymous. This is particularly problematic because it gives information about true identities when the owner of coins wants to spend it in any way on anything where bitcoin is not an accepted form of payment. Then, the "off ramp" becomes much more closely associated with the owner of the coins.
Heck, even in a world where on-ramps & off-ramps to bitcoin weren't necessary because everyone used bitcoin this would still be problematic: An address suspected of holding coins obtained through illegal enterprise pays a car dealership in bitcoins for a new car, and the authorities simply go to the dealership with a warrant and say "tells us everything you possibly can about that transaction and the people involved in the purchase & delivery of that vehicle".
There's nothing stopping governments from shutting it down either. The US by itself could practically take it down alone (or any other crypto) by banning US banks from working with it, or from working with any non-US bank that that deals with bitcoin. No need for a 51% attack, no need to track electricity usage to locate potential miners, just a simple piece of legislation. Or even simpler, an executive order issuing the same ban, stating that bitcoin enables significant financial activity by terrorists & criminals.
Or, at least not the same 3rd parties. Instead, it requires trusting a much larger host of other 3rd parties, many of which are anonymous, and likely none of which will provide recourse if you lose your bitcoin due to their failure or malicious intent.[1]
Bitcoin represents a shifting of trust; not an elimination of trust. That's not to say there is no value. It's just that there are significant risks involving trust that are overlooked by most holders.
[1] https://www.schneier.com/blog/archives/2019/02/blockchain_an...
As trust is spread across the network to an increasing number of people running nodes, the trust assigned to any individual participant approaches zero.
This can be observed in the resilience of the network, as it self-heals against any attacker or alternative fork from the consensus.
Bitcoin has democratically ossified into a store-of-value with absolute scarcity, deterministic monetary policy, and a priority on decentralization. It's extremely unlikely that those attributes will be compromised.
If only we knew this was true.
An increase in the number of people running nodes does not guarantee that the maximum trust assigned to any individual participant approaches zero. What is the size of the largest Bitcoin whale? What is the size of the largest Bitcoin cartel? How do you know that the share of the largest Bitcoin whale or cartel isn’t increasing? What prevents China from deciding to eliminate the Bitcoin threat to its control by taking over the Chinese miners and launching a 51% attack?
Even if you are willing to believe that trust is well distributed across many independent entities, you still need to have greater trust in your own security and IT skills. When your wallet is hacked or you lose your credentials, there’s no number to call to recover your Bitcoin.
Bitcoin still requires significant trust, which is often overlooked.
China isn’t stupid.
If they 51% attacked Bitcoin (completely contrary to their self interest), everyone would switch to a different hash algorithm and now China has burned tens of billions of capital, hurt their reputation, and achieved nothing.
China just launched its own digital currency.[1]
“In order to protect our currency sovereignty and legal currency status, we have to plan ahead,” said Mu Changchun, who is shepherding the project at the People’s Bank of China.
China isn’t the only major power that needs to monitor transactions and maintain control of its money supply. There are plenty of capable parties that could launch a 51% attack and they’re unlikely to take responsibility for it afterwards, so reputation is hardly a factor. The fact that another hash algorithm could be used later doesn’t matter. A government doesn’t stop defending its interests just because threats change.
Certainly, there may never be a 51% attack, but it will not be surprising if it happens.
[1] https://www.wsj.com/articles/china-creates-its-own-digital-c...
Further, while this article is about 2 years old, it indicates that many miners use outdated software that may have vulnerabilities. [0] Even assuming those expressed in the article have resolved, it may very well be the case that similar proportions of miners today aren't running the most recent software & are vulnerable to newer attacks.
Finally, while bitcoin may have ossified, I don't think that is has done so as a store of value (at least not year). A solid store of value should not fluctuate in value by 5%, 10%, 15% on a fairly regular basis.
If I wanted a good store of value, I would still be looking at the traditional option of gold or, at least over the long-term, real estate. Though I suppose if the world economic system every goes belly up, neither bitcoin, gold, or real estate will be of much use. In that case, the best store of value would be long-term shelf-stable food.
[0] https://thenextweb.com/news/bitcoin-100000-nodes-vulnerable-...
What do you think it should look like when an asset monetizes from nothing to one of the world’s largest assets in under 15 years? A nice smooth geometric curve?
Perhaps some hype artists would claim otherwise, but they shouldn't be defining how you view the technology itself.
It is also wrong to suggest that the bank in Chaum's system is a "trusted third party," as if the bank can unilaterally break any security property of the system. In fact the bank in an ecash system is very much constrained. The bank cannot violate a user's privacy (in the sense of linking a user's transactions) unless the user attempts to spend the same coin twice. The bank's ability to claim that a user was trying to conduct some kind of double-spending attack is also constrained (the no-frame-ups property) so that a user must actually attempt to double spend a coin for the bank to produce evidence of such a crime. It is also possible to create a distributed trust model where several parties must jointly issue the coins (threshold blind signatures).
Unlike Bitcoin, the security model of ecash is well-defined and follows the basic philosophy of cryptographic security: the computational difficult of attacking the system grows exponentially with the computational work performed by honest parties. Put another way, the energy expended in an ecash system will grow linearly with the number of transactions being performed in the system, and the incentive is to reduce the energy consumption by finding more efficient ways to process transactions. If the cost of a well-defined, rigorous security model, a system that incentivizes minimizing energy consumption, and features that Bitcoin can never actually support (e.g. direct peer-to-peer payments that do not require an Internet connection or any communication with any third parties), is to have a central bank or consortium of banks that issues the coins, you can count me in.
Nope, try again
Moreover, why assume that the attacker will necessarily have to work as hard as the total work being done by honest miners, when the attacker might first try to take down the largest miners as a first step to reduce the capital investment? Blackouts in China significantly reduced the hashrate of several large mining pools recently. An attacker willing to invest tens of billions of dollars in an attack would have little difficulty sabotaging mining operations, especially given how concentrated and centralized those operations have become.
Really though, in what other context would we accept an argument that comes down to assumptions about what an attacker is willing to do? Cryptographic security demands that the attack effort grows exponentially (or super-polynomial in the case of public key cryptography) so that we can make the attack effort larger than the number of atoms on our planet (or galaxy or universe), which renders all speculation on the attacker's motives or willingness to invest an attack moot. With Bitcoin you can never make such a claim until most of the world's available energy is consumed by honest miners (the only point at which the attack is actually impossible, at least if we assume that the honest parties cannot be corrupted).
If you are assuming that the attackers are also hiding "dark" mining capacity, then it's harder to say what capacity you would need to stop an attack, but they would be choosing not to run that hardware at a significant opportunity cost for no reason other than to create a false sense of security.
You seem to be implying that this is a strange model but I don't think so. It's no different from how you won't know how big of a military you need until after you get attacked. Your opponents could be hiding their military capacity. Etc. It's not clear that it is possible to avoid this problem in any trustless system.
It is also worth remembering that someone trying to attack Bitcoin is not limited to amassing enough of their own mining equipment; they can also try to reduce the work being done by honest miners by sabotaging honest mining operations, which at some point will likely be cheaper than trying to buy more mining rigs. So the honest miners need to do more than just match their own estimate of the capacity of would-be attackers. Honest miners must exceed attackers by enough of a margin to absorb attempts by an attacker to reduce the honest mining capacity, and that margin is also difficult to estimate.
I do not know what counts as "strange" but I certainly say that Bitcoin's security model is inefficient and backward by the standard used in cryptography. Honest parties have no advantage over the attacker and thus are left devoting ever growing amounts of energy to mining, continuously raising the bar for the attacker (and also raising transaction costs to pay for all that energy, not to mention creating an environmental disaster in the process). No competent military commander would pursue a strategy that depends purely on numerical superiority; armies set up bases in locations that are tactically advantageous (e.g. on a hilltop) and focus their planning (offensive or defensive) on strategically valuable targets (bridges, supply lines, etc.).
Cryptography tries to avoid speculating on the attacker's motivation, but establishing trust from nothing is a different problem than sending private messages on a public channel. It's not clear the former can be done any other way than by creating incentive structures to make the cost of cheating greater than some known amount.
> Honest parties have no advantage over the attacker
Honest parties have the advantage that it's easier for them to agree (and they are rewarded for agreeing). An honest party who wants to play honestly is implicitly supported by every other honest party whether they are explicitly allied or not. Whereas a dishonest party doesn't just need to be dishonest to benefit, they need to get >50% of all miners to agree to benefit them specifically, or otherwise amass all that capacity just for themselves while outcompeting every other honest party put together (not just their specific enemy, but every honest party).
> and thus are left devoting ever growing amounts of energy to mining, continuously raising the bar for the attacker
Why would the energy usage be "ever growing"? Bitcoin might become more popular and therefore might have bigger security demands expected of it in the future, but that should eventually reach a cap. From that point only cheapening electricity generation would increase the expected usage.
> No competent military commander would pursue a strategy that depends purely on numerical superiority;
That is certainly what they'd do if there was literally no other way to achieve an advantage (which is the case in this kind of landscape). Everything else is just a way to make their forces work more efficiently.
"Honest parties have the advantage that it's easier for them to agree (and they are rewarded for agreeing)."
I should clarify that when I used the term "advantage" I was referring to something analogous to mechanical advantage. A basic tenet of cryptographic security definitions is that the honest parties should have an advantage over the attackers in the sense that a small increase the work done by the honest parties results in a large increase in the work that must be done to attack the system. Note also that cryptographic security definitions assume the opposite of what you said: that the honest parties are not coordinated and are operated independently, but that the attackers do coordinate with each other (in fact we just refer to "the adversary" which has full control over all the attacking parties, with full access to their internal state, inputs, outputs, randomness, and whatever else).
You mention incentive structures, but incentive structures are not very reliable. You need to make a lot of assumptions about motivation before an incentive structure makes sense, and those assumptions can easily fail because of something external to the system. What if a group of miners who collectively control 51% of the mining capacity of Bitcoin realized that they could open short positions in Bitcoin futures and make a fortune if they triggered a panic by e.g. executing very obvious double-spending attacks? Historically incentive structures have failed to prevent wars, crime, and other unwanted behaviors.
"Bitcoin might become more popular and therefore might have bigger security demands"
One does not follow from the other. Security requirements have nothing to do with popularity and everything to do with the ability of some attacker to succeed in attacking a system. Even if nothing about Bitcoin changes, a change elsewhere in the world may create an opportunity to profit from attacking Bitcoin (and there is no reason to think anyone other than the attacker would be aware of that opportunity). The attacker may not be rational at all; maybe the attacker just wants to create chaos, even at great expense. Like I said, incentive structures are unreliable and make for a poor approach to security on the Internet.
I think a more accurate claim would be that cryptography aims to achieve the best security guarantees that can be assured mathematically. In the case of establishing consensus the best guarantees you can achieve are just different from what you can achieve in those other situations. That doesn't mean that Bitcoin is somehow going against some kind of cryptographic standard like you are implying here. It is using cryptographic technologies to achieve the most secure possible solution (as far as we have discovered) to the problem which it aims to solve. It just happens to be a different problem than those other problems and therefore the nature of the solution is different.
> Note also that cryptographic security definitions assume ... that the attackers do coordinate with each other
That's just one possible scenario which you might consider. Again I think it is misleading to imply this is some kind of "cryptographic litmus test" or something.
> You mention incentive structures, but incentive structures are not very reliable.
Right, but there's just no stronger guarantees which you can make when it comes to this problem.
> One does not follow from the other. Security requirements have nothing to do with popularity and everything to do with the ability of some attacker to succeed in attacking a system.
I think you are interpreting what I said backwards. Popularity defines what level of security is required. The level of security defines what attacks can be resisted. The more popular the coin, the bigger need it will have to resist attacks. And this is accommodated in the design: the higher the market price of the coin, the bigger the reward will be for miners (thus funding more mining, increasing the cost of an attack).