Chaum, DigiCash and the First Digital Cash

Cash has a property so familiar that we rarely notice it. When you pay with a coin, the coin does not record who you are, and the shopkeeper who receives it cannot learn where it has been. Electronic payments are different. A card payment or a bank transfer leaves a record linking payer, payee, amount and time. Collect enough of those records and you have a detailed portrait of a person’s life.

In the early 1980s, when electronic payments were still a minor part of daily life, a graduate student in computer science at the University of California, Berkeley, saw this coming and decided to do something about it. His name was David Chaum.

A cryptographer worried about records

Chaum’s first major paper, published in 1981, was not about money at all. It described a way of sending electronic mail so that no observer of the network could tell who was writing to whom. Messages were wrapped in layers of encryption and passed through a series of relays, each of which removed one layer and shuffled the messages before passing them on. This idea, the mix network, became the ancestor of many later tools for private communication.

The same concern drove his work on payments. In a 1985 article in Communications of the ACM, whose subtitle spoke of transaction systems to make Big Brother obsolete, Chaum argued that the computerisation of everyday transactions would, by default, create an unprecedented capacity for surveillance. He proposed instead systems in which individuals could prove what they needed to prove, for instance that they had paid, without revealing who they were.

The blind signature

The key invention was the blind signature, which Chaum presented at the CRYPTO conference in 1982 and published the following year. An ordinary digital signature lets a signer, such as a bank, certify a message so that anyone can check that the bank really signed it. A blind signature adds a twist: the signer signs a message without seeing its content.

Chaum explained the idea with a paper analogy. Imagine putting a document inside an envelope lined with carbon paper and asking someone to sign the outside of the envelope. The signature passes through the carbon onto the document. When you open the envelope, you have a signed document, but the signer never saw what it said.

How a blind coin works

Applied to money, the scheme works roughly like this. A customer’s software creates a random serial number for a new digital coin and disguises it mathematically, the equivalent of putting it in the carbon-lined envelope. The bank signs the disguised coin with a key that means, say, one unit of value, and reduces the customer’s account accordingly. The customer’s software then removes the disguise, leaving a coin with a valid bank signature on a serial number the bank has never seen.

When the customer pays a shop, the shop sends the coin to the bank. The bank checks that the signature is genuine and that this serial number has not been spent before, then credits the shop. Because the bank never saw the serial number when it signed, it cannot connect the coin it is now receiving to the customer who withdrew it. The payer is anonymous; the shop, which deposits the coin, is not.

The double-spending problem

Digital information can be copied perfectly. A file representing a coin can be duplicated as easily as any other file. What stops someone spending the same digital coin twice? In Chaum’s first design, the answer was the bank’s list of spent serial numbers. Every payment had to be checked against that list at the moment it was made, so the system had to be online.

In 1988 Chaum, together with the cryptographers Amos Fiat and Moni Naor, described an ingenious alternative. Coins could be built so that spending one once revealed nothing about the spender, but spending the same coin twice would reveal the cheater’s identity when the bank compared the two deposits. Honest users kept their privacy; dishonest ones exposed themselves. The double-spending problem would remain the central puzzle of digital cash for the next twenty years.

Beyond coins: credentials

Chaum’s 1985 article went well beyond payments. He imagined a world in which a person would use a different pseudonym with each organisation they dealt with: one with their bank, another with their employer, another with a library or a hospital. Each organisation would know only the pseudonym used with it, so records held by different organisations could not easily be linked into a single profile.

The difficulty is that organisations often need to know facts established elsewhere. A shop may need to know that a customer is old enough to make a purchase; a lender may want to know that a borrower has repaid earlier loans. Chaum proposed credentials that could be issued to one pseudonym and shown under another, using techniques related to blind signatures, so that a person could prove a fact about themselves without revealing which other records belonged to them.

This idea of proving a property without exposing an identity has had a long life. Later researchers developed it into anonymous credential systems, and related techniques, such as zero-knowledge proofs, are now studied for digital identity documents. In this sense, eCash was only one application of a broader programme: to design the information systems of a digital society so that privacy was built in from the start rather than added later.

DigiCash

Chaum moved to Amsterdam, where he worked at the Dutch national research centre for mathematics and computer science, and in 1989 he founded a company, DigiCash, to turn his ideas into products. Its system, called eCash, let users hold digital coins in software on their computers and spend them on the young World Wide Web.

DigiCash ran a public trial in the mid-1990s and then licensed its technology to banks. In 1995, Mark Twain Bank in St. Louis, Missouri, began offering eCash to its customers, the first bank in the United States to do so. A handful of other banks in Europe and Australia followed with their own trials. For a moment, it looked as if private digital cash might become a normal part of the internet.

Why it did not take hold

It did not. The number of users stayed small; merchants saw little reason to accept a payment method few customers had; banks were cautious about a system that could weaken their view of customers’ transactions. Meanwhile, the web developed secure connections for sending card details, and card payments online became the default. In 1998 DigiCash filed for bankruptcy.

Historians of the period, including Finn Brunton in Digital Cash (2019), point to a mixture of reasons: timing, business decisions, the difficulty of persuading banks to adopt a technology that reduced their own visibility, and the simple fact that most people were not yet worried about the records their payments created. Chaum’s privacy argument was ahead of its audience.

What Chaum left behind

There was also a structural limit. eCash protected the privacy of payers, but it relied entirely on a central issuer: the bank that signed the coins and kept the list of spent serial numbers. If the bank failed, or was ordered to stop, the system stopped. Users had to trust the bank to honour its coins, just as holders of a banknote had to trust its issuer.

For the cryptographers who came after, many of them gathered on the cypherpunks mailing list described in our next essay, this was the problem to solve. Chaum had shown that digital money could be private. The question now was whether it could also exist without a single trusted institution at its centre. The Bitcoin whitepaper of 2008, which proposed a way to prevent double-spending without a central bank, was written against that background, even though it does not cite Chaum by name.

Chaum himself went on to work on cryptographic voting systems, including one used in a municipal election in Takoma Park, Maryland, in 2009, and on further privacy technologies. His blind signature remains a standard tool in the cryptographer’s kit, and his 1985 warning about transaction records reads today less like a prophecy than a description.