Bitcoin
Apurely peer-to-peer version of electronic cash would permit payments to be sent directly from one party to another, without passing through a financial institution.
ART. I. Of Introduction. Commerce upon the internet has come to rely wholly upon financial institutions serving as trusted third parties. Yet this suffers the inherent weakness of the trust-based model: transactions remain reversible, mediation swells the cost of small dealings, and merchants must demand more of their customers than a transaction requires. What is wanted is an electronic payment founded upon cryptographic proof in the place of trust, permitting any two willing parties to transact directly, without need of an intermediary.
ART. II. Of Transactions. We define an electronic coin as a chain of digital signatures. Each owner transfers the coin to the next by signing a hash of the prior transaction together with the public key of the receiver, and appending these to the coin's end. A payee may verify the signatures to establish the chain of custody. The peril is that a payee cannot know an owner has not spent the coin twice; this we resolve without a mint, by public and singular agreement upon the order in which transactions were received.
ART. III. Of the Timestamp Server. Our solution commences with a timestamp server, which takes the hash of a block of items to be stamped and publishes that hash abroad. Each timestamp includes the one before it within its hash, forming a chain wherein every timestamp fortifies those that came before, and none may be altered in isolation.
ART. IV. Of Proof-of-Work. To raise a distributed timestamp server we employ a proof-of-work: the scanning for a value whose hash begins with a requisite number of zero bits. The labor once spent, a block cannot be changed but by its repetition; and as blocks are chained thereafter, to alter one is to redo all that follow. Thus is representation measured not by counting addresses, which one might multiply at will, but by proof-of-work: one processor, one vote.
ART. V. Of the Network. The network is run by these steps: new transactions are broadcast to all nodes; each node gathers them into a block; each labors to find the block's proof-of-work; the proof being found, the block is broadcast abroad; nodes accept the block only if its transactions be valid and unspent; and they signify their acceptance by laboring to build the next block upon it. The longest chain the nodes hold to be the true one, and thereon do they extend.
ART. VI. Of Incentive. By convention the first transaction of a block is a special one, creating a new coin owned by the maker of the block. This rewards nodes for their support and, wanting a central authority, disburses coins into circulation. The reward may be funded also by transaction fees. And once a predetermined number of coins have entered circulation, the incentive may pass wholly to such fees, and be entirely free of inflation. Such incentive may encourage honesty: should a greedy assailant command more power than all the honest nodes, he must choose between defrauding men of their payments and the honest generation of new coin, and shall find the rules the more profitable.
ART. VII. Of Reclaiming Disk Space. When the latest transaction of a coin lies buried beneath sufficient blocks, the spent transactions preceding it may be discarded to spare storage. That the block's hash be not thereby broken, transactions are hashed within a Merkle Tree, and only the root is entered into the block. Old blocks may then be compacted, their interior branches stubbed away, for they need not be kept.
ART. VIII. Of Simplified Payment Verification. A man may verify payments though he keep no full node. He need only hold the block headers of the longest chain, obtained by querying nodes until persuaded he holds the longest, and fetch the Merkle branch binding his transaction to the block wherein it was stamped. He cannot inspect the transaction himself, but seeing it bound to a place in the chain, he beholds that a node has accepted it, and blocks added thereafter confirm the network's assent.
ART. IX. Of Combining and Splitting Value. That value be managed apart from the handling of each coin one by one, transactions admit of many inputs and many outputs. Commonly there is a single input of a larger sum, or several inputs joining smaller sums; and no more than two outputs: one for the payment, and one, if any be needed, returning the change unto the sender.
ART. X. Of Privacy. The elder banking model preserved privacy by narrowing the sight of the parties and the trusted third party. Here privacy may yet be kept, though transactions be public, by holding the public keys anonymous. The world may see that some sum passes from one to another, but nothing binding the sum to any name. For each transaction let a fresh key-pair be used, that they be not traced to a common owner.
ART. XI. Of Calculations. Consider an assailant who would fashion a chain swifter than the honest one. He cannot conjure value from nothing, nor seize coin that was never his, for nodes will not accept an invalid transaction. His hope is only to reclaim his own late payment; and the probability that he ever overtakes the honest chain falls away exponentially with every block that is laid upon it.
ART. XII. Of Conclusion. We have set forth a system of electronic transaction that leans not upon trust. Beginning with coins made of digital signatures, we proposed a peer-to-peer network recording the public history of transactions in proof-of-work, soon rendering it beyond an assailant's power to alter, should honest nodes command the greater strength. The network is robust in its unstructured simplicity: nodes work all at once with little coordination, needing no identity, free to leave and rejoin at will, accepting the proof-of-work chain as witness of what passed in their absence. They vote with their processing power, and any rules and rewards required may be enforced by this consensus.