我对 Tim May 的密码无政府主义深感着迷。与通常和“无政府”一词联系在一起的社群不同，在密码无政府主义中，政府不是暂时被推翻，而是永远不被允许存在，也永远没有存在的必要。在这样的社群里，暴力威胁不起作用，因为暴力根本无法实施；而暴力之所以无法实施，是因为无法把参与者与其真实姓名或实际所在地联系起来。
I am fascinated by Tim May's crypto-anarchy. Unlike the communities traditionally associated with the word "anarchy", in a crypto-anarchy the government is not temporarily destroyed but permanently forbidden and permanently unnecessary. It's a community where the threat of violence is impotent because violence is impossible, and violence is impossible because its participants cannot be linked to their true names or physical locations.
到目前为止，即使在理论上，这样一个社群如何运作也还不清楚。社群以参与者之间的合作为基础，而高效合作需要一种交换媒介（货币），以及执行合约的办法。传统上，这些服务由政府或政府支持的机构提供，而且只向法律认可的主体提供。本文将描述一种协议，使不可追踪的主体既能获得这些服务，也能提供这些服务。
Until now it's not clear, even theoretically, how such a community could operate. A community is defined by the cooperation of its participants, and efficient cooperation requires a medium of exchange (money) and a way to enforce contracts. Traditionally these services have been provided by the government or government sponsored institutions and only to legal entities. In this article I describe a protocol by which these services can be provided to and by untraceable entities.
实际上，我将描述两种协议。第一种并不实用，因为它大量依赖一个同步且无法被干扰的匿名广播信道。不过，它将为第二种更实用的协议提供思路。在这两种情况下，我都假设存在一个不可追踪的网络，发送者和接收者仅由数字假名（即公钥）标识，每条消息都由发送者签名，并用接收者的公钥加密。
I will actually describe two protocols. The first one is impractical, because it makes heavy use of a synchronous and unjammable anonymous broadcast channel. However it will motivate the second, more practical protocol. In both cases I will assume the existence of an untraceable network, where senders and receivers are identified only by digital pseudonyms (i.e. public keys) and every messages is signed by its sender and encrypted to its receiver.
在第一种协议中，每个参与者各自维护一份数据库，记录每个假名拥有多少钱。这些账户共同确定货币的所有权，而本协议要说明的，就是如何更新这些账户。
In the first protocol, every participant maintains a (seperate) database of how much money belongs to each pseudonym. These accounts collectively define the ownership of money, and how these accounts are updated is the subject of this protocol.
1. 货币的创建。任何人都可以通过广播一个此前尚未解决的计算问题的解答来创造货币。条件只有两个：必须容易确定解决该问题付出了多少计算工作；而且，除了这一点，该解答不能具有其他实际价值或知识价值。所创建的货币单位数量，等于这项计算工作以一篮子标准商品衡量的成本。例如，用最经济的计算机解决某个问题需要 100 小时，而在公开市场上购买这台计算机 100 小时的计算时间需要花费 3 篮标准商品，那么，当解答被广播时，所有人都会在广播者的账户上增加 3 个货币单位。
1. The creation of money. Anyone can create money by broadcasting the solution to a previously unsolved computational problem. The only conditions are that it must be easy to determine how much computing effort it took to solve the problem and the solution must otherwise have no value, either practical or intellectual. The number of monetary units created is equal to the cost of the computing effort in terms of a standard basket of commodities. For example if a problem takes 100 hours to solve on the computer that solves it most economically, and it takes 3 standard baskets to purchase 100 hours of computing time on that computer on the open market, then upon the broadcast of the solution to that problem everyone credits the broadcaster's account by 3 units.
2. 货币的转移。如果 Alice（假名 K_A 的所有者）想向 Bob（假名 K_B 的所有者）转移 X 个货币单位，她就广播一条由 K_A 签名的消息：“我给 K_B X 个货币单位。”这条消息广播后，所有人都会从 K_A 的账户扣除 X 个单位，并在 K_B 的账户增加 X 个单位；但如果这样会使 K_A 的账户余额变为负数，就忽略这条消息。
2. The transfer of money. If Alice (owner of pseudonym K_A) wishes to transfer X units of money to Bob (owner of pseudonym K_B), she broadcasts the message "I give X units of money to K_B" signed by K_A. Upon the broadcast of this message, everyone debits K_A's account by X units and credits K_B's account by X units, unless this would create a negative balance in K_A's account in which case the message is ignored.
3. 合约的生效。一份有效合约必须写明每个缔约方违约时承担的最高赔偿额。合约还应指定一方，在发生争议时负责仲裁。包括仲裁者在内，合约各方都必须广播自己对合约的签名，合约才能生效。合约和全部签名广播后，每个参与者都会从各方账户中扣除其最高赔偿额，并将这些最高赔偿额的总和记入一个专用账户；该账户由合约的安全哈希值标识。如果各方的扣款均成功，且没有产生负余额，合约便生效；否则就忽略该合约，并将账户恢复到此前状态。一份合约示例可以是：
3. The effecting of contracts. A valid contract must include a maximum reparation in case of default for each participant party to it. It should also include a party who will perform arbitration should there be a dispute. All parties to a contract including the arbitrator must broadcast their signatures of it before it becomes effective. Upon the broadcast of the contract and all signatures, every participant debits the account of each party by the amount of his maximum reparation and credits a special account identified by a secure hash of the contract by the sum the maximum reparations. The contract becomes effective if the debits succeed for every party without producing a negative balance, otherwise the contract is ignored and the accounts are rolled back. A sample contract might look like this:
K_A 同意在 0:0:0 1/1/2000 之前，将问题 P 的解答发送给 K_B。K_B 同意在 0:0:0 1/1/2000 之前，向 K_A 支付 100 MU（货币单位）。K_C 同意在发生争议时进行仲裁。K_A 同意在违约时最多支付 1000 MU。K_B 同意在违约时最多支付 200 MU。K_C 同意在违约时最多支付 500 MU。
K_A agrees to send K_B the solution to problem P before 0:0:0 1/1/2000. K_B agrees to pay K_A 100 MU (monetary units) before 0:0:0 1/1/2000. K_C agrees to perform arbitration in case of dispute. K_A agrees to pay a maximum of 1000 MU in case of default. K_B agrees to pay a maximum of 200 MU in case of default. K_C agrees to pay a maximum of 500 MU in case of default.
4. 合约的结束。如果合约在没有争议的情况下结束，各方都广播一条签名消息：“SHA-1 哈希值为 H 的合约结束，无须赔偿。”也可以是：“SHA-1 哈希值为 H 的合约结束，赔偿安排如下：……”全部签名广播后，每个参与者都会将各方的最高赔偿额返还到各自账户，移除合约账户；如果存在赔偿安排，再据此增加或扣减各方账户中的金额。
4. The conclusion of contracts. If a contract concludes without dispute, each party broadcasts a signed message "The contract with SHA-1 hash H concludes without reparations." or possibly "The contract with SHA-1 hash H concludes with the following reparations: ..." Upon the broadcast of all signatures, every participant credits the account of each party by the amount of his maximum reparation, removes the contract account, then credits or debits the account of each party according to the reparation schedule if there is one.
5. 合约的执行。即使有仲裁者协助，合约各方若仍无法就合适的结束方式达成一致，各方就分别广播自己建议的赔偿／罚款方案，以及有利于自己的论点或证据。每个参与者自行决定实际的赔偿和／或罚款，并据此修改自己维护的账户记录。
5. The enforcement of contracts. If the parties to a contract cannot agree on an appropriate conclusion even with the help of the arbitrator, each party broadcasts a suggested reparation/fine schedule and any arguments or evidence in his favor. Each participant makes a determination as to the actual reparations and/or fines, and modifies his accounts accordingly.
在第二种协议中，谁拥有多少钱的账户记录不再由所有人保存，而是由一部分参与者保存，以下称他们为服务器。这些服务器通过一个类似 Usenet 的广播信道连接起来。在该信道上广播的交易消息，格式与第一种协议相同；不过，每笔交易涉及的参与者都应随机选取一部分服务器，核实消息已被接收并成功处理。
In the second protocol, the accounts of who has how much money are kept by a subset of the participants (called servers from now on) instead of everyone. These servers are linked by a Usenet-style broadcast channel. The format of transaction messages broadcasted on this channel remain the same as in the first protocol, but the affected participants of each transaction should verify that the message has been received and successfully processed by a randomly selected subset of the servers.
由于必须在一定程度上信任服务器，就需要某种机制促使它们诚实运作。每台服务器都必须向一个专用账户存入一定金额，以备受到处罚，或在有人提供其不当行为证据时用作奖励。此外，每台服务器都必须定期公开其当前的货币创建数据库和货币所有权数据库，并对所公布的内容作出承诺。每个参与者都应检查自己的账户余额是否正确，以及所有账户的余额总和是否超过已创建的货币总量。这可以防止服务器永久且无成本地扩大货币供应，即使所有服务器串通也不例外。新服务器还可以使用公开的数据库，与已有服务器同步。
Since the servers must be trusted to a degree, some mechanism is needed to keep them honest. Each server is required to deposit a certain amount of money in a special account to be used as potential fines or rewards for proof of misconduct. Also, each server must periodically publish and commit to its current money creation and money ownership databases. Each participant should verify that his own account balances are correct and that the sum of the account balances is not greater than the total amount of money created. This prevents the servers, even in total collusion, from permanently and costlessly expanding the money supply. New servers can also use the published databases to synchronize with existing servers.
本文提出的协议，通过提供交换媒介和执行合约的方法，让不可追踪、使用假名的主体能够更高效地合作。这个协议或许还能变得更加高效、安全，但我希望它能向前迈出一步，使密码无政府主义不仅在理论上可能，也在实践中成为可能。
The protocol proposed in this article allows untraceable pseudonymous entities to cooperate with each other more efficiently, by providing them with a medium of exchange and a method of enforcing contracts. The protocol can probably be made more efficient and secure, but I hope this is a step toward making crypto-anarchy a practical as well as theoretical possibility.
附录 A：另一种 b-money 创建方式
Appendix A: alternative b-money creation
b-money 协议中较难处理的部分之一，是货币创建。这部分协议要求所有记账者就某些计算的成本作出判断，并达成一致。遗憾的是，计算技术通常进步迅速，而且进展并不总是公开，因此这些信息可能无法获得、不准确或已经过时，而这些情况都会给协议带来严重问题。
One of the more problematic parts in the b-money protocol is money creation. This part of the protocol requires that all of the account keepers decide and agree on the cost of particular computations. Unfortunately because computing technology tends to advance rapidly and not always publicly, this information may be unavailable, inaccurate, or outdated, all of which would cause serious problems for the protocol.
因此，我提出另一种货币创建子协议：由记账者（第一种协议中的所有人，或第二种协议中的服务器）改为决定每个周期要创建多少 b-money，并就此达成一致；创建这些货币的成本则由拍卖决定。每个货币创建周期分为以下四个阶段：
So I propose an alternative money creation subprotocol, in which account keepers (everyone in the first protocol, or the servers in the second protocol) instead decide and agree on the amount of b-money to be created each period, with the cost of creating that money determined by an auction. Each money creation period is divided up into four phases, as follows:
1. 规划。记账者进行计算并相互协商，确定下一个周期最合适的货币供应增量。无论能否达成共识，每个记账者都广播自己的货币创建配额，以及为支持这些数值而进行的任何宏观经济计算。
1. Planning. The account keepers compute and negotiate with each other to determine an optimal increase in the money supply for the next period. Whether or not the account keepers can reach a consensus, they each broadcast their money creation quota and any macroeconomic calculations done to support the figures.
2. 出价。任何想创建 b-money 的人都可以广播一个形式为 <x, y> 的出价，其中 x 是他想创建的 b-money 数量，y 是某个预先确定的问题类别中尚未解决的问题。该类别中的每个问题都应有一个公开商定的名义成本，例如以 MIPS-years 衡量。
2. Bidding. Anyone who wants to create b-money broadcasts a bid in the form of <x, y> where x is the amount of b-money he wants to create, and y is an unsolved problem from a predetermined problem class. Each problem in this class should have a nominal cost (in MIPS-years say) which is publicly agreed on.
3. 计算。看到出价之后，在出价阶段提交了报价的人便可以解决自己报价中的问题，并广播解答。
3. Computation. After seeing the bids, the ones who placed bids in the bidding phase may now solve the problems in their bids and broadcast the solutions.
4. 货币创建。每个记账者只考虑已经广播解答的出价，按每创建一单位 b-money 所对应的名义成本，选择最高的出价，并据此增加出价者的账户余额。
4. Money creation. Each account keeper accepts the highest bids (among those who actually broadcasted solutions) in terms of nominal cost per unit of b-money created and credits the bidders' accounts accordingly.