很久以前，我想到了比特黄金这个构想。简单地说，问题在于：我们现在所用货币的价值，依赖于对第三方的信任。20 世纪发生的多次通货膨胀和恶性通货膨胀已经表明，这并不是理想的状态。同样，私人银行发行纸币虽然各有利弊，也依赖可信任的第三方。
A long time ago I hit upon the idea of bit gold. The problem, in a nutshell, is that our money currently depends on trust in a third party for its value. As many inflationary and hyperinflationary episodes during the 20th century demonstrated, this is not an ideal state of affairs. Similarly, private bank note issue, while it had various advantages as well as disadvantages, similarly depended on a trusted third party.
贵金属和收藏品由于生产成本高昂，具有无法伪造的稀缺性。这一度使货币的价值在很大程度上不依赖任何可信任的第三方。不过，贵金属也有问题：日常交易中反复检验金属的成色，成本太高。因此，人们引入了可信任的第三方，将标准数量的金属铸成带有印记的硬币；这一方通常与接受这些硬币缴税的收税者有关。运输价值巨大的金属也可能很不安全。第一次世界大战期间，英国为支撑金本位，把黄金运往加拿大，途中要穿越德国潜艇出没的大西洋，就体会到了这一点。更糟的是，你无法用金属在网上付款。
Precious metals and collectibles have an unforgeable scarcity due to the costliness of their creation. This once provided money the value of which was largely independent of any trusted third party. Precious metals have problems, however. It's too costly to assay metals repeatedly for common transactions. Thus a trusted third party (usually associated with a tax collector who accepted the coins as payment) was invoked to stamp a standard amount of the metal into a coin. Transporting large values of metal can be a rather insecure affair, as the British found when transporting gold across a U-boat infested Atlantic to Canada during World War I to support their gold standard. What's worse, you can't pay online with metal.
因此，如果存在这样一种协议，就会非常理想：它能让人们在网上生成成本无法伪造的比特，尽量减少对可信任第三方的依赖；之后，同样只需极少的信任，安全地保存、转让和检验这些比特。这就是比特黄金。
Thus, it would be very nice if there were a protocol whereby unforgeably costly bits could be created online with minimal dependence on trusted third parties, and then securely stored, transferred, and assayed with similar minimal trust. Bit gold.
我的比特黄金提案以这样一种计算为基础：从一串挑战比特计算出另一串比特，所用函数有时被称为“客户端谜题函数”“工作量证明函数”或“安全基准函数”。计算得到的比特串就是工作量证明。单向函数的逆向计算成本高得难以承受；相比之下，理想的安全基准函数，其逆向计算应有一个以计算周期衡量的特定成本。
My proposal for bit gold is based on computing a string of bits from a string of challenge bits, using functions called variously "client puzzle function," "proof of work function," or "secure benchmark function.". The resulting string of bits is the proof of work. Where a one-way function is prohibitively difficult to compute backwards, a secure benchmark function ideally comes with a specific cost, measured in compute cycles, to compute backwards.
以下是我设想的比特黄金系统的主要步骤：
Here are the main steps of the bit gold system that I envision:
（1）生成一个公开的比特串，称为“挑战串”（见第 5 步）。
(1) A public string of bits, the "challenge string," is created (see step 5).
（2）Alice 在自己的计算机上使用基准函数，根据挑战比特生成工作量证明比特串。
(2) Alice on her computer generates the proof of work string from the challenge bits using a benchmark function.
（3）为工作量证明加上安全的时间戳。这应以分布式方式进行，使用若干不同的时间戳服务，从而不必高度依赖其中任何一个服务。
(3) The proof of work is securely timestamped. This should work in a distributed fashion, with several different timestamp services so that no particular timestamp service need be substantially relied on.
（4）Alice 将挑战串和带时间戳的工作量证明比特串，加入比特黄金的分布式所有权登记系统。在这里，同样不必高度依赖任何一台服务器来保证登记系统正确运行。
(4) Alice adds the challenge string and the timestamped proof of work string to a distributed property title registryfor bit gold. Here, too, no single server is substantially relied on to properly operate the registry.
（5）最后生成的比特黄金比特串，为下一个比特串的生成提供挑战比特。
(5) The last-created string of bit gold provides the challenge bits for the next-created string.
（6）为了核实 Alice 是否拥有某个比特黄金比特串，Bob 检查比特黄金所有权登记系统中不可伪造的所有权链。
(6) To verify that Alice is the owner of a particular string of bit gold, Bob checks the unforgeable chain of title in the bit gold title registry.
（7）为了检验一个比特黄金比特串的价值，Bob 检查并验证挑战比特、工作量证明比特串和时间戳。
(7) To assay the value of a string of bit gold, Bob checks and verifies the challenge bits, the proof of work string, and the timestamp.
注意，Alice 对其比特黄金的控制，并不取决于这些比特是否仅由她持有，而在于所有权登记系统中不可伪造的所有权链（数字签名链）将她列为当前所有者。
Note that Alice's control over her bit gold does not depend on her sole possession of the bits, but rather on her lead position in the unforgeable chain of title (chain of digital signatures) in the title registry.
所有这些都可以由软件自动完成。这个方案的安全性主要受两点限制：第（3）和第（4）步能在多大程度上分散信任，以及下面将要讨论的计算机架构问题。
All of this can be automated by software. The main limits to the security of the scheme are how well trust can be distributed in steps (3) and (4), and the problem of machine architecture which will be discussed below.
Hal Finney 已经实现了一种名为 RPOW（可重复使用的工作量证明）的比特黄金变体。它依靠公开“铸币厂”的计算机代码，而这套代码运行在一台远程计算机上，对这台计算机的篡改会留下可察觉的痕迹。比特黄金的购买者随后可以使用远程证明，核实确实执行了特定数量的计算周期；Finney 将其称为“透明服务器”技术。
Hal Finney has implemented a variant of bit gold called RPOW (Reusable Proofs of Work). This relies on publishing the computer code for the "mint," which runs on a remote tamper-evident computer. The purchaser of of bit gold can then use remote attestation, which Finney calls the transparent server technique, to verify that a particular number of cycles were actually performed.
所有这些方案的主要问题在于：工作量证明方案依赖计算机架构，而不仅仅是建立在抽象“计算周期”之上的抽象数学。（几年前，我曾写过这个问题，但当时说得不够清楚。）因此，有人可能以低得多的成本——甚至低几个数量级——生产比特黄金，并让市场充斥其产品。不过，由于比特黄金带有时间戳，生成时间和计算工作的数学难度都可以自动验证。由此，通常可以推断出在那个时期生产它的成本。
The main problem with all these schemes is that proof of work schemes depend on computer architecture, not just an abstract mathematics based on an abstract "compute cycle." (I wrote about this obscurely several years ago.) Thus, it might be possible to be a very low cost producer (by several orders of magnitude) and swamp the market with bit gold. However, since bit gold is timestamped, the time created as well as the mathematical difficulty of the work can be automatically proven. From this, it can usually be inferred what the cost of producing during that time period was.
黄金原子可以互换，而比特黄金与收藏品更相似：某个时期的大量供应，会压低那一批物品的价值。在这方面，“比特黄金”更像收藏品，而不是黄金。不过，将这个后续交易市场与决定初始价值的拍卖相匹配，可能会让发明并部署优化计算机架构的“比特黄金矿工”获得非常可观的利润。
Unlike fungible atoms of gold, but as with collector's items, a large supply during a given time period will drive down the value of those particular items. In this respect "bit gold" acts more like collector's items than like gold. However, the match between this ex post market and the auction determining the initial value might create a very substantial profit for the "bit gold miner" who invents and deploys an optimized computer architecture.
因此，比特黄金不能仅凭一个简单函数——例如比特串长度的函数——就实现可互换性。相反，为了创建可互换的单位，交易商需要把价值不同的比特黄金组合起来，形成价值大致相等的较大单位。这与今天许多商品交易商为使商品市场得以运作而采取的做法类似。信任仍然是分散的，因为许多其他参与方都能以基本自动化或完全自动化的方式，独立核实这些组合的估计价值。
Thus, bit gold will not be fungible based on a simple function of, for example, the length of the string. Instead, to create fungible units dealers will have to combine different-valued pieces of bit gold into larger units of approximately equal value. This is analogous to what many commodity dealers do today to make commodity markets possible. Trust is still distributed because the estimated values of such bundles can be independently verified by many other parties in a largely or entirely automated fashion.
总的来说，人类用过的所有货币，在某些方面都不安全。这种不安全以各种形式表现出来，从伪造到盗窃都有，而其中危害最深的可能是通货膨胀。比特黄金或许能为我们提供一种货币，在抵御这些危险方面具有前所未有的安全性。计算机架构中未公开的创新，可能带来起初不为人知的供应过剩。这是比特黄金的潜在缺陷；至少，也是其初始拍卖和后续交易必须应对的不完善之处。
In summary, all money mankind has ever used has been insecure in one way or another. This insecurity has been manifested in a wide variety of ways, from counterfeiting to theft, but the most pernicious of which has probably been inflation. Bit gold may provide us with a money of unprecedented security from these dangers. The potential for initially hidden supply gluts due to hidden innovations in machine architecture is a potential flaw in bit gold, or at least an imperfection which the initial auctions and ex post exchanges of bit gold will have to address.