A historical investigation

Who was
Satoshi?

The road to Bitcoin, 1972–2014

19722014

Chapter I

The Mathematician

1972 – 1979

19722014

1972 · Age 16

The young mathematician

Drawn to problems with precise answers — answers that could take hours to find.

19722014

1974 · Age 18

Six miles

From Arcadia High School, valedictorian, to Caltech.

19722014

1974 · Age 18

Caltech

Mathematics, physics, engineering — and, increasingly, computers.

19722014

1970s · Mathematics

A classic text

William Feller’s probability theory. Decades later, Satoshi would cite it in the whitepaper.

19722014

1978 · Age 22

Hal and Fran

A partnership through remarkable achievements — and extraordinary hardship.

19722014

1979 · Age 23

The programmer

Mattel’s Intellivision: sophisticated systems in extraordinarily little memory.

19722014

Chapter II

Trust and Privacy

1981 – 1993

19722014

Early 1980s · A parallel story

David Chaum

How can people who distrust one another run a trustworthy computer system?

19722014

1982 · UC Berkeley

Mutually suspicious groups

The problem of trust — central to digital money, and one day to Bitcoin.

19722014

1982 · Crypto ’82

Blind signatures

Electronic payments with the privacy of physical cash.

19722014

1991

Phil Zimmermann

PGP: strong encryption for ordinary users. Hal Finney contributed as a programmer.

19722014

1992 · Crypto ’92

Computation as a price

Cynthia Dwork and Moni Naor: make the sender of junk email do a little work first.

19722014

1992

Expensive to produce.
Cheap to verify.

An ancestor of proof of work.

19722014

1993 · Wired

The crypto rebels

The Cypherpunks: privacy built with software, not merely promised by law.

19722014

Chapter III

The Small World

1996 – 2002

19722014

1996 · Age 40

PGP becomes
a career.

In this world: a younger cryptographer named Len Sassaman.

19722014

1997

Adam Back

Hashcash: proof that a computer has done work. Built to fight spam.

19722014

Hashcash · 1997

Search for a nonce

nonce 001SHA-1 →a91e52f8…×
nonce 002SHA-1 →7b31ca09…×
nonce 003SHA-1 →0000ab72…✓

Millions of attempts to find. One to verify.

19722014
No verified
public photograph

1998

Wei Dai

Creator of Crypto++.
Proposed b-money.

19722014

1998

b-money

Pseudonymous users. Signed transfers. Shared records of who owns what.

19722014

b-money

But how would
everyone agree?

Coordination and reliable agreement were left unresolved.

19722014

1998

Nick Szabo

Digital property, contracts, scarcity —
and Bit Gold.

19722014

Late 1990s

Len Sassaman

Privacy and anonymous messaging.
He knew Hal Finney.

19722014

The small world

Hal FinneyWei Daimet and correspondedNick Szabomet and correspondedAdam Backexchanged ideasLen Sassamanprofessional circlePhil Zimmermannprofessional circle
19722014

The missing ingredient

Not better encryption.
Not another digital token.

19722014

The missing ingredient

A way for strangers
to agree on one history.

19722014

Chapter IV

RPOW

Reusable Proofs of Work · 2004 – 2005

19722014

2004 · Age 48 · He built it

RPOW

Working digital-money software — not merely a proposal.

19722014

August 15, 2004 · Cryptography mailing list

An open
invitation.

Hal asked cryptographers to test his Hashcash-based server — and to criticize it.

19722014

August 18, 2004 · The critic

“I’m wondering how applicable RPOW is.”
“…aren’t we restricted to applications already nailed down by digital cash schemes?”
Ray Dillinger (“bear”), Cryptography mailing list
19722014

August 19, 2004 · Hal answers

“Another way to think of RPOWs is as an implementation of Nick Szabo’s concept of ‘bit gold’.”
Hal Finney, Cryptography mailing list
19722014

August 21, 2004 · Adam Back replies

Two future Bitcoin
pioneers, debating.

Back saw RPOW as Chaumian e-cash, built from Hashcash and trusted hardware.

19722014

The IBM coprocessor

Trust still lived
inside an IBM chip.

Even the operator couldn’t cheat — but everyone depended on trusted hardware.

19722014

The weakness

If the server failed,
the tokens could fail.

One machine’s fate should not decide whether someone’s savings survive.

19722014

World of RPOW

A shared
database?

Several RPOW servers keeping one common record of spent tokens.

19722014

Hal Finney · World of RPOW

“Ultimately, this approach was considered and rejected.”
Hal Finney, RPOW documentation: clustering and shared databases
19722014

The unsolved question

How can computers
that don’t trust
one another agree on
who owns the money?

19722014

February 2005 · CodeCon

Peer-to-peer
money.

RPOW meets BitTorrent: share files to earn tokens, spend tokens to buy priority.

19722014

February 27, 2005 · RPOW 1.2.0

Add Tor.

Proof of work, transferable tokens, peer-to-peer apps — and anonymous communication.

19722014

February 2005

The public RPOW
trail ends.

The problem does not.

19722014

Chapter V

The Silence

2005 – 2008

19722014

2005 – 2007

Two years.

Who made the leap?

19722014

December 2005 · Nick Szabo

Bit Gold,
in print.

Proof of work, timestamping, ownership records — and still no public implementation.

19722014

2007

Someone begins
writing Bitcoin.

We do not know who.

19722014

November 2007

RFC 4880

Hal co-authors the OpenPGP standard — still a working cryptographic engineer.

19722014

April 2008 · Nick Szabo, on Bit Gold

“Anybody want to help me code one up?”
Nick Szabo, blog comment
19722014

April 2008

Hal had already
built RPOW.

There is no verified evidence he answered.

19722014

Crypto++ · Reported commit gap

Feb 2, 2008last recorded commit
9+ months
Nov 21, 2008commits resume
Aug 20 · Satoshi writes to Adam Back
Oct 31 · The whitepaper

Reported by Ben Sigman. Individual SVN revisions require independent verification.

19722014

August 20, 2008

A blog goes
into reruns.

Nick Szabo’s. The same day, Satoshi writes to Adam Back. Striking — but not evidence.

19722014

Chapter VI

Bitcoin

2008 – 2009

19722014

August 20, 2008 · A stranger writes

“I’m getting ready to release a paper that references your Hashcash paper and I wanted to make sure I have the citation right.”
Satoshi Nakamoto, first email to Adam Back
19722014

Adam Back replies

“You maybe aware of the ‘B-money’ proposal … by Wei Dai which sounds to be somewhat related to your paper.”
Adam Back, reply to Satoshi
19722014

August 21, 2008 · Satoshi to Adam Back

“Thanks, I wasn’t aware of the b-money page, but my ideas start from exactly that point.”
Satoshi Nakamoto, email to Adam Back
19722014

August 21, 2008

Hal Finney had known
Wei Dai for years.

Independent? Careful wording? Concealment?
The email alone cannot tell us.

19722014

October 31, 2008

Bitcoin: A Peer-to-Peer
Electronic Cash System

An unknown author. Familiar inventions — combined into agreement without a trusted issuer.

19722014

The whitepaper

Eight references

[1]W. Daib-money1998
[2]H. Massias et al.Secure timestamping with minimal trust1999
[3]S. Haber, W.S. StornettaHow to time-stamp a digital document1991
[4]D. Bayer et al.Efficiency of digital time-stamping1993
[5]S. Haber, W.S. StornettaSecure names for bit-strings1997
[6]A. BackHashcash — a denial of service counter-measure2002
[7]R.C. MerkleProtocols for public key cryptosystems1980
[8]W. FellerAn introduction to probability theory1957
19722014

The whitepaper

Two names
are missing.

19722014

Not cited

Nick Szabo.
Hal Finney.

Oversight, editorial judgment, or deliberate distancing? The motive is unknown.

19722014

November 2008 · Bitcoin source

Bitcoin was still
changing.

The code existed before launch — and its monetary parameters were still being refined.

19722014

Bitcoin v0.1 · SHA-256

Inside Bitcoin:
Wei Dai’s code.

SHA-256 code descended from Crypto++. Proof of reuse — not of authorship.

19722014

January 2009

“Running bitcoin”
Hal Finney, on Twitter
19722014

January 12, 2009

10 bitcoin

Satoshi → Hal: the first widely recognized person-to-person Bitcoin transaction.

19722014

January 2009 · Hal–Satoshi emails

Tester and
developer.

Hal reported bugs. Satoshi replied with fixes and deep knowledge of the C++ code.

19722014

April 18, 2009 · Santa Barbara

10 miles

Hal runs a documented ten-mile race.

19722014

April 18, 2009

Satoshi appears
to be active.

A serious problem for any theory that Hal ran the identity alone.

19722014

Chapter VII

The Theory

One name. More than one person?

19722014

The alibi changes the question

What if Satoshi
wasn’t one person?

19722014

A hypothesis

A project,
not a person?

One engineer designing the software. Another handling correspondence and releases.

19722014

Len returns

Len Sassaman

Knew Hal. Understood pseudonymous cryptography. Encouraged authors to use pseudonyms.

19722014

Finding Satoshi

Did Len
help Hal?

The documentary proposes it. Friendship and expertise do not prove it.

19722014

The hypothesis

Hal Finney
+

One or more of

Len Sassaman
Nick Szabo
Wei Dai

Possible. Not proven.

19722014

The theory meets its limits

  • Hal denied being Satoshi.
  • His emails read like correspondence with another developer.
  • Len reportedly criticized Bitcoin.
  • Wei’s commit gap has innocent explanations.
19722014

The case is not closed

A compelling hypothesis
is not proof.

It competes with a simpler possibility: Satoshi was someone else.

19722014

Chapter VIII

Hal

2009 – 2014

19722014

2009 · Age 52

The runner.

As Bitcoin began, Hal was in excellent physical condition.

19722014

August 2009 · Age 53

ALS

Seven months after Bitcoin’s launch.

19722014

December 2009

The finish line.

Fran turned a marathon into an ALS fundraiser. Hal joined the final stretch — and crossed the line.

19722014

2013 · Age 56

Bitcoin and Me

Written with assistive technology. He wrote about Satoshi as someone else.

19722014

August 28, 2014

Hal Finney
1956 – 2014

Encryption for ordinary people. A working digital-cash experiment. One of Bitcoin’s first advocates.

19722014

Who was Satoshi? · Still unresolved

His documented
achievements need
no mystery to matter.

19722014