Ecash is becoming an inevitable topic these days. In a climate of contention over virtually every proposal circulating these days, ecash stands out as a protocol that can be implemented today without any alteration or modification to the Bitcoin protocol.
The ability to deploy an application or protocol without depending on changes to Bitcoin is an incredibly valuable thing in the current climate, so it’s no surprise that the Cashu ecash protocol is starting to quickly gain traction on the fringes. Adoption is starting to happen on platforms like Nostr, and inter-mint settlement across the Lightning network makes Cashu wallets a viable alternative to things like Wallet of Satoshi as easy-to-use Lightning wallets.
Ecash will likely become an increasingly popular piece of the Bitcoin ecosystem, and Cashu in particular has been incredibly successful in encouraging multiple compatible implementations.
Cashu’s developers have a comprehensive plan for an ecosystem built around the protocol to address some of the fundamental problems of ecash’s trust model, as well as the specific needs of different use cases. Let’s examine the vision of the Cashu ecosystem.
Blinded tokens
The core of all ecash protocols is a blind signature scheme. This is the mechanism that allows a centralized entity to process ecash payments while respecting privacy.
To get started, users who mint a token need to generate a random value. This is the real ecash token. Generating it yourself ensures that the token is held securely in their possession and no one else’s. But that’s not enough, anyone can simply generate a random value. The ecash mint operator must authenticate the token with a signature.
The problem is that if they see the token when they sign it, they will know who they signed it for and will be able to know who made a payment when someone else approaches them to redeem it. To solve this problem, the user generates a second random value, a blinding factor, before the mint authenticates a token. The binding factor is essentially multiplying the value of the token by the value of the blind.
The user then provides the value of the blinded token to the mint to sign it. This leaves you with a problem though, the mint signed the value of the token in the blind, not the value in the clear. Due to how the obscuring protocol and underlying cryptography works, it is possible to perform the reverse operation performed to obfuscate the token in the first place to open the signature.
This leaves you with a valid signature for the value of the token in clear text and ensures that when it is redeemed the mint has no idea when, what or who signed it for. This is ecash in a nutshell (get it?).
Small local mints
Cashu’s goal is to be a lean and lightweight protocol that is easy to implement, easy to integrate and easy to develop. Vision is an ecosystem of a large number of very small ticks running locally, all interconnected via Lightning Network. Rather than focus on larger mints with network effects that enable direct token transfers between users, incentivizing the concentration of huge amounts of bitcoin in the hands of a few trusted counterparties, developers envision localized, much smaller-value operators.
This allows users to place trust in the people they have closest relationships with and each user to depend on an operator much closer to their trusted social circle. Lightning allows this, because instead of having to convince everyone to accept tokens from your mint, you simply redeem them and allow them to receive tokens from their own mint.
The strategy here tries to lean into the reality of Dunbar’s number, the maximum number of people with whom someone can mentally have a meaningful relationship or degree of trust.
Mint discovery on Nostr
Fueling the general idea of encouraging numerous local ticks into people’s circle of trust, the new Nostr discovery protocol is a huge component of the long-term functioning of a Cashu ecosystem. Nostr is built around the idea that users’ identities are tied to self-guarding cryptographic keys, ensuring that no one else but them can transmit messages attributed to their identity.
Nostr’s primary use case currently is social media, which combined with the key-based identity scheme provides a powerful foundation for a very old concept in cryptography: trust networks. Cashu is leveraging this to allow users to discover mints they could use.
With the Nostr key, anyone using a Cashu wallet that supports the feature can locate ticks and will be able to see which ticks are being used by people they know, trust and interact with. This can form a reputational system that allows them to make more informed decisions about which Cashu they trust with their funds rather than blindly guessing and hoping not to get burned at some point.
The more ticks that come online, and the more people using them with Nostr identities, the stronger this reputational trust network will become over time. This should naturally weed out malicious or unknown ticks and give users a solid set of reliable and honest mint operators to choose from.
Using more mints
The basic concept of a diverse ecosystem of ticks for users to choose from is a solid foundation for a market-based system of open and competitive options for users. But things can go even further. A single user can use multiple mints.
Users can spread their balance across multiple mints and, using a variant of multipath payments, can initiate a payment via the Lightning Network to a single destination with portions of the payment coming from many different mints they have balances with. This allows you to spread the counterparty risk of keeping your funds with custodians among many of them, without sacrificing the ability to make smooth payments to people using mints other than yours.
This is made possible by mints running custom software to allow one mint to only partially pay a Lightning bill, allowing other mints you have funds with to pay other parts of the bill. As long as each mint successfully routes its payment to the final destination, the payment will be successful.
You can also further customize your Lightning nodes to allow your users to do so receive a multi-tick payment. If minters support a user’s wallet that generates the preimage to finalize payment instead of minting, each mint used to receive funds can issue its own invoices where the receiving user controls the release of the preimage. As long as each participating mint receives the routed HTLC, the user can release the preimage to all of them and successfully distribute the received funds among the mints.
This scheme can greatly reduce the risk of losing funds due to any minting and, in combination with the Nostr detection protocol and associated trust networks, can dramatically improve user security.
Plan your money
One of the most useful aspects of Cashu is the ability to program script functionality into an ecash token in the same way that a real Bitcoin UTXO is lockable with a program that uses Bitcoin script. Cashu tokens may encode script conditions before blinding the token for the mint to authenticate, and when they are subsequently redeemed the mint may refuse to redeem the token unless such arbitrary script conditions are met.
Currently Cashu has implemented a public key lock script, which requires a signature from the specified public key to redeem the token. This allows the minting of tokens that are locked and redeemable only by the holder of a specific private key. Once the token with the public key block is minted, it is impossible for anyone else to redeem it.
This can be used to enable secure payments when the recipient is offline. Even without an internet connection, as soon as they receive the token from the sender they can be sure, after verifying the mint’s signature, that no one else will be able to redeem the token. They can confidently accept it as payment knowing that they can redeem it later at a convenient time.
This introduces some complexity, as the sender must lock the tokens to a specific recipient in advance if they do not have an internet connection at the time of spending. Since people very often don’t know exactly how much they will spend somewhere, this creates the problem of potentially allocating too much money with no ability to take it back if they don’t spend it.
But the script can support many things, tokens could be created that require a signature from a specific public key or anyone after a certain amount of time has passed. Something analogous to an HTLC. The Cashu specification also defines a true HTLC script token.
As time goes on and more use cases are desired, the scripts with which people can lock Cashu tokens can be expanded arbitrarily based on the needs of users and mint operators. I expect this to become a very powerful aspect of the protocol in the long term. It could support escrow services, multi-signature tokens, and a wide variety of arbitrary smart contracts. Cashu ticks can apply any script condition that Bitcoin can do, and much more.
The big picture
People use custodians, it’s something they always have done and will probably always do, regardless of the flexibility offered by non-custodial solutions. It is simply a fact that some people cannot or will not take on the responsibility or deal with the complexity of self-reliance.
Cashu aims to represent a radical improvement for users of custodial services. Something that can offer privacy, censorship resistance, and flexibility to users who otherwise wouldn’t have access to these things with the way traditional custodial services are architected.
The goal of the Cashu project is not to “scale Bitcoin” using custodians, but to offer an improved and private system for users of custodial services. I think this is a laudable goal and has huge potential to be a huge benefit to these users in the long term.
