Blockchain/Level V · Layers/5.2 Other layers/Lesson 4
Ecash: Cashu and Fedimint
Blind signatures and the trust they demand
MaterialsThe Cashu NUT specifications (github.com/cashubtc/nuts)Fedimint documentation (fedimint.org)A notebook
Wonder
- How can a server sign a digital token without knowing who will spend it?
- Why does strong payment privacy require a custodian to hold the underlying bitcoin?
- What changes when that custodian becomes a group of known guardians instead of a single operator?
Explore
- David Chaum introduced blind signatures in 1983, allowing a signer to sign a message without seeing its content. The user blinds the data before sending it; the signer applies their key to the blinded version; the user then unblinds it. The resulting signature is valid on the original data, but the signer cannot link it to any other token they have issued.
- Chaum’s DigiCash (1989) implemented this for electronic payments. Coins were issued through partner banks, and payers were anonymous: the issuer could verify a coin at redemption without learning who had withdrawn it. However, the system required centralized issuance and went bankrupt in 1998 before widespread adoption.
- Cashu, launched in 2022 by the developer known as Calle, revives Chaumian ecash on Bitcoin. A single mint holds bitcoin reserves and issues blinded tokens to users. The mint signs these tokens but cannot link deposits to redemptions. This offers instant, private peer-to-peer transfers off-chain, though the user relies entirely on one operator for custody.
- Fedimint, developed in 2021-2022, uses a federated approach. A group of ‘guardians’ jointly holds the bitcoin reserve using threshold signatures (e.g., 3 of 4). No single guardian can access funds alone or track user activity independently. This model suits communities where members already trust each other, distributing custodial risk across known parties rather than a centralized server.
- Both connect to Lightning through gateways, so ecash can be paid out to, or received from, ordinary Lightning wallets. The trade-off is consistent: users gain privacy and speed in exchange for trusting the mint or federation with their funds. If the custodian misbehaves or goes offline, token holders cannot redeem them unilaterally without cooperation.
- The Cashu specifications (the ‘NUTs’, starting with NUT-00) walk through the blinding step by step: the wallet sends the mint a blinded value, the mint signs it, and the wallet removes the blinding factor. Reading them shows why the mint cannot later match a redeemed token to the request it signed, and why that privacy does nothing to protect against a mint that simply refuses to pay.
Key facts
- David Chaum published blind signatures in 1983, enabling untraceable digital payments.
- Cashu (2022) uses a single mint to hold bitcoin and issue blinded tokens for private transfers.
- Fedimint (2021-2022) employs a federation of guardians holding bitcoin via threshold signatures.
- Both protocols provide payment privacy by preventing the issuer from linking deposits to redemptions.
- Cashu relies on one operator for custody; Fedimint distributes this risk among known community members.
- Lightning connections (gateways, in Fedimint’s terms) let ecash be paid to and from ordinary Lightning wallets.
Exercise nine, six, three, one
9CollectList 9 digital cash or token systems, historical or modern. Note the issuer type (centralized, federated, decentralized) and the privacy mechanism used.
6ClusterGroup the 9 into 6 by how they handle custodial risk: single operator, known federation, anonymous validators, smart contract escrow, hybrid, or other.
3DistillReduce the 6 to 3 core trade-offs between privacy, speed, and trust assumptions.
1CrystallizeWrite 1 sentence on what blind signatures promise and what keeps that promise from being broken by the issuer.
Fact check
Dates, figures and claims checked against the published sources listed below.