ccamrobertson

Sorry, I don't follow any of your reasoning here. Monopoly money is a low cost print with little detail on standard paper. People don't throw away foreign currency simply because they don't know what it's worth. I'd recommend taking a look at the psychology of cash to understand my point better.

Yes; you are effectively requesting sending from the original 2-of-2 multisig to a new 2-of-2 multisig in the re-key procedure. The user broadcasts the transactions and pays the fees. For all transfers we're recommending using the lowest fee tier possible as given the fact that the notes are intended to be long-lived, rushing to load or re-key them doesn't make a ton of sense.

We're going to showcase the physical notes in person at Consensus, which is arguably the last major Bitcoin conference of the year (certainly for US market).

We've found that having notes in person helps folks to understand the concept more easily.

Once the tamper circuit it tripped you cannot reverse it. But sure, one could try to carefully do this and pass off a note to someone who doesn't verify it electronically.

Or a safe.

Because it's easier to understand and safely custody than private keys for the billions of people who know how to use cash but haven't encountered Bitcoin yet.

We can't transfer the funds under any circumstance. Custody always reverts to the user key on the note.

> I’d love to see how you accomplish this. It seems tricky to be able to sign the replacement transaction without revealing the encrypted private key either to yourselves, or to the mobile app. I guess that you could have the app send the encrypted key up to your servers, where it could be decrypted locally for use and then discarded. But if you are going to do that every time the note changes hands, why not just hold onto the private key? Why mess with encryption keys?

I had to dig back into the architecture on this part since most of this was written last year waiting on notes. In this case you are correct -- we need to decrypt the key in RAM, use it to generate the new tx along with the new user pub key and send that back for the user to broadcast.

Again, the distinction here is that we don't store it which, to your point may or may not matter from a regulatory perspective. I would agree that it would be hand waving and, indeed, false if we claimed that we never could store it at this point (or prior, at the time of creation).

> I assume this is a technical limitation rather than a business decision to sell more notes. But I do wonder (as someone who doesn't quite understand cryptography and multisig beyond the basics of how Bitcoin works), barring a protocol update, is it technically impossible to have reusable notes or was this a trade-off/design decision? If it is possible, is the trade-off it requiring an on-chain transaction to update the multisig every time the note change hands?

This is a trade-off; we could issue notes that never expire and do not require cutting to claim (and could be reloaded), however, this would require perpetual trust that we remain in existence without a fallback. Creating an expiration date mirrors how real money wears out after use. Our intent here isn't to sell more notes; in a medium-confidence scenario our hope is that after a long life in circulation the final holder of the notes re-keys them and puts them in a safe place until 2029 at which point they claim without cutting the notes (and retain them as collectable artifacts with no Bitcoin value thereafter). Our goal is not to sell more notes because they are cut/expired, but rather because we have new designs and denominations.

> This looks like a cool gift, but the necessity of destroying the note to move it, or otherwise trust the giver didn't copy the key, makes it a bad currency (I understand that cold-storage is the aimed use-case, not currency). My first thought on the landing page was that the keys were inaccessible to the holder without destroying the note for moving it to a known address (which would be somewhat alike trading in US dollars for gold, back in the day). I.e., that you could trust the note holds it's denomination as long as it is not cut. That would make it a proper offline and trustless currency. Is there a future where such notes will exist and does it require a major protocol update?

If there is anything beyond zero trust that we exist in some form into the future, the goal is that the recipient can re-key a note from an untrusted giver without cutting the note. In a medium trust world you can assume that a note hold value without scanning it so long as the expiration date is not past. But this requires several things -- (1) trusting that we will continue to exist and facilitate key rotation and (2) that the previous holder carried out some validation and is somewhat trustworthy -- e.g. potentially a bank or large retailer. For low value notes this doesn't seem completely unreasonable, but I appreciate why no one would treat the notes that way without some track record. Given a theoretical new chip which doesn't exist there are some additional possibilities here.

We did debate this, but decided to stick with same size notes for a couple reasons -- (1) they're easier to produce in low volume and (2) there is a bit of sensation from the raised print on the large "1", "2", "5" and "10" numbers.

That's a super interesting idea. We've been somewhat purist about the notes being bearer by nature (not ideal, like digital Bitcoin, for fleeing from oppressive regimes), so any other entanglements challenge that notion.

That said I could imagine a run of "bond" notes instead that rely on a multisig across notes rather than redemption at a bank or with the Treasury.

To gift Bitcoin to people who are not used to using wallets. To have small amounts of Bitcoin not tied your phone or other online device in the case of destruction/hacking/etc. To allow for immediate settlement of a Bitcoin transaction.

At that point in time the note downgrades to a 1-of-2 multisig where only the user key on the note is needed to create a transaction. Cutting the note isn't required/is irrelevant as the second encrypted key has no function at that time.

> So, would this require the full balance of the note effectively to be “spent” and sent to a new multisig UTXO? Wouldn’t you also need access to the decryption key from your server in order sign with both signatures? And who pays the TX fee? Is all the key rotation work done on your servers?

> Also, in order to rotate the key, a user would surely need a separate networked device able to interact with the note. I imagine one would also need to install your specific app as well.

Effectively yes -- working on preparing the security overview here, but we need to be in the loop on the re-key procedure. We will open source that app so that in theory you do not need to rely on that, however, you will need to communicate with our server in this case.

> Would there be an open protocol by which a person could perform key rotation if you go out of business and shut down your servers? If your servers go down, I can’t think of how there would be any way for a user to rotate the user key.

This is a great idea, however, it would require us to select another entity to hold the encryption keys (probably not unreasonable). Currently if there is no way to rotate the keys in this case.

> How are you paying to keep the lights on so that these notes keep working though expiration? You all need a revenue source, but there isn’t anything on your website that indicates how you would make money.

One idea we have is charging a small amount to re-key the notes in addition to network fees. We have not implemented this. We do believe, however, that this would be reasonable and fund continued operation of the servers. I should also note that our hope is to amortize some of the server costs in the notes since their operation isn't particularly intensive.

The biggest challenge we have with stablecoins is justifying why when US Dollars are ubiquitous and "free".

I think there are some good arguments for stablecoins in markets that desire dollars, but they are hard to get -- or for high denomination notes, however, we suspect there would be additional regulatory challenges here.

The time lock lets you optimistically circulate the note prior to the expiration date as even if previous holders know the user key they cannot use it to claim the Bitcoin alone.

Yes, literal cutting -- if not cut, the notes can be re-keyed and recirculated until the expiration date in 2029.

The psychology of cash and how people hold and spend it is unique from any other physical financial instruments. They keep it safer and spend less than they would with credit cards or debit cards.

A completely foreign object with a printed key might be kept safe -- but it isn't intuitive to do so. We heard multiple stories of people gifting Bitcoin at events like weddings only for private keys to be tossed out with cards.

Thanks for the feedback -- agreed, that's definitely become apparent.

Yes, and we would argue that has grave implications. Cash is useful for the young, the old, those who can't participate in commercial banking, etc.

We don't believe that this trend will necessarily reverse, but rather that a society with no cash is risky to live in.

In that circumstance they don't need to be online. The recipient can scan the note entirely offline, get the private key, create a transaction and broadcast it to the Bitcoin network when they are online.

> I mean this respectfully - why would you release a cryptographic method of transferring money - without going into detail of how it actually works? That's kinda the entire point of cryptocurrency, that we have a way to be mathematically confident the money is safe - but you didn't tell us the math. Especially on HN were a lot of the audience is technical enough to want to and be able to verify it to some degree.

As noted, the app will be open source as will the (brief) Bitcoin script for audit. For the sake of simplicity 2-of-2 multisig that downgrades to 1-of-2 multisig over time should capture the essence of how these notes work.

> Also, if your servers go down or you're hacked or rm -rf dir/ * happens, will all the notes become unusable? Are we relying on you to maintain servers indefinitely?

Nope. Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note.

The synthetic paper we use is laughably difficult to tear -- it more readily deforms and stretches instead. You need to cut across a trace.

I like the idea of a note "humidor" with included cutter -- instead it's fireproof and includes EMF shielding.

No, this is a super important question to us as we don't want to hold Bitcoin key material.

The encrypted key on the note can only be used in conjunction with the user key on the note. If we go away or our servers are seized, then in 2029 the user key on the note can access the funds without needing to decrypt the second key on the note.

There are a number of circumstances where the notes can live "offline" without further contact with us -- the primary one we think of is gifting to non-crypto savvy family.

Our denominations are also meant to imply this -- we aren't making 1 BTC notes on purpose. The goal is to provide another tool for onboarding and holding crypto.

OP_CHECKLOCKTIMEVERIFY in the multisig.

Thank you; I don't know too much about Monero -- while I see that it does have multisigs, I can't tell if they can change over time. This is pretty important to ensure that we as the note issuer can never block someone from ultimately claiming the funds off of the note.

Gifting cold storage is the main case we see here. Namely to someone who might throw out a printed private key. We spoke with many Bitcoiners who know that friends and family lost coins they gave them in the early days simply because a printed private key doesn't have much gravitas.

No, still cold storage. If the company shuts down you can use the plaintext user key to claim the funds from the note after January 3rd 2029.

Thank you, the Kong Cash notes were a labor of love and are now very limited in availability -- glad you got some! With Kong we wanted to create a completely new cryptocash from the ground up with Kong with the idea "what if a cryptocurrency started physical first". It was really a demonstration of the usefulness of secure element chips that generate their own keys -- work we've continued with Kong Land.

Unfortunately the chips we use for Kong Cash rely on the P256 curve rather than secp256k1. With Ethereum and the EVM we could bridge this via smart contract, however, Bitcoin script is too limited to achieve the same result (imo with good reason).

We landed on a very different chip configuration for Bitcoin which has the tradeoff of some centralized elements, but also allows the user to introduce their own entropy (unlike the chip we used in Kong Cash which in theory has very good entropy, but still relies on claims from the manufacturer). The timelock concept from Kong, however, works incredibly well for the Bitcoin Note as a failsafe for conditions where we disappear or refuse to service notes.

Great questions --

> First, exactly what is the mechanism by which the user key is rotated? Does that require a transaction to be added to the blockchain whenever the note is transferred from one owner to another? Does the new key need to be kept on a paper wallet or separate device?

Yes, for re-keying you need to carry out an on-chain action. The new key is stored on the note. I could imagine scenarios where people don't re-key a note every time, e.g. they expect to spend it in a short time period.

> Also, when your website says that the decryption key is released when the note is cut—exactly how does that work? Does it require an interaction with your servers? And what is the mechanic by which expiration is enforced?

Exactly, our servers are required here. The expiration is baked into the multisig on Bitcoin.

> And finally, your say that there is no requirement to trust your company. But you somehow have access to the encryption key yourselves. As far as anyone knows, you also kept a record of the encrypted multisig key before you distributed each note.

> Why should anyone trust that you are not keeping copies of all the information needed to access the bitcoin stored on the note? Can you step through how exactly you are blocked from accessing the bitcoin yourselves?

This is good to highlight -- we could be lying and we could keep the encrypted private keys (again, for a clear statement here regarding custodianship: we don't). But in the case of the multisig the encrypted key only ever allows for access to the funds in conjunction with the user key. There is no scenario where it can claim funds alone.