Bilinear group cryptography

An important recent development in public key cryptography is the bilinear group, which for abstract algebra wonks is defined as follows (if you're not into abstract algebra feel free to skip to below):

Bilinear groups are a set of three abstract algebraic groups, G1, G2 and GT , together with a deterministic function e, called a bilinear map, that takes as input one element from G1 and one element from G2 and outputs an element in GT . Suppose all three groups have order Q, element g1 generates group G1, and element g2 generates group G2. Then, one special property called bilinearity of the map e is that for all a, b < Q, we have that e(g1^a , g2^b) = e(g1, g2)^ab. This new element, e(g1, g2)^ab, is in group GT . The key observation is what happens to the exponents, a and b, during the mapping: they are multiplied. The group GT is distinct from both G1 or G2; thus the output of the mapping cannot be fed back into the map e as input.

Elliptic curves are generally used for the groups, although bilinear schemes in at least some other algebras are also possible.

Two of the main applications of bilinear groups are proxy re-signatures and proxy re-encryption. In proxy re-signatures, a semi-trusted party transforms Alice's public key signature into Bob's. The proxy does not have, cannot derive, and thus cannot sign with either Bob's secret key or with Alice's, but can only transform Alice's signature into Bob's. The proxy re-signer is thus "semi-trusted" -- it is trusted with some things we normally would trust a proxy signer with, but not with others. For example it is not trusted with either Alice's or Bob's private key, only with a special key that allows the signature transformation.

The target signature could also be a group signature. Thus, for example, Alice could sign her e-mail with her own digital signature, and a proxy re-signer sitting on the corporate e-mail firewall could re-sign the e-mail with the corporate group signature.

Proxy re-signers can be chained in a series, so that signature A is transformed by proxy AB into signature B, which is transformed by proxy BC into signature C, and so on. The last signature Z proves that the message was signed by each proxy in the chain in order. Proxy re-signers can also be chained together in a tree or directed acyclic graph. (Note that threshold signatures by contrast do not require or prove that the signatures took place in a particular order).

Proxy re-encryption is the same idea for public key encryption, with the added bonus that the re-encryptor can't read the message. So, for example, we could have the following scheme to restrict the distribution of content:

(1) Content owner Alice encrypts her content with her public key and publishes it to proxies P1, P2, etc., along with re-encryption keys AC1, AC2, etc. for each customer.

(2) Proxy allows customer to access the content only if paid. When paid, the proxy re-encrypts to the customer using the re-encryption key for that customer.

The proxies themselves are trusted neither with an ability to view the content nor with the discretion to distribute to additional customers not desired by content owner Alice. The proxy is trusted only to restrict access to a customer. (I present this scheme mainly just to illustrate what proxy re-encryption does. As an application, this particular content distribution scheme seems to me to only be useful if it somehow lowers transaction costs to route all payments through proxies rather than paying Alice directly, the latter which could be done by normal public-key cryptography, and of course it doesn't protect against a cheating customer re-publishing the content to the world).

I suspect proxy re-encryption could simplify the design of digital mix schemes like onion routing -- this is left as an exercise for the cryptographically inclinded reader.

This thesis is my source for most of this blog post; it discusses bilinear group cryptography for proxy re-encryption, proxy re-signing, and for reducing the trust needed for blinded offline digital cash.

Legal caveat: many, if not most protocols based on bilinear groups seem to have been recently patented.

Money and the problem of cooperation

From "Shelling Out: The Origins of Money":

Evolutionary psychology starts with a key mathematical discovery of John Maynard Smith [D89]. Using models of populations of co-evolving genes, from the well-developed area of population genetics, Smith posited genes that can code for strategies, good or bad, used in simple strategic problems (the "games" of game theory). Smith proved that these genes, competing to be propagated into future generations, will evolve strategies that are Nash equilibria to the strategic problems presented by the competition. These games include the prisoner's dilemma, a prototypical problem of cooperation, and hawk/dove, a prototypical problem of aggression and its mitigation.

Critical to Smith's theory is that these strategic games, while played out between phenotypes proximately, are in fact games between genes at the ultimate level -- the level of competition to be propagated. The genes -- not necessarily the individuals -- influence behavior as if they were boundedly rational (coding for strategies as optimal as possible, within the limits of what phenotypes can express given the biological raw materials and previous evolutionary history) and "selfish" (to use Richard Dawkins' metaphor). Genetic influences on behavior are adaptations to the social problems presented by genes competing through their phenotypes. Smith called these evolved Nash equilibria evolutionary stable strategies..

The "epicycles" built on top of the earlier individual selection theory, such as sexual selection and kin selection, disappear into this more general model which, in a Copernican manner, puts the genes rather than individuals at the center of the theory. Thus Dawkins' metaphorical and often misunderstood phrase, "selfish gene", to describe Smith's theory.

Few other species cooperate on the order of even Paleolithic humans. In some cases -- brood care, the colonies of ants, termites, and bees, and so forth, animals cooperate because they are kin -- because they can help copies of their "selfish genes" found in their kin. In some highly constrained cases, there is also ongoing cooperation between non-kin, which evolutionary psychologists call reciprocal altruism. As Dawkins describes it [D89], unless an exchange of favors is simultaneous (and sometimes even then), one party or the other can cheat. And they usually do. This is the typical result of a game theorists call the Prisoner's Dilemna -- if both parties cooperated, both would be better off, but if one cheats, he gains at the expense of the sucker. In a population of cheaters and suckers, the cheaters always win. However, sometimes animals come to cooperate through repeated interactions and a strategy called Tit-for-Tat: start cooperating and keep cooperating until the other party cheats -- then defect yourself. This threat of retalation motivates continued cooperation.

The situations where such cooperation in fact occurs in the animal world are highly constrained. The main constraint is that such cooperation is restricted to relationships where at least one of the participants is more or less forced to be in the proximity of the other. The most common case is when parasites, and hosts whose bodies they share, evolve into symbiotes. If the interests of the parasite and the host coincide, so that both working together would be more fit than either on their own, (i.e. the parasite is also providing some benefit to the host), then, if they can play a successful game of Tit-for-Tat, they will evolve into symbiosis -- a state where their interests, and especially the exit mechanism of genes from one generation to the next, coincides. They become as a single organism. However, there is much more than cooperation going on here -- there is also exploitation. They occur simultaneously. The situation is ananalogous to an institution humans would develop -- tribute -- which we will analyze below.

Some very special instances occur that do not involve parasite and host sharing the same body and evolving into symbiotes. Rather, they involve non-kin animals and highly constrained territory. A prominent example Dawkins describes are cleaner fish. These fish swim in and out of the mouths of their hosts, eating the bacteria there, benefiting the host fish. The host fish could cheat -- it could wait for the cleaner to finish its job, then eat it. But they don't. Since they are both mobile, they are both potentially free to leave the relationship. However, the cleaner fish have evolved a very strong sense of individual territoriality, and have stripes and dances that are difficult to spoof -- much like a difficult to forge brand logo. So the host fish know where to go to get cleaned -- and they know that if they cheat, they will have to start over again with a new distrustful cleaner fish. The entrance costs, and thus the exit costs, of the relationship are high, so that it works out without cheating. Besides, the cleaner fish are tiny, so the benefit of eating them is not large compared to the benefit of a small number of, or even one, cleaning.

One of the most pertinent examples.is the vampire bat. As their name suggests, they suck the blood of prey mammals. The interesting thing is that, on a good night, they bring back a surplus; on a bad night, nothing. Their dark business is highly unpredictable. As a result, the lucky (or skilled) bats often share blood with the less lucky (or skilled) bats in their cave. They vomit up the blood and the grateful recipient eats it.

The vast majority of these recipients are kin. Out of 110 such regurgitations witnessed by the strong-stomached biologist G.S. Wilkinson, 77 were cases of mothers feeding their children, and most of the other cases also involved genetic kin. There were, however, a small number that could not be explained by kin altruism. To demonstrate these were cases of reciprocal altruism, Wilkinson combined the populations of bats from two different groups. Bats, with very rare exception, only fed old friends from their original group. [D89]. Such cooperation requires building a long-term relationship, where partners interact often, recognize each other, and keep track of each other's behavior. The bat cave helps constrain the bats into long-term relationships where such bonds can form.

We will see that some humans, too, chose highly risky and discontinuous prey items, and shared the resulting surpluses with non-kin. Indeed, they accomplished this to a far greater extent than the vampire bat. How they did so is the main subject of our essay. Dawkins suggests, "money is a formal token of delayed reciprocal altruism", but then pursues this fascinating idea no further. We will.

Among small human groups, public reputation can supercede retaliation by a single individual to motivate cooperation in delayed reciprocation. However, reputational beliefs can suffer from two major kinds of errors -- errors of about which person did what, and errors in appraising the value or damages caused by that act.

The need to remember faces and favors is a major cognitive hurdle, but one that most humans find relatively easy to overcome. Recognizing faces is easy, but remembering that a favor took place when such memory needs to be recalled can be harder. Remembering the specifics about a favor that gave it a certain value to the favored is harder still. Avoiding disputes and misunderstandings can be improbable or prohibitively difficult.

The appraisal or value measurement problem is very broad. For humans it comes into play in any system of exchange -- reciprocation of favors, barter, money, credit, employment, or purchase in a market. It is important in extortion, taxation, tribute, and the setting of judicial penalties. It is even important in reciprocal altruism in animals. Consider monkeys exchanging favors -- say pieces of fruit for back scratches. Mutual grooming can remove ticks and fleas that an individual can't see or reach. But just how much grooming versus how many pieces of fruit constitutes a reciprocation that both sides will consider to be "fair", or in other words not a defection? Is twenty minutes of backscratching worth one piece of fruit or two? And how big a piece?

Even the simple case of trading blood for blood is more complicated then it seems. Just how do the bats estimate the value of blood they have received? Do they estimate the value of a favor by weight, by bulk, by taste, by its ability to satiate hunger, or other variables? Just the same, measurement complications arise even in the simple monkey exchange of "you scratch my back and I'll scratch yours".

For the vast majority of potential exchanges, the measurement problem is intractible for animals. Even more than the easier problem of remembering faces and matching them to favors, the ability of both parties to agree with sufficient accuracy on an estimate of the value of a favor in the first place is probably the main barrier to reciprocal altruism among animals.

Just the stone tool-kit of even early Paleolithic man that has survived for us to find was in some ways too complicated for brains of our size. Keeping track of favors involving them -- who manufactured what quality of tool for whom, and therefore who owed whom what, and so on -- would have been too difficult outside the boundaries of the clan. Add onto that, quite likely, a large variety of organic objects, ephemeral services (such as grooming), and so on that have not survived. After even a small fraction of these goods had been transferred and services performed our brains, as inflated as they are, could not possibly keep track of who owed what to whom. Today we often write these things down -- but Paleolithic man had no writing. If cooperation occured between clans and even tribes, as the archaeological record indicates in fact occured, the problem gets far worse still, since hunter-gatherer tribes were usually highly antagonistic and mutually distrustful.

If clams can be money, furs can be money, gold can be money, and so on -- if money is not just coins or notes issued by a government under legal tender laws, but rather can be wide variety of objects -- then just what is money anyway? And why did humans, often living on the brink of starvation, spend so much time making and enjoying those necklaces when they could have been dong more hunting and gathering? Nineteenth century economist Carl Menger [M1892] first described how money evolves naturally and inevitably from a sufficient volume of commodity barter. In modern economic terms the story is similar to Menger's.

Barter requires a coincidence of interests. Alice grows some pecans and wants some apples; Bob grows apples and want some pecans. They just happen to have their orchards near each other, and Alice just happens to trust Bob enough to wait between pecan harvest time and apple harvest time. Assuming all these conditions are met, barter works pretty well. But if Alice was growing oranges, even if Bob wanted oranges as well as pecans, they'd be out of luck -- oranges and apples don 't both grow well in the same climate. If Alice and Bob didn't trust each other, and couldn't find a third party to be a middleman [L94] or enforce a contract, they'd also be out of luck.

Further complications could arise. Alice and Bob can't fully articulate a promise to sell pecans or apples in the future, because, among other possibilities, Alice could keep the best pecans to herself (and Bob the best apples), giving the other the dregs. Comparing the qualities as well as the quantities of two different kinds of goods is all the more difficult when the state of one of the goods is only a memory. Furthermore, neither can anticipate events such as a bad harvest. These complications greatly add to the problem of Alice and Bob deciding whether separated reciprocal altruism has truly been reciprocal. These kinds of complications increase the greater the time interval and uncertainty between the original transaction and the reciprocation.

A related problem is that, as engineers would say, barter "doesn't scale". Barter works well at small volumes but becomes increasingly costly at large volumes, until it becomes too costly to be worth the effort. If there are n goods and services to be traded, a barter market requires n^2 prices. Five products would require twenty-five prices, which is not too bad, but 500 products would require 250,000 prices, which is far beyond what is practical for one person to keep track of. With money, there are only n prices -- 500 products, 500 prices. Money for this purpose can work either as a medium of exchange or simply as a standard of value -- as long as the number of money prices themselves do not grow too large to memorize or change too often. (The latter problem, along with an implicit insurance "contract", along with the lack of a competitive market may explain why prices were often set by long-evolved custom rather than proximate negotiation).

Barter requires, in other words, coincidences of supply or skills, preferences, time, and low transaction costs. Its cost increases far faster than the growth in the number of goods traded. Barter certainly works much better than no trade at all, and has been widely practiced. But it is quite limited compared to trade with money.

Primitive money existed long before large scale trade networks. Money had an even earlier and more important use. Money greatly improved the workings of even small barter networks by greatly reducing the need for credit. Simultaneous coincidence of preference was far rarer than coincidences across long spans of time. With money Alice could gather for Bob during the ripening of the blueberries this month, and Bob hunt for Alice during the migration of the mammoth herds six months later, without either having to keep track of who owed who, or trust the other's memory or honesty. A mother's much greater investment in child rearing could be secured by gifts of unforgeable valuables. Money converts the division of labor problem from a prisoner's dilemma into a simple swap.

The proto-money used by many hunter-gatherer tribes looks very different from modern money, now serves a different role in our modern culture, and had a function probably limited to small trade networks and other local institutions discussed below. I will thus call such money collectibles instead of money proper. The terms used in the anthropological literature for such objects are usually either "money", defined more broadly than just government printed notes and coins but more narrowly than we will use "collectible" in this essay, or the vague "valuable", which sometimes refers to items that are not collectibles in the sense of this essay.

Reasons for choosing the term collectible over other possible names for proto-money will become apparent. Collectibles had very specific attributes. They were not merely symbolic. While the concrete objects and attributes valued as collectible could vary between cultures, they were far from arbitrary. The primary and ultimate evolutionary function of collectibles was as a medium for storing and transfering wealth. Some kinds of collectibles, such as wampum, could be quite functional as money as we moderns know it, where the economic and social conditions encouraged trade. I will occasionally use the terms "proto-money" and "primitive money" interchangeably with "collectible" when discussing pre-coinage media of wealth transfer.

More here.

Why the industrial revolution?

There is currently a hot debate at Marginal Revolution and elsewhere over Gregory Clark's new book, A Farewell to Alms. I can't do Clark justice with a short explanation, but in brief he posits that the rich outbred the poor so quickly in medieval England that a eugenic effect occurred, giving the English traits of temperament such as harder work, longer time preferences, etc. that made the industrial revolution possible. I find the political incorrectness of Clark's explanation refreshing, but I'm not convinced, given that the rich tended to outbreed the poor during most eras and in most cultures of history prior to the industrial revolution. Even worse, Clark's theory can't explain why England fell behind most of the rest of Western Europe, and later most of the rest of the industrial world, in industrial and later economic progress after about 1870. Genetic change doesn't work nearly that fast.

I've argued that the printing press, combined with a free market in books and the resulting spread of literate culture and the rise of national languages, gave Europe an institutional superiority over other cultures of that era that is now hard to fathom. As the term "literate culture" does not connote the radical shift in our very thought processes that occurred, I call this effect "book consciousness."

This led, in the first instance, to Western European conquest of the world's seas and colonization all over the planet -- a conquest that has been substantially reversed and could not be duplicated today because now most of the world shares book consciousness. It also led to a radical change in the way work skills were taught to children, which along with the scientific revolution and other fruits of the printing press led to the industrial revolution.

Clark's own data on wages and productivity can best be explained, I believe, by the radical changes in child investment strategy reflected in Protestant Reformation and a central aspect of book consciousness.

Finally, the industrial revolution occurred first in England rather than other parts of Western Europe due to the security advantages of being an island. Not at all coincidentally, England was by 1800 the leading colonial power. England was protected at low cost by its navies from most of the organized violence that ravaged the continent. This allowed it to develop a more secure regime of property rights, which in turn lowered the risks of the large capital outlays needed for industrialization. For a similar reason Japan initially outpaced its continental Asian rivals in industrialization.

Here's a link to the debate at Marginal Revolution.

Mutually private computation

From my article, The God Protocols:

Imagine the ideal protocol. It would have the most trustworthy third party imaginable — a deity who is on everybody's side. All the parties would send their input to this god. God would reliably determine the results and return the output. In addition, God, being the ultimate in confessional discretion, would ensure that no party would learn anything more about the other party's input than they could learn from their own input and the output.

Alas, in our temporal world we deal with humans rather than deities. Yet, too often we are forced to treat people in a nearly god-like manner because our infrastructure lacks the security needed to protect ourselves.



To an astonishing extent, network security theorists have recently solved this problem. They have developed protocols that create virtual machines between two or more parties. Multi-party secure computation allows any number of parties to share a computation, each learning only what can be inferred from their own input and the output of the computation. These virtual machines have the exciting property that each party's input is held in strict confidence from the other parties. The program and the output are shared by the parties.

For example, we could run a spreadsheet across the Internet on this virtual computer. We would agree on a set of formulas and set up the virtual computer with these formulas. Each participant would have their own input cells, which remain blank on the other participants' computers. The participants share output cell(s). Each participant inputs their own private data into their input cells. Alice could only learn as much about the other participants' input cells as she could infer from her own inputs and outputs.

I go on to briefly describe applications such as confidential auditing and auctions with private bids, here.

Related articles: confidential auditing, secure time-stamping, advances in distributed security.

Some outside links to papers: secure time-stamping, multiparty secure computation.

Blind signatures

The following, from a larger article of mine, serves as an introduction to the idea of blind signatures and their use in digital cash and other digital bearer certificates:

Introduction

Meet the greatest simple equation since e=mc²:

gSf(m) = S(m)

S is a digital signature, f is the blinding function, and g an unblinding function. The blinding functions are usually based on a secret random number called the "blinding factor". m is another random number, a unique identifier which can, for example, refer to an instance of some object.

The idea is very clever but very simple. It may be counterintuitive because the simplest physical world metaphor of this highly useful e-commerce primitive sounds worse than useless: Alice can get Carol to sign a blank check! Here's how:

(1) Alice generates m and blinds it. "Blinding" is just a one-time-pad encryption to oneself, f(m). She sends this to Carol. This is like taking a piece of paper and sealing it inside an envelope which Carol can't open or see through.

(2) Carol signs it: Sf(m), and sends this back to Alice. This is like Carol signing the outside of the envelope.

(3) Alice unblinds it: gSf(m) = S(m). Carol has also signed the paper Alice put inside the envelope!

The genius behind this discovery: cryptography guru David
Chaum. The brilliance lies in step 3: Chaum discovered that
some signatures have the property of being "commutative"
with the blinding functions: Alice can strip off the blinding
in the reverse order which the blinding and signature
were applied, leaving just Alice's signature of n. It is as if
Alice put a piece of carbon paper inside the envelope.

In particular for RSA signatures, with public key (pq, e)
and private key d, the blind signature functions are the following
modulo pq:

S(x) = xd
g(x) = xk-1
f(x)= xke

We can check that the blind signature property holds:

gSf(m) = (m(ke))d * k-1
       = md * k * k-1
= md

which is the valid RSA signature of private key d on m.

Unlinkable Transfers

Distinguish between either a counter or third party tracing one person's true name, via lack of or weak communications mix, and a third party linking two entities (whether nyms, use-more-than-once-addresses, account numbers, or true names) as being involved in the same transaction. By unlinkability herein we mean the latter. The goal where true names are used (this occurs, for example, when using true name accounts or not using good communications mixes), is to prevent third party linking of two people doing business with each other. Where nyms are used the goal is to minimize the release of traffic information, to prevent the unwanted accumulation of unique behavior patterns, which could be used to link nyms (including to their true names), or could augment other means of breaching privacy. Blinding especially helps where rights holders want to keep third party or public accounts denominated in generic rights. In that case a communications mix doesn't even in principle give us what blinding does.

Besides protecting against the transfer agent, Chaum's transferor-, transferee-, and double-blinding protocols protect against collusion of a party with a transfer agent to identify the countparty account or nym.

Unlinkability can be provided by combining a list of cleared certificates with blind signatures and a delay-mixing effect. Enough instances of a standardized contract [or specifically with digital cash, standard denominations of money] are issued over a period of time to create a mix. Between the issuing and clearing of a certificate, many other certificates with the same signature will be cleared, making it highly improbable that a particular clearing can be linked to a particular issue via the signature. There is a tradeoff between the mixing effect and the exposure to the theft of a "plate" for a particular issue: the smaller the issue, the smaller the exposure but the greater the linkability; a larger issue has both greater exposure and greater confidentiality.

Blind signatures can be used to make certificate transfers unlinkable via serial number. Privacy from the transfer agent can take the form of transferee- unlinkability, transferor-unlinkability, or "double blinded" where both transferor and transferee are unlinkable by the transfer agent or a collusion of a transfer agent and counterparty.

A use-once-address communications mix plus foreswearing any reputation gain from keeping accounts, in theory also buys us unlinkability, but a communications mix is weak and very expensive.

Bearer certificates come in an "online" variety, cleared during every transfer, and thus both verifiable and observable, and an "offline" variety, which can be transferred without being cleared, but is only verifiable when finally cleared, by revealing any the clearing name of any intermediate holder who transferred the object multiple times (a breach of contract).

This unlinkability is often called "anonymity", but the issue of whether accounts are issued to real names or pseudonyms, and whether transferor and transferee identify themselves to each other, is orthogonal to unlinkability by the transfer agent in the online model. In the off-line model, account identification (or at least a highly reputable and/or secured pseudonym) is required: passing an offline certificate a second time reveals this identity. Furthermore, communications channels can allow Eve to link transferor and transferee, unless they take the precaution of using an anonymous remailer. Online clearing does make lack of identification a reasonable option for many kinds of transactions, although common credit and warrantee situations often benefit from or even require identification.

When confronting an attempted clearing of a cleared serial number, we face an error-or-fraud dilemma similar to the one we encountered above in double entry bookkeeping. The ecash(tm) protocol from DigiCash actually takes advantage of on purpose to recover from a network failure. When certificates are lost over the net it is not clear to the transferor whether they have been received and cleared by the transferee or not. Second-transferring directly with the transfer agent resolves the ambiguity. This only works with the online protocol. The issue of distinguishing error from fraud is urgent in the offline protocol, but there is as yet no highly satisfactory solution. This problem is often intractable due to the subjectivity of intent.

With ideal two-way anonymous communications between use-once keys, and completely accountless clearing, unlinkability via blind signatures becomes redundant. This ideal case has yet to be even closely approached with implemented technology, and necessarily involves long communications delays which are often intolerable. Real imperfect communications mixes and less expensive blinded tokens complement each other.

Personal jurisdiction before sovereignty

Today the concept of personal jurisdiction -- the freedom of a government to take action against a particular person for the purposes of enforcing a law -- is largely based around the idea that a "sovereign state" has personal jurisdiction over the persons and activities within its territory. But in many times and places this has not been so. Under the system of political property rights in most of medieval Western Europe, for example, the kings had their political property rights, and the lords had theirs. Both were governed by the same basic laws of property, including laws of right (title), trespass, and inheritance. The result was a sophisticated system of jurisdiction based on property rights rather than sovereign rule.

Both kings and lords had an incentive to respect each other's political and economic property. This is illustrated by a speech that Shakespeare puts into the mouth of Duke of York in Richard II, when King Richard is threatening to (under somewhat dubious legal arguments) confiscate the exiled Duke of Hereford's estates and franchises (i.e. both his economic and political property rights). Indeed, a major theme of the tragedy is that since the king failed to respect political property rights, his own end up being overturned. Note that "royalties" and "franchises" are synonyms used for political property rights -- they are the same kinds of property rights as the king himself holds, and alliterative redundant pairs like (e.g. "royalties and rights") were common in legal language as well as in Shakespeare:

O my liege,
Pardon me, if you please; if not, I, pleased
Not to be pardon'd, am content withal.
Seek you to seize and gripe into your hands
The royalties and rights of banish'd Hereford?
....
Take Hereford's rights away, and take from Time
His charters and his customary rights;
Let not to-morrow then ensue to-day;
Be not thyself; for how art thou a king
But by fair sequence and succession?

The king's own rights to his realm are, in other words, based on the same property law as the jurisdictions of the dukes, burghers, and other franchise owners. Abrogate the law for others and it could easily be abrogated for the king. But the long era of political property rights would end with the coming of republicansim and democracy because Parliament and other legislatures do not share this coincidence of interests. Only the dawn of an independent court saved economic property rights in England and America -- but it was insufficient to save political property rights, especially those of jurisdiction which the "sovereign" courts seized for themselves.

The late medieval English case of Upton v. Le Mazerer provides a great illustration of personal jurisdiction based on political property rights rather than sovereignty. To get the most out of the following you should have a basic idea what a life estate and reversion are. The basic issue of the case is whether the the tenant holds property of the lord as a "sokeman" tenant (in which case the lord has jurisdiction) or whether the lord had granted the tenant a release from jurisdiction, making the tenant a "frank" tenant which meant the king had jurisdiction. The meanings of all these will become clearer as you read through the following description of the case, taken from my paper "Jurisdiction as Property."

Our cast has several players:

(1) Lord Hugh, ancestor of the current lord.

(2) Hugh, a tenant of the Lord Hugh. As the curtain opens on the facts of the case, Hugh is a sokeman tenant of Hugh the lord, and thus Hugh the lord starts with personal jurisdiction over Hugh the tenant.

(3) The current lord, heir of Lord Hugh.

(4) The current tenant, heir of Hugh the tenant.

In Upton v. Le Mazerer a “writ of right according to the custom of the manor,” a dispute over lands of the manor, was removed...from the manorial court because the tenant party claimed to hold in frank-fee rather than as a sokeman of the lord of the manor. If this was the case the king, not the lord of the manor had personal jurisdiction over the tenant.

The agreed facts were that Hugh, ancestor of the current lord, had granted to Hugh, a sokeman tenant (i.e. a tenant then under the jurisdiction of Hugh the lord), the same lands that Hugh already held of his lord, but in “frank,” thus releasing Hugh the tenant from the lord’s to the king’s jurisdiction. The current tenant, a successor to the tenant Hugh, claimed the grant was frank-fee, i.e. [in the king's jurisdiction] “for all time”, while the current lord, an heir to Hugh the lord, agreed that it was a grant of freedom from the lord’s jurisdiction but argued that the grant was only for “a term of life.” The current lord, heir of Hugh the lord, argued that “we are claiming these tenements as ancient demesne from the seisin of [our] ancestor, which is higher in time than this deed” In modern terms, the lord of the manor was claiming that the tenant now held only the reversion of the life estate, which was just the original sokeman fee held of the lord of the manor, and thus that the lord of the manor had regained jurisdiction over the tenant. The outcome of the case thus hinged on whether the grant adding to the tenancy freedom from the lord’s jurisdiction was for a term of life or a perpetual fee. The outcome of this factual issue was not reported, but the reporter observed that “if it be found that Hugh [the tenant] had fee, the original writ, which remained in the lord’s court, would abate...[a]nd if it be found that he only had for a term of life, then the parties shall go back to the lord’s court, and plead with regard to the original etc.” The personal jurisdiction of each court was entirely contingent on the outcome of the property issue: as one Scrope (either a justice favorable to the lord, or one of the lord’s barristers) observed, “[t]he scope of the averment is only to determine whether the tenements ought to be tried here or sent back to the lord’s court.” The reporter also noted main property law issue on which jurisdiction hinged: “[w]hen a man recovers tenements from his ancestor’s seisin, he shall recover the tenements in the state wherein his ancestors held them, and all deeds made in the meantime between the ancestor’s recovery and the seisin will be defeated by this recovery.”

Smart contracts watch

Cell phones can be used to monitor and pay for parking. This system and this one are pretty clumsy in terms of all the gratuitous user input required, but as has occurred with prepaid cell phones I expect this to become quite a bit more user-friendly in the future. It will be very nice to be able to top up the parking meter without having to return to the car.

As usual remember that any information recorded (here, where and when you park) "can and will be used against you." For example it can generally be subpoenad for use in court, as also occurs with credit card records, phone records, and automated toll systems. My old boss David Chaum, his student Stefan Brands, and others in the advanced cryptography community have designed many protocols that would preserve privacy in these scenarios, but the deployers of these technologies are usually not terribly interested in your privacy. Your recourse -- keep using physical cash, and take the trouble to go back to your car to check and stuff your parking meter.

In my original writing on smart contracts I talked about trading derivatives and constructing synthetic assets with low transaction costs:

Very complex term structures for payments (ie, what payments get made when, the rate of interest, etc.) can now be built into standardized contracts and traded with low transaction costs, due to computerized analysis of these complex term structures. Synthetic assets allow us to arbitrage the different term structures desired by different customers, and they allow us to construct contracts that mimic other contracts, minus certain liabilities. As an example of the latter, synthetic assets have been constructed that mimic the returns of stocks in German companies, without requiring payment of the tax foreigners must pay to the German government for capital gains in German stocks.

A bit later I figured out that the primary barrier to such activity is mental transaction costs. These costs throw a monkey wrench into what is otherwise the very good idea of consumer derivatives. One can imagine a wide variety of consumer derivatives, such as buying insurance against air fare changes and the growing business of selling sports tickets based on personal seat licenses (PSLs). I have sketched some possible solutions to the mental transaction problem, such as the market translator. The main problem is designing an automated agent that can figure out user preferences without bothering the user -- usually by recording and analyzing the user's normal behavior. If this can be fully automated the bottom drops out, so to speak, and even nanobarter becomes possible.

Smart contracts, based on digital property, open up a vast new space of possibilities. Many of the digital machines you own can obtain good information about your usage and their own status, from which they could at least crudely estimate what you want to buy. Take parking, for example. A suitably smart car and parking meter system should be able to figure out where you want to park and how much you want to pay for it, with minimal user intervention. I'm not talking anything like "AI" here, just computerized cars and parking meters that have sufficient sensors, can communicate with each other, and use known algorithms. As you are driving down the street, you tell your car that you want to find a parking place. The price of open parking spots ahead starts popping up on your dashboard. You choose and agree to pay the fee by simply parking in the spot.

Along with this future urban lifesaver, parking spot derivatives would be very useful. For the same reasons as stadium owners sell PSLs -- to receive revenue up-front to help pay the cost of building the infrastructure -- owners of parking spaces could sell parking space licenses (PSL again, oops :-). The owner of the PSL, in turn -- or said owner's car acting as his agent -- could sell the hours or minutes that the car is not using. You could buy a PSL and thereby reserve that sweet spot right next to your downtown office for the year. Then sell off the parking rights for the weekends. You could reserve a spot next the your favorite club and sell off all the times except Thursday through Saturday night. And if you are away from the office or staying in for the evening, your car's market translator can price and offer the space and it will become open and start popping up on driver's dashboards.

This kind of thing is just the tip of the iceberg as far as the potential of smart contracts is concerned.

Finally I will report on a digital cash system from no less than our frequent commentor Daniel Nagy. Nagy makes the following observation:

While everyone with a cellular or a touch-tone telephone, a web-browser or email client in its readily available, out-of-box configuration is able to transmit short messages (up to a few hundred bits), performing complex calculations involving strong asymmetric cryptography requires additional tools which not everyone possesses or can afford to run. The fact that it is impossible to transact without performing complex calculations in real time is a far more serious obstacle than the need to contact the issuer for each transaction.

This is an interesting approach, but I suspect may be correct only in the limited sense that these devices and software don't come built-in with the particular cryptographic protocols needed for strongly private cash (e.g. Chaumian blinding). But they don't come built-in with digital cash software either. Thus, the main advantage of Nagy's scheme, which may or may not make up for its reduced privacy features, comes from the ability to use it without having to install any extra software at all -- to just, for example, cut and paste the cash from an e-mail where you received it from one person to an e-mail where you pay it to another. Your word processor can be your wallet. If this is an important use-case, then Nagian cash may succeed where Chaumian cash failed.

Another payment system of note is WebMoney, which recently started up a gold-backed currency, a competitor to the troubled e-gold. (HT: Financial Cryptography)

Exit and freedom

Why did the early United States have much stronger property rights and far lower taxes than today, even though it is nominally governed by the same political form and a constitution that has undergone only a few amendments? Why do Hong Kong and Singapore currently lead the world in economic freedom? Why did the fall of the Berlin Wall spell the end of European communist states? What political changes or changes to our own lives would give us stronger property rights and lower taxes?

What stands out about Singapore and Hong Kong --and other entities that have the most economic freedom in their region, such as Bahrain in the Arab Middle East -- is that they specialize in international trade. To encourage business travel, they must put few restrictions and tax penalties on travel. Large proportions of their population have strong international social ties. Large proportions of the population of these countries could easily move out of the country if their local rights were violated. Strong international personal and business ties allow them to quickly reestablish themselves in a different, but not so foreign, country.

In other words, when a small country specializes in mediation of international trade, the exit costs for the people from whom it collects most of its tax revenue is low. To maintain their tax revenues they must maintain a productive international trade business, and to maintain international trade these governments must thus maintain low exit costs for a large proportion of their population.

Laffer curve of tax rate versus tax revenue (black) and corresponding curve of GDP (green). When governments maximize tax revenue the prosperity and economic freedom of their taxpayers suffer. Credit: Mark Byron.

Governments of almost any form try to maximize their tax revenues, and government employees also often gain personal satisfaction from being able to control the lives and property of others (this goes under various euphemisms, such as the ambitions to "change the world" and "make a difference.") This process is facilitated primarily by high exit costs and is limited almost only by limits on governmental ability to increase exit costs. The maximum point on theLaffer curve -- the most tax that a government can collect -- is lower and occurs at a lower percentage tax rate in countries where exit costs are low. Thus the tax rates inHong Kong, Singapore, and Bahrain are lower than among their culturally similar neighbors that do not specialize in as internationalimermediaries.

At the other end of the spectrum from Hong Kong and Singapore are countries with isolated populations, with poor access to world communications and travel. Add to this countries where tax revenues can be gained from taxing agricultural land or minerals rather than potentially mobile "human capital." These countries tend to have the fewest freedoms. Even among highly developed countries, those with more homogeneous populations that speak a tongue seldom spoken outside the country -- and thus far stronger internal than international social ties -- tend to tax their "human capital" the most, e.g. the Scandinavian countries.

In other words:

(1) the governments of Singapore and Hong Kong have to encourage free travel to and from many other countries, to encourage the constant human interchange that is essential to international trade, making it impractical to set up onerous travel restrictions,

(2) most residents of Singapore and Hong Kong have strong social ties -- both business and personal -- outside the country, and

(3) the vast majority of residents of almost all other countries are tied to their territories by strong internal social networks and the lack of external social networks that could support them if they needed to escape. That makes it easy for governments to tax, regulate, and control the residents, for the same reason that it's easy for prison guards to abuse inmates -- it's hard to escape.

The American colonies and the early American republic both had remarkably strong property rights and very low taxes by our standards, despite sharp changes in the form of government. With few changes in the form of government since, taxes have risen almost tenfold and property rights often now mean little more than the right to keep after-tax capital gains.

The answer to this American puzzle is again exit costs. Farmland was the dominant form of wealth in the 18th and early 19th century, and practically free yet very good farmland was available in America on the western frontier. Any oppression, any high taxes or other violations of property rights could be countered by pulling up stakes and moving west. If you didn't want your local farmers to leave you had to respect their rights, in sharp contrast to the traditional form of agriculture where serfs were stuck on the land. On the other hand, black slaves in the U.S. provide a sharp contrast to the remarkably free white farmers -- a condition explained by state and federal fugitive slave laws, which spread a virtual Iron Curtain for slaves across the entire vast expanse of the United States, in free states as well as slave states.

Human capital is very easy to tax when it gathers in large organizations, such as modern corporations, as these organizations must be audited, and auditing provides the information needed for the income tax, by far the most lucrative form of tax ever developed. When America's frontier disappeared, when the good agricultural land was claimed and industrial wealth became more important than agricultural wealth, and industrial wealth was flowed in easily audited forms through corporations and to their employees, taxes rose and property rights for all started to erode, a process that continues to this day.

Countries that depend on human capital, as almost every country these days does, often throw up legal barriers to exit. Countries that worry about "brain drain" sometimes charge extortionate passport fees. These are examples of countries erecting virtual Berlin walls in order to raise the exit costs of their countries, suppress jurisdictional competition, and thus increase their tax revenues. Another form of this are long-arm statutes, especially when used to collect taxes on companies that have only "minimal contacts" with a jurisdiction.

Why are governments imposed on us rather than chosen? Why can't we shop for countries like we shop for cars? Why has progress in jurisdiction shopping movements such as the Free State Project been so slow? Because interstate travel is considered a fundamental right under U.S. law, the exit costs imposed by law on moving from state to state are very low. The slow progress of the Free State Project points up several factors:

(1) that many, if not most, taxes and other violations of property rights considered onerous come from federal rather than local governments, and moving just from state to state within the United States does not avoid these,

(2) that no state, not even New Hampshire, is so remarkably better than any other state to motivate many people to move, and

(3) that local social ties -- whether for personal or business relationships -- are much more expensive for most people to break than the gains to be had from increased economic freedom between one state and another.

In the United States and today in most of the world, exit costs are imposed primarily by the ways we live our lives -- and in particular by our personal and business networks -- not by artificial Berlin wall like barriers. Modern deprivations of liberty have much more to do with this fact than with the oftenexaggerated differences in forms of government or with supposedly crucial rights such as the right to vote. Today, never in the United States have so many people had the right to vote, yet never in the United States have we had so high taxes and so few property rights.

With the fall of communism, for most people in the world government restrictions on exit are no longer the dominant barrier to exit. Our lack of liberty has rather to do with the fact that the vast majority of our strong social ties lie within a territory monopolized by a nation-state. Any form of large modern nation-state that we can practically expect to encounter, as well as any state of any size that restricts emigration, will engage in extortionate deprivations of property that many people in many earlier times and places, such as colonial America, did not tolerate.

How, then, can one best protect one's rights? By living one's life in a way that makes exit costs low:

Be prepared to vote with your feet. Add interstate and international diversity to your social networks -- both personal and business. Lower your costs of exiting, if the need should arise, the jurisdictions that impose on the territories wherein you reside. Repeatedly in history -- from the old American frontier to the fall of the Berlin Wall to modern jurisdictions that specialize in international trade -- low exit costs have not only enabled liberty for the individual and the small group, but they have more than any other factor motivated the larger jurisdiction to provide the most important rights and freedoms for those who stay put. Grow interpolitical roots so that no single polity can chop down your tree. The good news is that modern communications, travel, and standardization of international languages (mostly on English) have made diversifying our social networks -- growing international roots - far easier than ever before in history.

Despite the closing of physical frontiers, which has had an extremely deleterious impact on freedom, other trends may be bringing about the lowering of exit costs. International communications networks and the international standardization on a few languages (and perhaps even just one, which quite fortunately for my readers is the one I'm currently writing in), combined with low international travel costs, are leading to the development of more strong personal and business social ties that cross borders. Multinational small businesses are joining multinational corporations in developing cross-border business ties.

But there are also many threats by governments to re-establish or increase exit costs by throwing up virtual Berlin walls and fugitive taxpayer networks. Extraterritorial assertions of jurisdiction, especially of tax jurisdiction, threaten to throw up enforcement networks akin to the old fugitive slave laws in the antebellum United States. Freedom of travel is being threatened by paranoid responses to the overblown threat of terrorism -- but at least one good group is fighting to counter this threat. To counteract these threats, basic freedoms must be protected by our courts from encroachment by other governmental branches. The U.S. Supreme Court counts both voting and interstate travel as fundamental rights. Of these fundamental rights, travel -- but especially international travel -- the right to pass through the airports and Brandenburg Gates and Checkpoint Charlies of the world -- is by far the more important.

Our new omniscient savior

"I hear from so many people that realize that they're just invisible to their government ... but they won't be invisible to me."

Hillary sees me! All hail Clinton, full of grace.

UPDATE: This is, of course, nothing new.

Ten ways to make a political difference

Ten ways to be an effective political activist, in a roughly decreasing order of importance:

1. Be prepared to vote with your feet. Add interstate and international diversity to your social networks -- both personal and business. Lower your costs of exiting, if the need should arise, the jurisdictions that impose on the territories wherein you reside. Repeatedly in history -- from the old American frontier to the fall of the Berlin Wall to modern jurisdictions that specialize in international trade -- low exit costs have not only enabled liberty for the individual and the small group, but they have more than any other factor motivated the larger jurisdiction to provide the most important rights and freedoms for those who stay put. Grow interpolitical roots so that no single polity can chop down your tree. The good news is that modern communications, travel, and standardization of international languages (mostly on English) have made diversifying our social networks -- growing international roots -- far easier than ever before in history.


2. Influence our law in action. Serve on a jury and insist on protecting those who have not been proven to harm or intend to harm another.

3. Make your own law. For starters draft your own contracts, wills, prenuptial agreements, and property deeds. Even better if you can do this as a service for other people, but for that you will generally need to be a member of the appropriate legal guild. To draft law usefully, whether for yourself or others, you will need to learn the real law they don't normally teach in public schools: contracts, property, trusts and estates, and torts for starters, or else (often a second best choice to learning law yourself) retain the services of a sympathetic lawyer. Learn actual law -- don't turn into a whacko running around putting liens on other people's property based on interpretations of the UCC quite remote from what any judge would contemplate. But do start to make your own law. You cannot be free if you cannot make your own law.

4. Influence our law in action. Donate to or get involved with the Institute for Justice and other organizations of politically and legally savvy people defending our most important rights and freedoms in the courts.

5. Make your own law: use strong security to protect the people, relationships, property, and data you value. Learn to defend yourself and your loved ones with weaponry. Write and use cryptography, smart contracts, bit gold, digital cash, and other security protocols made possible by computer science.

6. Tell us about your good research and good ideas: write a blog, comment on a blog, write papers.

7. Start a multinational small business.

8. Vote with your pocketbook -- buy and sell the goods, services, stocks
and bonds that promote liberty, and boycott those that promote its
violation.

9. Get involved in a lobbying group or political campaign where you can make a difference: usually a local campaign, but on rare occasions a national one.

10. Vote for and against politicians, but don't be fooled -- of all these
ten ways to make a political difference, voting in a political election makes the
least difference.

Government for profit

There are may examples of coercive political power both today and in history that don't fit in to the academic idea of "the state" as a "monopoly of force." Federalism, separation of powers, and many examples of legally "taking the law into one's own hands" are just three categories of examples. Here, we look at another, mostly forgotten but once ubiquitous category from history: political power wielded by private individuals or commercial organizations, with profits or the equivalent as a primary incentive of the organization.

These were entities quite different from both modern governments and modern economic corporations. These wielders of coercive power for profit combined the efficiency of private enterprise with the often ruthless coercion of government.

In the Roman Republic there were a number of corporations that were granted various kinds of political power. The most notorious were the publicani, the ruthlessly efficient tax farmers. Tax farmers were private contractors to governments or other coercively funded entities (such as colonial corporations, examples of which we will see below). Through history tax farmers have been famed and reviled for their efficient operations and ruthless treatment of taxpayers. The publicani, for example, deployed crucifixion and other forms of torture to extract financial information from their victims.

Tax farmers were, however, at least more honest than modern tax collectors. Tax farmers knew who their customers were -- governments or other coercively funded organizations. Like any other collection agency their customers were the creditors, not the debtors. They never propounded the pathetic mythology of some modern government tax collectors that their quite involuntary debtors, rather than their respective governments, are their "customers".

It is not well understood by Romanist moderns that monarchy was based, not primarily on Burkean romantic worship or the divine right of kings, but rather on the political property rights of an individual and his heirs. The laws of inheritance for a monarch were usually the same as those for land. Furthermore, at most places and times the monarch did not have a monopoly of political power, but rather by prescription or grant many other entities -- nobles, burghers, and corporations chief among these -- also held political property rights. Modern "titles" are the shell of a system that once involved extensive political property rights. As I described in my paper "Jurisdiction as Property", the most basic aspects of the medieval and Renaissance English legal system -- from which much of the modern writs, common law, and constitutions of England, Commonwealth and United States legal systems are derived -- were the laws that defined the rights and trespasses involving political property.

After a long lapse from the records of history, the Roman corporate form reanimated in the form both of independent cities -- municipal corporations that gave rise to republics -- and in forms like the Genovese maone and similar organizations in other late medieval Italian republics. The maone issued securities that acted much like stock shares, effectively paying dividends, although technically they were treated as debt instruments rather than ownership shares. They engaged in colonial conquests and administration, tax farming, or other subsets of governmental functions. A fuller account of the maone and their role in originating the modern corporation can be found here.

Sir Francis Drake, commander of joint-stock navies.

There is also a long history of armed forces for profit -- of mercenaries, private escorts, privateering, and sheer piracy. The main colonial companies, such as the East and West India companies of Britain, the Netherlands, and other colonial powers, deployed their own naval forces to protect their own fleets and on occasion to attack rival shipping. Among the first English joint-stock corporations were the temporary joint-stock companies set up by Drake and Hawkins to trade with the Spanish colonies (from the Spanish point of view to smuggle) and raid the Spanish gold and silver fleets.

Despite their profit motive, which put a premium on trading and raiding rather than defense, these private navies also successfully defended England. The battle of against the Spanish Armada was won, not by the Royal Navy (which did not yet exist), but by the joint-stock naval corporations of Drake and Hawkins. Drake's circumnavigation of the globe in 1577-80 was also funded by a joint-stock company created for the purpose. The profits came from trading/smuggling and privateering against the Spanish Main.

Most of the British colonies overseas (and many of those of Brtitain's rivals) were organized as corporations for profit, and most of these at one point or another issued stock. The political consequences of such corporate colonies were highly controversial and highly varied. In America, the corporate charters guarunteed "the rights of Englishmen"; that and a large frontier (and thus low exit costs) produced a very libertarian political system. Some American charters, such as the Massachusetts Bay Company, guarunteed that all freeholders of land within the corporation's land grant could vote on the corporate by-laws, which effectively became the laws of the land. This set the stage for two of the most distinctive characteristics of the later United States -- both its democracy (in contrast to their status in England, most early English settlers in America were landowners ("freeman") and thus entitled by charter to vote) and its written constitutions enforced by judicial review (because the charter -- in modern corporate parlance the articles of incorporation -- trumps mere legislation -- in modern corporate parlance the by-laws).

Charter of the Massachusetts Bay Company, 1628

In Africa, by sharp contrast, the main business was slaving, and the charters of the African corporations authorized them to wield martial law, which they did with ruthlessnes. The most infamous of these African companies operated, however, after the era of individual slavery had ended. Instead of overt slavery the Congo Free State instituted a system effectively worse than slavery -- a tax system based on in-kind payments of rubber. The barbarous cruelty of the resulting system was immortalized in Joseph Conrad's Heart of Darkness.

In between these political extremes, the East India Companies and many other colonial companies operated across the globe, at first assisting local entities in military, tax collecton, and administration, but eventually taking over these governmental functions and reaping often immense profits as a result. They brought literacy and very efficient and modern administration but also often engaged in an exploitation that was widely percieved as so ruthless that the East India Company became profoundly unpopular and was eventually nationalized.

Administration by the colonial companies was usually far more efficient, for example in terms of European manpower deployed, than the later administration by the governments of European powers when these companies were nationalized in the 19th and 20th centuries. By the end of the 18th century these companies had become highly unpopular in government circles. The rise of democracy and the Romanist ideology of the monolithic state spelled their doom. Ideologists and scholars as varied as Adam Smith, Edmund Burke, and Karl Marx railed against the depradations of the colonial corporations. For Marx these epitomized the evil of capitalism generally, whereas Smith and Burke were careful to distinguish the wielding of coercive political power, which they found particularly destructive in this form, from the wielding of voluntary economic power, which they found highly beneficial.

Besides the links above, here are some further references:

E. Burke, "The Nabob of Arcot's Debts" -- a screed against the exploitation of "the Carnitic" (part of modern India) by the British East India Company

Charter of the Massachusetts Bay Company (1628)

G.R. Elton, England Under the Tudors, Third Edition (1991)

H.C. Hockett, The Constitutional History of the United States, 1776-1826 (despite the title has some good descriptions of pre-Revolution developments including corporate colonies and judicial of local legislation against the corporate charters)

A. Smith, The Wealth of Nations (esp. Book 4, Ch. 7 "Of Colonies")

N. Szabo, Charters and Judicial Review

N. Szabo, Origins of the Joint-Stock Company

N. Szabo, Jurisdiction as Property