Bitcoin Is Time

Reprinted from: Bitcoin Is Time

A luminary clock hung high in the sky, proclaiming that time was neither wrong nor right. — Robert Frost, “Acquainted with the Night” (1928)

We still have not fathomed the great mystery that is time. Time is only a concept; we do not even know whether it really exists… — Clifford D. Simak, “Shakespeare’s Planet” (1976)

As the saying goes, time is money. Conversely, money is also time: time is all the economic energy stored within the human body. Yet the relationship between time and money is far more complex than it first appears. If creating money required no time, money would not be money at all — or at least could not function as money for long. Think one level deeper: to track things in the world of information is to track time.

Once money becomes digital, we must reach a consensus on the definition of time — and that is where the problem lies. Perhaps you think telling the time is as simple as glancing at the clock beside you. For everyday tasks, that way of thinking is fine. But if you want a global distributed network, in which people each act on their own, to advance its state in sync, telling the time becomes an enormous problem. If clocks cannot be trusted, how do you obtain the correct time? If your system spans galaxies, how do you establish a concept of time? In a world without clocks, how do you measure time? What is time, exactly?

To answer these questions, we must further explore the concept of time, and how Bitcoin created its own unit of time (block time — that is, what we usually call block height). The questions we will explore include: Why does timekeeping ultimately become tied to bookkeeping? Why is there no absolute time in a decentralized system? How does Bitcoin use causality and unpredictability to define the tense of “now”?

Timekeeping devices have repeatedly brought about great changes in civilized society. As Lewis Mumford said in 1934: “The key machine of the industrial age was not the steam engine, but the clock.” Today, timekeeping devices are once again driving a transformation of modern civilization: the key machine of the information age is not the computer, but the clock. And that clock is Bitcoin.

I. Tracking

“Let the child learn to count things, and thereby gain the concept of number. In counting, these things may be treated as if they were all exactly alike, whether they are single objects or groups of objects.” — David Eugene Smith, “The Teaching of Elementary Mathematics” (1900)

In general, we can track items in two ways: physical tokens and ledgers. You can directly use objects from the real world — for example, shells, coins, or other tangible things (to express the corresponding quantities); or you can replicate the state of the world by writing down, on a piece of paper, the things that have happened.

Imagine you are a shepherd who wants to make sure every sheep returns home. You could put a collar on each sheep, and whenever a sheep comes home, take off its collar and hang it in the shed. Suppose each collar hangs on its own hook: as long as every hook is full, all the sheep are home. Of course, you could also count them each time and draw up a list. However, every time you start counting, you would have to draw up the list afresh, to prevent double counting or missed counts.

Money is essentially a tool for tracking debt. In general, everything that has ever served as money falls into two categories: physical artifacts and lists of information. In more colloquial terms: tokens and ledgers.

Understanding the essential difference between these two kinds of money is important. Let me state it clearly here: physical tokens directly represent the state of things; ledgers indirectly reflect the state of things. Each has its advantages and disadvantages. For example, tokens are physical and distributed, while ledgers are informational and centralized; tokens are inherently trustless, while ledgers are not.

In the digital world, we can only use ledgers (even though there are always many “masters” who would have you believe there is another way). This is the world of information, not the world of matter. Even if you define some type of information as a “token,” it is still a piece of malleable information written to a hard drive or some information storage medium, presented in the form of an information record.

All digital information is essentially a ledger — and this is the root of the “double-spending” problem. Information never directly represents the state of the world. Moreover, the movement of information also means that information can be copied. Information exists somewhere. To “move” information, you must copy it to another place and then delete the original information. The material world has no such problem: moving is moving, and it does not imply copying. The information world does not have this property. If you want to “move” information from table A “to” table B, you must copy the information from table A to table B. There is no other way.

Another way of thinking about this is “uniqueness.” Physical tokens are unique combinations of atoms and cannot be easily copied. Pure information does not have this property. As long as you can read a piece of information, you can copy it perfectly. Therefore, we can draw this conclusion: physical tokens have uniqueness; digital tokens do not. I would even argue that the term “digital token” is questionable. A token can represent secret information, but it can never represent information that is one-of-a-kind and uncopyable.

This difference in properties shows that information actually cannot be “handed over.” A digital token cannot be transferred the way a physical token can, because you cannot be sure whether the original owner has destroyed the information. Like all information, a digital token can only be spread, like an idea.

“…If you have an apple and I have an apple, we can exchange apples, and afterwards each of us still has one apple. But if you have an idea and I have an idea, after we exchange, each of us has two ideas.” — Charles F. Brannan (1949)

Physical tokens (what we call physical bearer assets, or “cash”) do not face this dilemma. In the real world, if you give me a coin, you no longer have that coin. There is no magic in this world that can copy that coin; for me to obtain a coin, a coin must be handed to me. The laws of the physical world prevent double-spending.

Although multiple spending does occur in the non-digital world (the notorious con artist George Parker made money by selling the same property to many buyers — and what he sold were landmark buildings such as the Brooklyn Bridge), it requires an elaborately designed scam and gullible buyers. The digital world is different.

In the digital world, since we are always dealing with information, multiple spending is an inherent problem. Anyone who has ever copied a file or used copy-and-paste knows that information can be copied perfectly, and that it is not bound to the medium that stores it. Suppose you have a digital photo: you can copy it a million times, store some of the copies on a USB drive, and send it to thousands of people. Perfect copies are achievable because perfect correction methods can be used to eliminate every flaw. Most importantly, copying is nearly zero-cost, and copies are indistinguishable from the original.

Let me say it again: for information, there is only copying. Digital information cannot be moved from A to B; it can only be copied from A to B. Only if the copy succeeds and the original at A is then deleted can we call it “moving.” This is why the double-spending problem is so thorny. Without an authority, there is no way to transfer any information from A to B without counterparty risk. We must trust that the original will be deleted. A natural side effect is that, as far as digital information is concerned, we cannot determine how many copies exist, or where those copies are.

Therefore, digital tokens can never serve as money. Tokens are reliable because their unique physical construction makes them hard to copy. In the digital world, this advantage vanishes. In the digital world, tokens cannot be trusted. Because of the inherent properties of information, the only viable form of digital money is a ledger, not a token. Digital money therefore has no choice but to confront the problem of time.

II. Tokens Are Timeless; Ledgers Are Not

“For the things which are seen are temporal; but the things which are not seen are eternal.” — Paul of Tarsus, Corinthians 4:18b

For physical tokens, it does not matter when a transaction happened (where your money came from). Either you have money in your pocket, or you don’t. Either you spend it, or you don’t. The only precondition for spending money is having money in your pocket. Everything else is left to the laws of nature. In this sense, physical tokens are trustless and timeless.

For ledgers, physical possession is not so important. The person managing the ledger needs to make sure all accounts are in good order. The properties originally conferred by the laws of physics (you cannot spend money that is not yours, and you cannot spend the same money twice) must be enforced by man-made rules. It is these rules (not the laws of physics) that keep a ledger operating in an orderly fashion.

The shift from the laws of physics to man-made rules is where the crux of the problem lies. The latter can be altered and broken; the former cannot. For example, you cannot “counterfeit” a physical gold coin — you have to dig gold out of the ground. But you can counterfeit a gold coin on paper. You only need to add an entry to a ledger claiming that you have some gold coins. If you are a central bank, you only need to tap a few keys on a computer to issue trillions of dollars. (People in finance call this “rehypothecation,” “fractional-reserve banking,” and “quantitative easing” — but do not let these fancy terms confuse you; in essence they are all counterfeiting money.)

To ensure that the ledger and the people managing it are not cooking the books, we must audit the ledger independently on a regular basis. Verifying every entry in the ledger is no great feat. Auditors must be able to inspect past books to ensure the reliability and validity of the ledger. Without reliable timestamps, we cannot verify the internal consistency of a ledger. We must establish a mechanism to determine the order of transactions.

If there is no absolute concept of time, we cannot determine the order of transactions. If we cannot determine the order of transactions, we cannot guarantee that a ledger is not forged. Besides this, what other way is there to prove how much money you own? What other way is there to ensure that all accounts are in good order?

The difference between tokens and ledgers highlights the necessity of tracking time. In the physical world, money is a timeless artifact that can be used in transactions without anyone’s supervision. In the digital world, marking money requires timestamps.

III. Centralized Money Tagging

“Time can carve its mark on everything, and erase every mark as well.” — Yahia Lababidi (b. 1973)

The most common method of solving the double-spending problem (ensuring that each digital transfer happens only once) is to create a centralized list of transactions. Once you have a centralized list of transactions, you have a ledger that can serve as the single source of truth. At that point, solving the double-spending problem is simple: just carefully check the list of transactions and make sure every entry is correct. This is how PayPal, Venmo, Alipay, and every bank in the world (including central banks) solve the double-spending problem: authority.

“The problem with this solution is that the payee cannot verify whether one of the previous owners did not double-spend the coin. The usual solution is to introduce a trusted central authority, or mint, to check every transaction for double spending… The problem with this solution is that the fate of the entire money system depends on the company running the mint, since every transaction must go through the mint, which is just like a bank.” — Satoshi Nakamoto, “The White Paper”

It should be noted that Satoshi Nakamoto could not make information uncopyable. Every part of Bitcoin (the source code, the ledger, users’ private keys) can be copied. All of it can be copied and tampered with. However, Satoshi succeeded in creating a system in which copies that violate the rules are rendered useless. The Bitcoin network employs a complex mechanism to decide which copies are useful and which are not. It is this mechanism that brought scarcity to the digital world. This mechanism is like a dance, in which the rhythm must be controlled.

Even a centralized ledger must adopt a unified way of tracking time in order to solve the double-spending problem. When a transaction occurs, we must know the transacting parties, the amount — and, most importantly, the time of the transaction. In the realm of information, money cannot be tagged without timestamps.

“It must be emphasized that, since we have consistently failed to solve the problem of associating events with points in time in distributed systems, a decentralized ledger was impossible — until Satoshi Nakamoto invented the solution.” — Gregory Trubetskoy (2018)

IV. A Decentralized Clock

“Time brings all things to pass.” — Aeschylus (525 BC to 456 BC)

Time and ordering are very closely related. As Leslie Lamport stated in his 1978 paper “Time, Clocks, and the Ordering of Events in a Distributed System”: “The concept of time is fundamental to our way of thinking. It is derived from a more fundamental concept, namely, the order in which events occur.” Because there is no central coordinating point in time, seemingly intuitive concepts such as “before,” “after,” and “at the same time” have no reference point. In Lamport’s words: “The concept of ‘happened before’ defines the invariant portion of the ordering of events in a distributed multi-process system.”

In other words: if we cannot have someone be responsible for managing time (for timekeeping), how do we determine the order in which events occur? Without a central frame of reference, how can we obtain a reliable clock?

You might think this problem is easy to solve, because everyone can use their own clock. But this method only works if everyone’s clock is perfectly accurate (and everyone follows the rules). In a system where people have opposing interests and conflicts of interest, everyone using their own clock would be a disaster. Moreover, according to relativity, this method cannot work across space.

Consider a thought experiment: suppose you live in a world where everyone tracks the order of events themselves — how could you deceive others? You could pretend that a transaction you sent today was actually yesterday’s (delayed for some reason), so that the money you spent today would still be yours. Since every decentralized system is inherently asynchronous communication, the scenario above is not merely a theoretical thought experiment. Messages really do get delayed, and timestamps really are inaccurate. Add to that the effects of relativity and the natural speed limit of the universe, and it becomes very difficult to distinguish the order of events without a centralized authority or observer.

“Who’s there? Knock knock.” (“Knock knock!” “Who’s there?”) — A classic pun

To better illustrate this problem, let’s look at a concrete example. Imagine that you and your business partner can both access your company’s bank account. Your business spans the globe, so you opened the bank account in Switzerland; you yourself live in New York, while your business partner lives in Sydney. On your side it is January 3, and you are comfortably spending a weekend evening at a hotel. On your partner’s side it is already Monday morning, and she decides to use the debit card of the shared bank account to buy breakfast. At that moment, the card balance is 615 dollars. The local time is 8:21 in the morning. Her breakfast costs 27 dollars.

At the same time, you plan to use another debit card linked to that bank account to pay for your lodging. At that moment, the card balance is 615 dollars. The local time is 5:21 in the afternoon. The lodging costs 599 dollars.

That is to say, the two of you swiped your cards at the same moment. What happens? (Physicists, please forgive me for using the expression “the same moment”; here we will temporarily ignore the effects of relativity and the fact that there is no absolute time in the universe. We must also assume that the concept of simultaneous events exists. Bitcoin itself is complicated enough!)

The bank’s central ledger will most likely receive the two transactions one after the other, so one of you is bound to be the lucky one and the other the unlucky one. If the central ledger happens to receive the two transactions at the exact same instant (down to the millisecond), the bank must decide which of you gets to spend the money.

But what if there is no bank? Who decides the order of the transactions? What if it is not just the two of you, but hundreds or even thousands of people transacting at the same time? What if you do not trust these people? What if someone wants to do evil — for instance, turning their clock back and pretending their transaction happened a few minutes ago?

“We need a tool related to time to create a generally accepted ordering and to maintain a unique history without relying on any central coordinator.” — Giacomo Zucco, “Discovering Bitcoin” (2019)

This is why all previous attempts at digital cash could not do without a centralized registry. That is to say, we must trust someone in order to correctly decide the order of affairs. We need a centralized participant to act as a centralized clock.

Bitcoin’s method of solving this problem is to redefine time. Bitcoin measures time in blocks, not seconds.

V. Blocks as the Unit of Time

Time’s glory is to calm contending kings;

To unmask falsehood, and bring truth to light;

To stamp the seal of time in aged things;

To keep watch through the night, and wake the dawn;

To wrong the wronger, till he render right;

— Shakespeare, “The Rape of Lucrece” (1709)

All clocks rely on a regular process — what we commonly call the “tick” (the sound of seconds passing). In essence, there is no difference between the ticking of a grandfather clock and the humming of modern quartz clocks and atomic clocks. Specifically, we use the number of times some component in a clock swings or vibrates to measure seconds or minutes.

The pendulum of a large pendulum clock is long, and its swinging is very visible. More specialized small clocks require special components. The vibration frequency of a clock (the frequency of its “ticks”) depends on its application.

Most clocks have a fixed vibration frequency, so that they can tell time precisely. However, some clocks have a variable vibration frequency. A metronome, for example, can be preset to a vibration frequency, and once set, it beats at a constant frequency. The time interval between each of Bitcoin’s “ticks” is different, because its internal mechanism is probabilistic. But the purpose of both is the same: to play the music, so the dance can go on.

——— Genesis block (6 days); the delta between the timestamps of blocks can be a negative number.

**

Isn’t the Bitcoin before our eyes just a clock? Satoshi did indeed hint that the entire Bitcoin network is like a clock — in his words, a distributed timestamp server.

In this paper, we propose a solution to the double-spending problem using a peer-to-peer distributed timestamp server to generate computational proof of the chronological order of transactions. — Satoshi Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System” (2009)

From the references at the end of the Bitcoin white paper, it is clear that timestamping is a fundamental issue. Of the 8 references, 3 are related to timestamping:

• “How to Time-Stamp a Digital Document,” S. Haber, W.S. Stornetta (1991)
• “Improving the Efficiency and Reliability of Digital Time-Stamping,” D. Bayer, S. Haber, W.S. Stornetta (1992)
• “How to Design a Secure Time-Stamping Service with Minimal Trust,” H. Massias, X.S. Avila, J.-J. Quisquater (1999)

As Haber and Stornetta stated in 1991, digital timestamping uses a computational process to make it impossible for users (or adversaries) to backdate or forward-date a digital document. Unlike paper documents, digital documents are easy to tamper with, and tampering does not necessarily leave any obvious traces on the physical medium. In the digital world, forgery and tampering can be utterly flawless.

Given the malleability of information, adding timestamps to digital documents became a very complicated process. Intuitive solutions simply do not work. Take a text document as an example: merely appending a date to the end of the document is useless, because anyone (including yourself) can easily modify the date. Moreover, you could have forged the date from the very beginning.

VI. Time Is a Causal Chain

In an extreme view, the world is nothing but a web of relationships. — Tim Berners-Lee, “Weaving the Web” (1999)

Forging dates is a universal problem, and it does not exist only in the digital world. In a kidnapping case, for example, the kidnappers need a way to prove when the kidnapping took place.

This method works because newspapers are hard to forge and easy to verify. Since the front pages of newspapers report the previous day’s events, the kidnappers could not possibly have known the front-page news in advance and forged the hostage photo weeks ahead of time. Therefore, the publication date of the newspaper held by the hostage in the photo is proof that the hostage is alive.

This method highlights an important concept: causality. The arrow of time reflects the causal relationship between events. Without causality, there is no time to speak of. In cyberspace, hash functions are crucial to solving the timestamping problem, because they introduce causality. Without a document, we cannot generate its corresponding cryptographic hash, so a causal relationship exists between the document and the hash: first there must be data, and only then can the hash (corresponding to that data) be generated. In other words, without the computational irreversibility of one-way functions, there would be no causality in cyberspace.

With causality, we can create a chain of interlocking events. Therefore, secure digital timestamping schemes can write history for a digital world in which time originally did not exist.

Causality determines the temporal order of events. If an event is caused by certain previous events, and causes certain subsequent events, then the event’s position in history is determined and will not change again. — Bayer, Haber, Stornetta (1992)

There is no doubt that causality is crucial for economic calculation. Since a ledger is in fact the embodiment of economic calculation among multiple cooperating parties, causality is equally crucial for every ledger.

We need a system that allows all participants to reach consensus on a single history… The solution we propose is based on a timestamp server. — Satoshi Nakamoto (2009)

Interestingly, all the components that make Bitcoin work already existed. As early as 1991, Haber and Stornetta introduced two schemes that “can effectively prevent timestamp forgery.” One was a scheme relying on a trusted third party; the other was a more complex “distributed trust” scheme, requiring no reliance on a trusted third party. The two authors even discovered the inherent problems behind trusting a causal chain of events, and the conditions required to rewrite history. In other words, “the only way to successfully do evil is to prepare a timestamp chain long enough that even the most suspicious challenger cannot doubt it.” Today, Bitcoin has a similar attack vector, namely the 51% attack (see the next section for details).

A year later, Bayer, Haber, and Stornetta built on the previous research and proposed using a “Merkle tree,” rather than a simple linked list, to link all events together. A Merkle tree is a simple and efficient data structure that can compute a definite hash value from multiple hash values. From the perspective of timestamping, this means that one unit of time can accommodate multiple events. In addition, the three authors proposed improving the distributed trust model they had put forward in 1991: namely, continually holding a “world championship tournament” to decide a single “winner,” who would publish the computed hash value in a public place (such as a newspaper). Sound familiar?

We can see that the newspaper is an excellent example, allowing us to better think about the second property of time: unpredictability.

VII. Causality and Unpredictability

Time is not a reality (hupostasis), but a concept (noêma) or a measure (metron)… — Antiphon the Sophist, “On Truth” (3rd century AD)

Although causality is important, it is far from sufficient. The passage of time also cannot do without unpredictability. In the physical world, we describe the passage of time by observing natural processes. We observe that entropy is constantly increasing, and we call this the arrow of time. Although in most cases the laws of nature appear unrelated to the arrow of time, some things actually cannot be undone. As the saying goes, a broken mirror is hard to make whole again.

Likewise, the digital world also needs entropy-increasing functions to create an arrow of time. SHA256 hashes and cryptographic signatures are not absolutely unbreakable; but just as a broken mirror is almost impossible to make whole again, SHA256 and cryptographic signatures are almost impossible to break.

Without entropy increase, we could alter timestamps at will. For example, the sequence of Fibonacci numbers has causality, but does not have the property of entropy increase. In the Fibonacci sequence, each number is obtained by adding the previous two numbers. The Fibonacci sequence is therefore a causal chain. However, the Fibonacci sequence cannot be used to tell time, because it is completely predictable. This is like saying that kidnappers cannot use a photo of the hostage with a calendar to prove the hostage is still alive. We cannot use predictable things as proof of time; we can only use things that cannot be foreseen in advance, such as the front page of that day’s newspaper.

Bitcoin’s unpredictability is achieved through transactions and proof of work. Just as no one can predict what tomorrow’s newspaper will carry, no one can predict what the next Bitcoin block will look like. You cannot predict which transactions will be packed into a block, because you cannot predict which transactions will be broadcast in the future. More importantly, you cannot predict who will solve the current proof-of-work puzzle, or what the solution will be.

Unlike newspapers, proof of work is directly linked to events that have already occurred. Proof of work is not merely a record of an event; it is the event itself. It is precisely this direct, probability-based link that frees proof of work from any need for trust. The only way to find a valid proof of work is to make a great many guesses, each guess taking a small amount of time. The number of guesses required to find each solution is probabilistic, and this constitutes Bitcoin’s chain of time.

Using the causal ordering of hash chains and the unpredictability of proof of work, the Bitcoin network provides a mechanism for creating an undisputed history of events. Without causality, we could not distinguish the order of events. Without unpredictability, causal ordering would be meaningless.

Regarding the kidnappers’ method mentioned above, Bayer, Haber, and Stornetta actually gave a clear explanation back in 1992: “If one is to determine that a document was created after a certain time, the document must record events that have already happened but could not have been foreseen in advance.”

It is the combination of causality and unpredictability that allows us to artificially define “now” in a digital world that originally had no concept of time. As Bayer, Haber, and Stornetta pointed out in their 1991 paper: “The order of clients requesting timestamps and the hashes they submit cannot be foreknown. Therefore, if we include in a signed certificate the bits of the previous sequence of client requests, we know that the certificate’s timestamp is later than those requests… The requirement that a certificate must include the bits of previous documents can also indicate the order of time from another direction, because a timestamping authority cannot issue a certificate in advance unless it possesses the requests of this very moment.”

All the components are here. Satoshi’s brilliance was to combine all of these components together, thereby eliminating the need for a timestamping authority.

VIII. Proof of Time

The cause is deeply hidden, but the result is already known. — Ovid, “Metamorphoses” (8 AD)

Let us summarize: to spend money in the digital world, we must rely on a ledger. For a ledger to be reliable, we must make the order of transactions clear. To make the order clear, we must use timestamps. Therefore, if we want to create trustless money in the digital world, we must remove any entity that creates and manages timestamps, as well as any single entity responsible for timekeeping.

A genius like Satoshi found the solution: “To implement a peer-to-peer distributed timestamp server, we will need to use a proof-of-work system similar to Adam Back’s Hashcash.”

The reason we need to use a proof-of-work system is that we need something native to the digital world. Once you understand that the essence of the digital world is information, it is obvious that computation is all we have. If your world is made of data, data manipulation will exist.

Proof of work is a peer-to-peer mechanism because it requires no trust. Proof of work is trustless because it is insulated from all external inputs (such as clocks or newspapers). It relies on only one thing: computation cannot do without the input of work. In our world, producing work requires the input of energy and time.

IX. A Bridge to Time

I know I am bewitched.

We ran across the bridge — the burning bridge —

The flames raging behind us,

We stand at the edge of death,

Darling, you and I are against the world.

— Kate Bush, “Burning Bridge” (1985)

Without proof of work, we inevitably run into the problem of information input mechanisms, because the physical world and the information world are forever separated by a gulf. The marks a shepherd makes on a list when counting sheep are not real sheep; a map cannot compare with real territory; and the news in a newspaper is not necessarily an event that really happened. Likewise, even if you use a real-world clock to create a timestamp, that does not mean the actual time is so.

Frankly, we cannot trust data to represent reality, unless it is the reality inherent in the data itself. The brilliance of Bitcoin’s difficulty-adjustable proof of work is that it creates its own reality, as well as its own space and time.

Proof of work can directly connect the digital world and the physical world. Only this connection is established in a trustless way. Everything else relies on external input.

Bitcoin’s block difficulty adjusts in order to maintain the connection between Bitcoin time and human time. Like clockwork, every 2016 blocks, the Bitcoin system readjusts the mining difficulty. The difficulty adjustment aims to keep the average block time at 10 minutes, thereby establishing a stable connection between the physical world and the information world. Therefore, the ticking of the Bitcoin clock needs to be readjusted according to human perception of time. A difficulty adjustment based purely on clocks is not feasible, because that would completely sever Bitcoin from the human world. The purpose of the difficulty adjustment is precisely to prevent people from producing blocks too quickly (or too slowly).

As Einstein told us, time is not absolute. There is no such thing as universal time. Time is relative, and simultaneity does not exist. From this fact alone, all timestamps (especially those spanning great distances in space) are inherently unreliable, even when there is no opposition between participants. (Incidentally, this is why the timestamps of GPS satellites must be constantly adjusted.)

For Bitcoin, the fact that human timestamps are not precise is not very important. It does not matter that there was no absolute frame of reference to begin with. The precision of timestamps need only be enough to make the block time computed on the basis of 2016 blocks sufficiently reliable. To ensure this, a block’s “physical world” timestamp is accepted only if it satisfies the following two criteria:

1. The timestamp must be greater than the median of the timestamps of the previous 11 blocks.
2. The timestamp must be less than network-adjusted time plus two hours. (“Network-adjusted time” is the median of the timestamps returned by all the nodes connected to you.)

In other words, the difficulty adjustment keeps time constant — not security, difficulty, or energy consumption. This design is quite original, because good money must have a high time cost, not an energy cost. If money were linked only to energy, that would not be enough to produce absolute scarcity, because once energy production technology improves, we could create more money. Time is the only thing that cannot be regenerated. As Julian Simon said, time is the ultimate resource. For this very reason, Bitcoin has become the ultimate form of money, because Bitcoin’s issuance is directly related to the universe’s ultimate resource (time).

The difficulty adjustment is crucial. Without it, as more and more miners join the network, or as mining machines become more efficient, Bitcoin’s internal clock would run faster and faster. We would soon run into coordination problems. Once the block time drops below some threshold (such as 50 milliseconds), the system cannot reach consensus on a shared state, even in theory. Light takes about 66 milliseconds to travel from one side of the Earth to the other. Therefore, even if our computers and routers were perfect, we would be helpless: faced with two events, we would be unable to assert which came first. If we did not periodically adjust Bitcoin’s block time, we would fall into a desperate situation — having to solve coordination problems at a speed exceeding the speed of light. Time is also the root of the instability problem in cryptography (see Chapter One for details). Cryptography works because it exploits the asymmetry of time: building a cryptographic wall takes only an instant, but breaking it takes a very long time, unless you have the key.

Therefore, in a sense, proof of work and the difficulty adjustment both artificially slow down time, at least from the perspective of the Bitcoin network. In other words, Bitcoin forcibly controls its internal rhythm, using a low frequency to provide ample buffer room for communication delays between peer nodes. Every 2016 blocks, Bitcoin’s internal clock is readjusted. Therefore, on average, only one valid block is mined every 10 minutes.

From an external point of view, Bitcoin gathers asynchronous messages broadcast around the world into a parallel universe. This parallel universe has its own rules, as well as its own view of space and time. From the perspective of the Bitcoin network, transactions in the transaction pool have no temporal attributes. Only transactions packed into a valid block are given a time: the number of the block in which the transaction resides.

The ingenuity of this solution is beyond words. Once you can define time yourself, you can easily distinguish the order of events. Therefore, people can also easily reach consensus on what happened, in what order, and who owes whom what.

The difficulty adjustment ensures that Bitcoin’s internal metronome beats at a constant tempo. It is the conductor of the Bitcoin orchestra, keeping the music forever fresh and alive.

But why should “work” be something ultimately worth relying on? The answer is threefold. First, because computation requires the input of work; producing work requires spending time; and here, the work — guessing nonces — cannot be cheated.

X. Probabilistic Time

Time endlessly births forks in the road, leading to countless futures. — Jorge Luis Borges, “The Garden of Forking Paths” (1958)

Finding a valid nonce for a Bitcoin block is a guessing game, similar to rolling dice, flipping a coin, or playing roulette. In essence, you are looking for an astronomical number. Each guess does not bring you any closer to the answer. Either you guess it, or you start over.

Every time you flip a coin, the probability of it landing heads or tails is 50% — even if you have already flipped it 20 times before and it landed heads every time. Similarly, in the process of Bitcoin mining, the probability of a valid block appearing in each second is around 0.16%. It does not matter when the previous block was found. The waiting time before the next block is found is always the same: about 10 minutes.

Therefore, every “tick” of the Bitcoin clock is unpredictable. Compared with the clocks we humans use, the Bitcoin clock seems crude and inaccurate. As Gregory Trubetskoy said: “It does not matter whether this clock is accurate. What matters is that everyone’s clock is the same, and that the state of the entire chain is unambiguously associated with the ticking of the clock.” Although Bitcoin’s clock is probabilistic, it is not an illusion.

Time is an illusion. Lunchtime doubly so. — Douglas Adams, “The Hitchhiker’s Guide to the Galaxy” (1979)

However, in the Bitcoin system, “now” is absolutely an illusion. Since there is no central authority in the network, strange situations can occur. Although it is unlikely, what if two people find a valid block at the same time? (Apologies once again to all physicists.) That is to say, clocks in two different locations tick at the same time. The contents of these two blocks are very likely different. Although they contain different histories, both are equally valid.

This is what is called a chain split — a situation that naturally arises in the operation of Nakamoto consensus. It is like a flock of migrating birds, sometimes splitting into two columns, sometimes merging back together. After some time, the nodes in the Bitcoin network eventually form a shared history, thanks to the probabilistic nature of guessing.

Nakamoto consensus simply requires that the correct history resides on the heaviest chain (that is, the chain containing the most proof of work). Therefore, if we have two histories, A and B, some miners will continue writing history on A, and some miners will continue writing history on B. Once the miners on one side find the next valid block, the miners on the other side will accept that they were mining on the wrong history and switch to the heaviest chain (which, by definition, is the chain that represents the events that actually happened). In Bitcoin, history is written by the victors.

The payee needs proof that can demonstrate that, when each transaction occurred, the vast majority of nodes agreed that they received that transaction first… When the same transaction has multiple payees, only one is valid. The payee must wait about an hour before he can believe that the transaction is valid. By then, the network can resolve any double-spending race that might occur. — Satoshi Nakamoto (2009)

The paragraph above reveals the secret of the distributed coordination problem. This is how Satoshi solved the “simultaneous payment” problem mentioned earlier, once and for all. To hell with relativity!

Because the Bitcoin clock is probabilistic, “now” (what we call the tip of the chain) is forever uncertain. The past (the blocks below the tip of the chain) is forever certain.

If we wish to understand more deeply, we must trace back to an earlier time. — Gordon Clark, “A Christian View of Men and Things” (1951)

Therefore, for some peer nodes, the Bitcoin clock sometimes runs backward a tick or two. If your chain tip (now) happens to lose to another chain tip, your clock will first run backward and then forward, overwriting the history you originally thought was correct. If your clock is probabilistic, your memory of history must be so as well.

Tick tock — what time is it?

Tick tock… stopped at c619.

Is that really so? Could it be running slow?

Who cares whether it’s on time: 8 before 9 can’t be wrong.

This clock is inaccurate; sometimes it runs backwards.

If it were on time, that would be a ghost — centralization is out of the question!

This clock is ticking, ticking and ticking again,

Doing mischief gains you nothing — tick tock to the next block.

— A little poem about Bitcoin and time (2020)

XI. Conclusion

Time remains one of the greatest mysteries of physics, and has even led people to question the definition of physics itself. — Jorge Cham and Daniel Whiteson, “We Have No Idea: A Guide to the Unknown Universe” (2017)

To track things in the world of information is to track a series of events, and therefore requires tracking time. Tracking time requires reaching consensus on “now (the point in time that forever connects the past and the future).” In the Bitcoin system, “now” is the endpoint of the chain with the most proof of work.

For the structure of time, the two most important components are: causality and unpredictable events. Causality is used to define the past; unpredictable events are used to construct the future. If the order of events were predictable, it would be possible to skip ahead. If there were no connection between each event, changing the past would be easy. Because the Bitcoin system defines its internal time, the difficulty of forgery is extremely high. If someone wants to forge, they must rewrite the past or foresee the future. Bitcoin’s chain of time effectively prevents both of these.

If we view Bitcoin from the perspective of time, we should be clear that “blockchain (a data structure that links multiple events together through causality)” is not the main innovation, and is not even a new idea. As long as we study the previous literature on timestamping, we can discover this.

A blockchain is just a chain of blocks of data. — Peter Todd

Satoshi’s innovation lies in how the parties can independently reach consensus on the history of events without centralized coordination. Satoshi found a way to implement a decentralized timestamping mechanism. This mechanism (a) does not rely on a timestamping authority or server, (b) does not require newspapers or any other physical medium as evidence, and (c) can ensure that the tempo of timekeeping remains basically unchanged, even when running in an environment with a faster CPU clock.

Timekeeping requires causality, unpredictability, and coordination. In Bitcoin, causality is provided by one-way functions — namely, the cryptographic hash functions and digital signatures at the core of the Bitcoin protocol. Unpredictability is achieved through the proof-of-work puzzle and node interaction: you cannot know in advance what other nodes are doing, and you cannot know in advance the solution to the proof-of-work puzzle. Coordination is achieved through the difficulty adjustment, whose secret is to link Bitcoin time with human time. Only by connecting the physical world and the information world can we reach consensus on time by relying on data alone.

Bitcoin is time in more than one respect. Bitcoin’s smallest unit, the satoshi, is time, because it is money; Bitcoin’s network is also time, because it is a decentralized clock. It is precisely because the Bitcoin clock turns tirelessly that Bitcoin can possess these magical properties. Otherwise, the entire Bitcoin system would fall apart. And it is for this reason that this ingeniously crafted internet money can benefit everyone.