Bitcoin Forum

Update - Feb, 2012
Due to the increase in valuation, printcoins is now offering 0.1 BTC bills which are about equal to a $2 bill. Bills that are greater that 10 BTC have been taken offline. Also Ron Paul bills have been discontinued.

Update - Aug, 2012
You can now print your own: http://print.printcoins.com/

Update - Feb 28, 2012

These will now only be sold in bulk orders of 100. This will likely change back in May, but for now, the small orders are just not worth the time. I would like to sell plastic credit card format printcoins, so let me know if you would like to do bulk orders of these.

Updates - Jan 4, 2012


* Due to the rise in the value of bitcoins, bills are now cheaper (prices automatically adjust to mtgox)
* Denominated bills are back up for sale
* Paper stock is now significantly heavier - 32 lbs,  100% cotton
* Hologram size is now 12% larger
* Denominated bills are sold pre-funded. You don't fund them yourself.

----
Original Post

Physical Bitcoin Bills at http://printcoins.com
http://printcoins.com/images/gallery/compare.jpg
http://printcoins.com/images/gallery/circle.jpg
http://printcoins.com/images/gallery/fifty.jpg


About

PrintCoins are a way to bring your bitcoins into the physical world.

PrintCoins come in a variety of denominations, each with their own color scheme based on standard poker chip values. And they are printed on 24lb paper that is made from 100% cotton.

There is also an "open" denomination bill that can be used like a blank check. You simply fund the bill with a specific amount, and then write the amount on the bill.

All bills come unfunded so your bitcoins remain in your digital wallet until you need them to fund the bills. To fund bills, you can use the public addresses sent to you via email when your order is shipped, or you can just scan the bill with a smartphone bitcoin wallet app (Android Wallet or InstaWallet).

Perfect for . . .

• Off grid transactions
• When you don't want to wait for a bitcoin transaction
• When you want to buy something from someone who is new to bitcoin.

Buy at:
http://printcoins.com

I am likely missing something, but how would a merchant know if you funded the bill?

They simply scan the QR code

The checkmark signifies that you funded it. This is verified with the QR code in the upper right hand corner (check out the first image) and it is a url to the balance at blockexplorer.com.

We trust Mike ( https://www.casascius.com ) because he has been around for a long time, has earned our trust and has gone to great lengths to describe his private key handling process.  Also he has published his real name and address etc.

Who are you that we should trust you with our private keys?  What is your private key handling process?  This entire system rests on your ability to convince us that we can trust you.

I REALLY like the idea and would like to buy some but I need to know a lot more about you personally before I do.

Are you willing to publish all your real life information?

You can't have a double standard like that. There is absolutely no reason to trust Mike anymore or less than these people. They can all screw you over.

The only safe way to do this is a way that even the bill/card/coin maker has no idea what the wallet information is.

They look nice, but are not at all secure. The generic hologram might as well just be a scratch off sticker.

Sure I can.  I (me Burt) trust Mike.  I can do that if I want to.  Not 100% sure why I do but some factors are that he uses SSL, he funds the coins, he has been around a long time, I have PMed him and gotten to know him, he makes more money selling coins than he would ripping people off at the current level of coin production.

I do not know this guy... yet.

If these things were in general circulation and there were a lot of them he could make a lot of money in one giant scam - that is obvious.

That also applies to the coins, true.

Do you have a list of Addresses that are available to the public?

Also, I would consider going through a company to create a unique tamper evident hologram. I sincerely hope that you did not sticker 1000 of your bills (http://www.ebay.com/itm/1000-Security-Hologram-Label-Tamper-Evident-1-1-8-Square-/230700391052?pt=LH_DefaultDomain_0&hash=item35b6d09a8c) already.  :(

It is cool, and I respect that.

My real name is Rob Kohr, and my personal website is robkohr.com, and from there you can probably find a lot of info about me (probably more than Mike). I use RobKohr as my username everywhere (I am not much on being anonymous).

The private (and the public keys) never actually touch a hard drive. I generate them during the printing process for the bills, and they exist in an in-memory pdf file format going to my printer (the pdf file is not saved either). I use a Mac, which while not bulletproof, viruses are rather rare for. I also am a programmer at Intel, and know a little bit about security. My machine is behind a firewall.

I will be publishing the public keys (unless requested by the buyer) when they are shipped. The pre-shipping process is to scan the public keys with my phone and drop them in an email to the recipient of the bills.

They are too generic though, you are correct. I have a design already, and if I sell out of my first batch I will be doing a custom hologram.

No, 20 of 50 (I have a 100 pack, double sided holograms). If I sell out, I will be doing a custom one for version B (and then these will be collector items :)

They will be public as they are shipped (they are scanned on the way out the door).

Can you show us what it looks like after the sticker is taken off?

Yep:
http://printcoins.com/images/gallery/tamper.jpg

The center of the sticker has a paper square under it to protect the QR code, so it doesn't come apart in the middle. The edges fall apart pretty easily when you try to remove it. It also totally loses its stickiness.

Thanks!

I would say, great proof of concept.  Here would be my advice.

First of all, custom holograms are a must.  It just doesn't make sense to use a generic hologram that's on eBay.  PM me and I'll tell you who did mine.

Be aware, a new order of holograms will set you back about $2k - $2.5k and you'll need about 6 weeks lead time.  So if you're gonna do it, start now.  On the flip side, these guys can produce holograms in practically any size.  For reference, mine are a 1" circle.  They can cut them however you want though, they come in sheets.  Since these are going to a piece of paper and size isn't a factor, if I were doing a project like this, I would totally be doing a huge eye-catching square sticker (at LEAST 2"x2"), which would be plenty of room to make a gorgeous holographic masterpiece (and these guys will help you).  You do this right, and this alone will sell bills.  Put a big fat-ass B logo hologram on there, and I'll want a fistful of them.

Next, it shouldn't be too hard to generate your keys on an offline computer.  You say you're firewalled...what do you need an internet connection for?  And you say these never touch the hard drive -- you're sure, not even via the page file, or via the print queue?  Sterility is easily achieved so no excuse to not do it.  If you're going to do this for real, you really need to format a fresh hard drive, generate your junk with no internet connection whatsoever, print your shiz, and then zero the drive.

The Courier and Arial (or whatever other built-in) fonts have got to go.  Consider the Ubuntu font.  Google for it.  I would also like to suggest scrapping the "bitcoin not legal tender" bit.

The load-it-yourself non-denominated bill should be more like a "bitcoin cheque" and be formatted to look like a cheque, not cash, in my opinion.  The user should be led to write out the amount in script as well as numerals: "------TEN------ bitcoins.... 10.00 BTC".  (Notably, your bills already look like cheques, they just lack the formatting of one.)

Finally... I would really rethink having "load-it-yourself" bills that are loaded by the customer.  YOU SHOULD LOAD THESE.  The whole point of having a bill is for the recipient to NOT have to scan it.  Fortunately you have thrown a generic hologram on there so you haven't really done any harm.  But if and when you start throwing holograms on there with your name, you want to do your best to make sure that all bills in the wild are actually loaded.  I would also have the hologram guys laser-etch the denomination into the edge of the actual holograms (like you may notice on my 2nd series).

Ordered one of each for fun.  I ignored your minimum 10 BTC order limit and sent you 3.04 BTC.  If you are really going to stick to your minimum 10 BTC limit then send my BTC back to me at http://firstbits.com/1burtw and cancel the order.

Please listen to Mike, he really knows what he is talking about.

You forgot to add:

Use security paper, not home printer paper.

He seems to already be using a pretty decent quality of paper.  "Security paper" could mean anything - a unique label is what will really make the biggest difference.

Would be nice, but probably not critical to have a very nice custom watermark on the paper...

It's all in the budget.  Certainly would enhance collectibility if he could pull it off.

Google brings me to yourownwatermark.com.

Thank you all for all your feedback!

A couple updates:
 
  * Minimum order requirements have been removed
  * International orders have been added. If you would like to help translate the bill into your local language, I can do that with that for no extra charge.

I also changed the address part of the form to a text area block. This should accommodate for some of the more interesting addresses in other countries.



I was wondering, why would making the list of public addresses be a good thing? Doesn't that destroy the anonymity factor?

I was thinking a better way would just be a verification page. Enter in a public address and complete a captcha, and it verifies whether this was a bill that was shipped.

No, anonymity doesn't truly exist here. The difference is that it makes them "easily" accessible to everyone rather than the few that would know.

True Transparency is always a good thing, although it might have negative or positive results.

I do not think publicly listing the addresses serves your customers.  A customer of yours can list the addresses of their bills themselves if they (why??) wanted to. 

I published all my Casascius Coin addresses, but partly out of need:  I'm only putting 8 characters on my coins, and without the list, one cannot be certain of the full address.

Publishing a signed list also has one useful effect, it would also enable someone to prove to a court I had scammed, if I were to ever scam.  Me scamming, for example, would result in a lot of people holding intact coins but with balances spent off them... would be strong evidence against me, and therefore a strong scam deterrent.

Since you must send btc to each public address, you can determine the firstbits (I see you've got one in your sig!). Random 1+7 characters is more than 99.9% likely to be unambiguous today (no, I did not calculate birthday paradox *). You could post-scan all of the addresses and pull any ambiguous prefixes. Anyway, with a large enough production, I think a transparent list is as good as anonymous. Once someone sees the physical address, how does the public list compromise identity? - or vise versa?

*
days|keyspace d =58^7
people|address n ~= 8 - 800 Million
d! / dn(d-n)!

Interesting proof of concept but I wouldn't be selling these.  As soon as someone scams someone w/ them you name is dirt and anybody who bought any of the bills is equally screwed.

1) A custom holograph is a must.  It took me about 2 minutes to find a supplier who makes the exact hologram you use.  I could pump out counterfeit bills right now w/ minimal work.  

2) You want to use security paper.  A holograph on normal paper is worthless.  Someone simply needs to dissolve the paper to get intact holographs and then stick them on normal paper counterfeit bills.

3) I would reconsider the whole "unfunded" bill concept.  Pretty easy to wash checks so it wouldn't be that tough to wash the bill to remove the public QR code and then replace it with one which has funds but doesn't match the 0BTC private key.

4) You also should make the public keys semi-unique.  Use a vanity generator to make all "good" public keys start w/ a known prefix (i.e. 111BC).  This will require attacker to generate public keys from the same sequence.  To add more security make the holograms contain unique ID and publish a list of all valid ID and their corresponding public key.

Like I said interesting concept but please either do it right or don't do it at all.  If it can be scammed it WILL be scammed and then all remaining bills are worthless, Bitcoin takes another "scam hit" in the PR dept and your name isn't worth anything either.

I disagree.  True security paper is mandatory just like custom holograph.  Using plain "good quality" paper makes counterfits trivially easy.

Two approaches:
1) Cut & Replace
Cut the holograph off a good bill and place it on a fake bill so now QR code of private key doesn't match QR code of public key.  Merchant checks the public key = good 10 BTC.  Later removing private key reveals 0 BTC value.

2) Wash the paper.  
Using the same methods used to wash checks (remove amount to change to a larger amount) you could remove the current public key QR code and replace it with a different one which has the proper stored value.

I think the OP idea is interesting but more thought/work needs to be put into security.  Someone should build this thinking people WILL try to scam/fake/counterfit these and then design it to be as difficult as possible.  I can't see any paper bitcoin "note" providing more than token security without private security paper and numbered holograms.

A while back when I dreamed up this same project my idea was to print the public key QR code on one side of a small piece of material and print the private key on the other side.  That way they are physically together, then create a hologram with a window and place the material under the windowed hologram with the public key showing.  This fixes some of the objections but not all.

The hologram MUST be custom or, as has been stated, anyone can make totally empty fakes by just running off multiple copies one of your good bills and then pasting stickers on them.  They don't even need to put a private key of any kind on them - just leave that blank.

Since I just bought one of each of your bills, technically I am set up to be a bad guy.  I just fund them, buy some holograms, and then make many copies of each bill and start passing them off.  Customer checks the public key, shows good, open it up, no private key to be seen.

Dont be discouraged from all the criticism, but I do agree the hologram needs to be unique, I did a bit of research on tamper evid. seals recently, its not too expensive to get a custom one made up..

Ideally, get one with serial numbers, it could help in the counter- counterfit area somehow Im sure.

The provider I use and the one I recommended can laser-etch serial numbers into holograms from a text file.

My series 2 holograms have laser etched denominations (e.g. "ONE BTC").  They could have easily etched a unique number per hologram.  And at a large size, you could probably etch the entire bitcoin address into the label.  This would go at the edge, since wherever the laser hits, the hologram becomes transparent.

Anyone else finding it hilarious to see everyone so concerned about investing into anti-counterfeiting and security measures when bitcoin already has them built in?

What a bunch of nutjobs. You're doing it wrong.

Agreed. But Casascius collectable coins are kewl.

Yes, I am one of the nutjobs that likes collecting Bitcoin physical money and other Bitcoin related items for my future Bitcoin display at the Smithsonian :)

For example I collected some of Mike's paper wallets that he made before https://www.bitaddress.org basically overtook that business.

Speaking of which:  What the heck ever happened to BitBills at http://bitbills.com  ???  I never was able to order any and the ordering page at http://bitbills.com/order is still disabled.  Are they ever coming back?  I think they had a great idea - embed the private key inside the plastic card so you have to destroy the card to get it out.  Except for the nutty idea of making physical Bitcoin money in the first place - these looked like a pretty good way to go - and I need some for my collection.

Interesting idea.  Watching and waiting for series 2 (that hopefully follows Mike's advice on all points).

Here is another way I have considered to accomplish the same thing, potentially at a fraction of the cost.

Call up Pollard Banknote, a company that makes lottery tickets.  Get them to quote you on 100,000 scratchoffs that are physically like lottery tickets in every way, but they are really just single-use bitcoin paper wallets, denominated just like these bills.  Each one should have a non-concealed barcode with the bitcoin address so they can be scanned with a barcode scanner (so the BTC can be loaded).  Find out what controls they have in place to make sure that someone can't get a copy of the concealed data.  Who knows, maybe they can mass-produce these for as little as a dime or a nickel.  If so, that would be the perfect price for something like this.  0.42 BTC isn't a bad price for a bill, but if 0.42 can buy a strip of 10 of them, and they are all high quality and visually appealing, the community will like that much more than getting just one.

Thank you all for your feedback.

Summary
If this was used as intended, which is not as a collectable, but as a form of money that would circulate from person to person until it was taken out of the economy, it is possible it could face a number of attacks along the circulation path:

[ul]

• one agent could remove the hologram, grab the private key, reapply the a new hologram, and pass the bill off and take the funds at a later date.
• The alternative method is that a funded bill is copied many times and distributed with again the same generic hologram.

[/ul]


DeathAndTaxes presented a more challenging attack, which was with a custom hologram, the bill could be dissolved, and the hologram could be applied to a copy of a bill that was already funded. Being that this is archival quality paper, and the hologram does a darn good job of holding on to the cotton fibers, I am not sure this is a meaningful attack vector. Keep in mind the hologram covers both sides of the bill in a sandwich.

He also presented the idea of bleaching out the unfunded public qr code and reprinting a funded public qr code. This seems a little more possible, but the paper isn't linen, it is pressed cotton. It won't survive a washing machine cycle for example, though the private key hologram sandwich would likely survive. It will likely survive a simple bath though. I'll have to do some experiments with bleach to test this out, since this seems like the one way that the custom hologram would become nullified.

If the hologram was lazer etched with the value and the bill was already funded (not funded by the first owner of the bill) DeathAndTaxes' second argument would become moot. Essentially the bill would be the hologram sandwich, and everything else would be fluff that makes it more money like to new users.

Result

All orders are being refunded (I am contacting users to see what addresses to direct funds to). None of the bills have been circulated, and that is for the best. The denominated bills will not be available for sale until a custom hologram is produced that would be difficult to clone.

I think the design with the non-custom holograms is acceptable as a personal check (or cheque) that is from one individual to another. I will be taking the open/non-denominated bill and tweaking it to make it more cheque like, and removing the suggestion on the back that this is something to pass around. I'll post up the design for you guys to look at.

My mission is still to have denominated bitcoin bills. I think physical cash is a vital part of bitcoin. It needs to be low cost, secure enough to pass through many user's hands, and easily convertible back to bitcoins. I want to make it look good, but I don't want it to be a collectable (it can be, but that is not a goal). I want people to be making transactions with bitcoins without any access to electronic devices, and with the same redemption qualities as gold & silver bills printed long ago. Basically a very user friendly currency that is backed by something that is valued and is uncontrolled by any government.

A little help

I need to get a sense of if anyone is interested before investing in this. If the bills had a 0.45 BTC markup (at current bitcoin/dollars) over actual denominated value how many would you buy? Please send a PM to me with what you would like.

Also, if anyone would like to buy in bulk for reselling let me know as well. I can do custom promotional bills.

Thanks,
Rob

I wouldn't worry about refunding.  These are likely being collected as bitcoin memorabilia, not circulated.  Those of us who bought them surely must have been aware of this.

Consider this.  Those guys I gave you the referral for... They could laser etch the bitcoin address AND denomination on your holograms.  They could also etch a transparent window like I have in my series 2 bitcoins.  That transparent window could reveal a few characters of the bitcoin address printed on the paper underneath, as a visual confirmation that the private key printed underneath actually corresponds to the bitcoin address on the hologram.  If you have seen my physical bitcoins and peeled one, you probably know that their material is SUPER TAMPER SENSITIVE and there is probably nothing to worry about with the paper being dissolved, especially if you have back to back holograms.  With all the vital information printed on the hologram itself, even if someone successfully washed the paper and reprinted it, they couldn't wash the hologram, and any changes would be detectable.

So example... your holograms say, at the bottom, "20.00  1ADDSLfkjasdflakjsdfalskdjfaksdljdfjk  [window]" (and through the window, you can see "1ADDSLfkj" which is printed on the bill... so you can confirm the hologram matches the bill).

If you have back to back holograms, what would improve security even more, is if there is a hole punched in the paper underneath the holograms, so the two holograms actually stick to each other at some point, not just sticking to the paper.  Once stuck together, there is just no way anyone is going to separate them without leaving behind obvious evidence.

Personally I think that is the strongest approach.  If you can get a custom hologram, w/ amount & public key etched onto a pair of holograms it will be much more resistant to tampering/fraud/counterfeiting.   

While the ability to ship unfunded notes is interesting it opens up a lot more attack vectors.  Defending against all those vectors would be tough. 

If you do come up w/ an upgraded product you may want to void some of them and give them to some testers unfunded.  Having a peer testing likely could improve security.   Maybe even offer a bounty for best counterfeit attempt (results only to be shared with you). 

IMHO the perfect (and possibly uneconomical  ;D) paper note would combine the following:
* tested against xray snooping.
* hologram sandwich.
* public key & denomination etched into serial number (even better public key could be denomination using vanity key).
* solvent reactive security paper.

Mike is right.  I don't really care about a refund and would rather pay for and have the prototype bills for my collection and to support the project.  There is a lot of great ideas here and it looks like they are converging on a viable product.

I would buy the bills as currently described above for circulation (back to back holograms, laser etched, hole in paper for contact between the holograms, etc.) and I believe others would buy them also.

The last idea of using a vanity address for the denomination is very interesting maybe 1xx001... 1xx005... 1xx010.., 1xx020... 1xx050... 1xx100... where xx is some sort of production code (encoding production year/month or something like that)?

I like the idea of the production cod in there. I am using version numbers that look like:
2011A

Where the letter increments and the year just matches the year the bill was printed.

I liked the idea of bitbills, but their site hasn't changed in a while.  I like this approach a little more since these could fit in a wallet just like paper cash.

I still don't like the idea of the manufacturer having the ability to know the private key, but there isn't a way around that.

Well the longer the attempted vantity code the more hashes it takes on average to find one valid address.

Each digit you attempt to match increases the time to find a matching address by a factor of 16.

Thus 12011Axxx would be 4,096x more difficult to find than 1AAxxx (where x is the denomination).

I was thinking use this year as the base year and then use one of the x spots to encode the next 58 years, use the second x spot to encode the production week 1-52 mapped onto the base 58 digit.

The entire public address is the "serial number"

Updates:

* Due to the rise in the value of bitcoins, bills are now cheaper
* Denominated bills are back up for sale
* Paper stock is now significantly heavier - 32 lbs,  100% cotton
* Hologram size is now 12% larger
* Denominated bills are sold pre-funded. You don't fund them yourself.

Rob, we should do a deal where one of us manufactures the bill, sends it to the other, and we each add a private key.

Example: You and I both generate a large batch of keypairs.  We exchange public keys and compute the bitcoin address of the resulting set.  You make your bills and send them to me in completed sheets where I can feed them through an inkjet printer.  I print a 2nd key and QR on them (doesn't even have to be covered up).  I put a "zero BTC" hologram on it as my stamp of approval, and then I ship it out to whoever you tell me to.  (I already have the holograms - I had like 4000 of them made that say "zero BTC", not sure in advance what I'd do with them, but this might be perfect)

That would work.


I can accompany the sheets with a text file of public addresses so you don't need to get them directly from the sheets.

Do you have code (in any language) on github somewhere for merging the private keys? If I can also have some example outputs that I can test against, I can see if I can port it over to javascript and make a simple web app for users.

Mike,  There are a few details missing here.

First question:  are you proposing that you guys use the point addition method or the serial point generation method that we recently discussed in the other thread?

I was assuming everyone was moving to using the serial point generation system (private key multiplication)

I think in order to make it as simple as possible for the customer you should end up with the bill having just three numbers/QR codes:

The final public key address
The first private key (under a sticker)
The second private key (under a sticker)

I think it might be ok to leave off the second sticker but the first one is critical and adding the second sticker to cover the second private key would avoid confusion and cover up another number/QR code so the customer only sees the one public key address/QR they need in order to fund the check or check the value of the preloaded bill.

Yes, we'd use point multiplication.

Each of us has a private key, so we should have no problem computing the addresses if we trade public keys.

If we both trade public keys, then Rob can pre-print the complete bitcoin address, and I can also print it a second time in small print for confirmation that the two still correspond.  My hologram isn't big enough to cover the whole QR code without actually sticking to it, so I'd print my QR code in the open, and stick my (windowed) hologram beside it, such that the firstbits of the combined address (as I printed it) show through the window.

Probably what I should do is make a derivative program of Casascius Bitcoin Address Utility that does both sides of the work, and then open source it.  Function one would generate a privkey/pubkey file (csv), function two would take the local privkey file and a foreign pubkey file and generate a bitcoin address list, which we would both independently sign and publish.

I think you're making great progress on this and I am eagerly awaiting the day that I can feel confident in purchasing your Bitbills. There are several more things that need to happen for them to be a truly kick-ass Bitcoin-backed paper currency.

Right now your prices are prohibitive.

I see that you are charging less premium(percentage wise) on a 50 BTC note than a 1 BTC note. But that doesn't really make sense. I'm assuming that the cost of making the 50 BTC note is ~ the same as making a 1 BTC note. Therefore, when an individual purchases a single solitary note, whether it be a 50 or a 1, the premium(in nominal terms, not percentage of note value) should be the same.

The savings should come in when an individual purchases large quantities of the same note. This would be bulk pricing. And since people are much more likely to buy 1's in bulk than they are 50's in bulk, we can reasonably expect people to get better discounts on their 1's than on their 50's, which I think is the goal you were trying to achieve when pricing the notes in the first place.

This sounds awesome.  There should also be a utility for taking the two private keys and combining them into a wallet import format of some kind so people can easily use these bills.

I intend to promote using private keys with the prefix "6" instead of "5" to mean keys that require other keys to be combined.  To get the "6", I intend to use 0xA2 instead of 0x80 as the version byte.  That way, a UI allowing redemption will know that this is only half of a private key, so it will know to ask for the other half.

As it turns out, 0xA2 thru 0xA9 also produce prefixes of "6", so for example 0xA3 could be used to signal a key in three parts, if somebody finds a use case for it.

With the increase purchasing power of Bitcoin seemingly inevitable, could we see the day where Printcoins has bills ranging as low as 1 BTC to as high as 100 BTC much like FRN's and Cas has coins ranging from 0.01 BTC to 0.50 BTC much like today's FRN coins? That would be badass.

Is this the proposal?  Should work.

You are right on. I adjusted my formula based upon your post, and the price of the higher denomination bills includes a much smaller markup than before.

Glad to help. Keep up the good work!

I hate to gum up the works, but there is one flaw. If I ever can see the full printed bill in circulation, and I was an evil person who actually was saving private keys, since the second one is in the clear, I would have both, and thus would be back in the beginning again (except with a new layer of trust in the bills).

How I could be evil, is buy these under a false name, have Mike ship them, and then somehow pass them off again to someone else to resell them or spend them.

Yep, it is far fetched, but I predict that in the next two years their will be a boatload of people printing all sorts of bitcoin bills, and this little run-around might become feasible.

Since Mike and I are the only game in town at the moment, and it would be absurd to go through all these steps where I could achieve the same ends without any steps, it should be just fine to use the clear second half of the private key. I would just recommend that when this becomes a common practice, both private keys need to be obscured.

That's possible yeah, but when I get some holograms that are cut as rectangles, then I can deal with that.  For now people are going to have to just trust you're not doing that, the same way they probably already trust we're not doing it now.  That's why I'm looking to get them to quote us on a continuous hologram pattern that works as both circles and big rectangles, so we can get both kinds out of the same hologram order.  My one inch circles are really only good for obscuring a small dot with tiny print like I do on my coins, just no way I could see it covering a full QR code.

Yeah, right now there is a lot based on trust, and I think that even with an un-obscured second key, it works extremely well, since it would take a massive effort on my part to undermine this system.

Since this is paving the way for the future currency producers, I just wanted to show how it isn't 100% of a perfect system. Even as a two part obscured private key, it isn't 100%, as collusion is possible.

Each person added to the scheme increases the trust factor by an exponent as the greater the number of people, the more difficult a conspiracy is (ignoring the possibility of sock-puppets).

The downside: this will cost more in labor, shipping and materials.

Whoops, I spoke to soon. Your 50 BTC note is still 3 BTC over spot. If you can make a single 1 BTC note and profitably sell it at 1.30 BTC, then you should be able to make a single 50 BTC note and profitably sell it at 50.30 BTC.

I would imagine the pricing system looks something like this:

                              Purchasing 1 Note       Purchasing 5 Notes      Purchasing 20 Notes      Purchasing 100 Notes      Purchasing 1,000 Notes

1 BTC Note              1.30 BTC                    6.25 BTC                    24 BTC                        115 BTC                       1,100 BTC

5 BTC Note              5.30 BTC                    26.25 BTC                   104 BTC                       515 BTC                       5100 BTC  

10 BTC Note            10.30 BTC                   51.25 BTC                   204 BTC                       1015 BTC                     10,100 BTC  

20 BTC Note            20.30 BTC                   101.25 BTC                  404 BTC                       2015 BTC                     20,100 BTC

50 BTC Note            50.30 BTC                    251.25 BTC                 1004 BTC                      5015 BTC                     50,100 BTC


Make sense?

The upside is that people who don't want to screw around with software will have a reliable way to get a very secure savings wallet, possibly the most secure wallet available to a non-technical person.  If we're jamming three or four holograms on this thing, the material costs are already somewhat expensive anyway.

The question you have to ask yourself is, even at very large orders, what is the absolute CHEAPEST I can sell 1 note worth. If the absolute cheapest amount you can sell a note for is 30 Bit cents over spot, then you'll have to make THAT your target goal for the bulk pricing. Notice above how I made it so that at 1000 notes ordered, the cost per note is 10 Bit cents over spot. Simply adjust that to be 30 Bit cents over spot, and re-adjust the rest to be slightly higher. In that case if somebody one orders, say, 1 note all by itself the cost might be 55 Bit cents above spot. Make sense?

I brought the price down significantly for the 50 BTC bill, but I do still include a percentage in my markup. I consider it a handling fee for the risk of managing $250 worth of cash. You may think that is no big deal as a transaction is a transaction, but I get a little nervous when I have to handle that much for someone. If someone ordered a hundred 50BTC bills, I would probably need to take the day off from work just to make sure I was ultra careful with each one being loaded.

If the markup is a big deal, just buy the open denomination bill, which is the cheapest one available. You can load it with whatever you like, and I don't have to handle your money for you.

Also, note that I just added "a stack of 100 1BTC bills" to the shopping system. There is a nice discount there, and coincidentally it is priced about the same as what you expected in your chart.

That's really cool! I suppose as you get more confident with what you're doing the markup fee will drop, or disappear altogether. Also, as demand increases, including for larger amounts, there will be bulk pricing for larger notes. But as it's not too likely that somebody is going to order 100 50 BTC notes right now, it's not really that important. I'm glad you have bulk pricing for the 1 BTC notes. It's still a little too high for me right now. But if you can get your prices down to, say, 106 BTC for 100 1 BTC notes, I'd throw down for that.

You're creating a very important product and I'm glad you're putting a lot of thought into it. This can be something that is truly badass and puts Bitcoin on the map for a much larger segment of society.

Maybe we should share some notes on how to efficiently fund bills.

For me, loading BTC on coins gives me virtually no anxiety, even if I'm doing 2000+ BTC in a single run.  I have a rock solid way to track and load them.  I am using a database to track their loading status, and everything is crosschecked against the master list of bitcoin addresses so I don't load the wrong thing.  Also since I keep my BTC on paper wallets, I only unpaperize the BTC I am about to load right then and there - so there's no risk that I send all my BTC to the wrong place by fat fingering an amount.

Why would markup disappear completely? 

As far as 0.06 BTC markup.  You are aware there is no central bank which can subsidize printing costs.  Things like material, labor, custom holograms, etc do time take and resources.   Your expectations may be a little unrealistic.

D&T -  Thank you, you are now my official spokesperson for all pricing issues.

Also, anyone is welcome to undercut me if I charge too much. You could probably charge much less and still make a profit if you have access to cheap labor.

Well, obviously there is going to be markup. But 3 BTC markup on a 50 BTC note is too steep for me. So is 17 BTC on 100 1 BTC notes.

I'm sure, eventually, there will be competition in the Bit bill market, driving prices down.

I am just giving room for a competitor to step in and eat my lunch. If I charged too little, than what would be the incentive for anyone else to break into the market.

Fair enough.

Burt you are a great source of clarity. Thanks for the above post!

Thanks.  I really like this elliptical curve crypto - it is a lot more fun than RSA.

Maybe we should take this to another thread but can you explain this

(F = b*A)

since both keys are 256 bit numbers are we just doing simple multiplication here.

i.e.
5 * 8 = 40 (but obviously much larger numbers).   How are we handling 256 bit overflow.

Or maybe I am complete off.  Can you provide an example of (F = b*A) using real numbers.

Quickly,

First, private keys are just very large numbers but public keys are actually a pair of two very large numbers representing the x, y coordinates of a point on an elliptical curve.

I use lower case letters to represent elements of the selected finite field and capital letters to represent points in the selected elliptical curve group.

So:  a = b*c represents simple modulo multiplication for the selected finite field, short for a = ((b*c) mod p)

And: A = B + C would represent the defined point addition operation on the selected elliptical curve group.  This is not simple addition, it is the way we define the addition of two points on the elliptical curve.

Then A = a*G is just G+G+G+G+...+G, a times.  And in this case the * represents the defined scalar multiplication operation for the selected finite field over the selected elliptical curve group - so no this is not simple multiplication it is a pretty involved function and can be a bit time consuming.

Clear as mud?

Update: 0.5 BTC denomination bills now available.

If this price rally keeps up I might even get to roll out my 0.25 bills.

Here is a complete list of all intended colors (going down to 0.01 BTC - which would require bitcoins to be around $100 a piece to make sense):

http://printcoins.com/colors

In this case, A is not a 256-bit number.  In programming terms, it is an object, a structure with two 256-bit numbers known as X and Y.  The definition of "multiplication" has been redefined - in C++ terms, the "multiplication operator" has been overridden with a far more complex definition.  So, F = b * A means "Perform the elliptic curve multiplication operation on point object A, using the 256-bit integer b as a parameter"... this operation returns another point object, not a number.

And 256 bit overflow is not a concern once you understand what "finite field" is.  Yes, there is overflow, and the overflow is thrown away - but you must critically understand that the overflow doesn't happen at 2^256, it happens at another number known as N, which is a 256-bit number, but smaller than 2^256.  So when you do scalar multiplication and the answer exceeds N, you handle the overflow by dividing by N and keeping the remainder (not dividing by 2^256 and keeping the remainder, as "handling 256 bit overflow" strictly means).

N is a constant you can find on the bitcoin wiki, search for "secp256k1".

The number mike calls N is the same number I call p (for "prime") is the prime number:

p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F

All the other parameters for the Bitcoin elliptical curve system can be found here: 

https://bitcointalk.org/index.php?topic=53177.msg635050#msg635050 (https://bitcointalk.org/index.php?topic=53177.msg635050#msg635050)

and most of the thread at https://bitcointalk.org/index.php?topic=53177.0 (https://bitcointalk.org/index.php?topic=53177.0) is interesting and informative.

Between the two of us, one of us has it wrong, because I think the number that needs to be divided by and mod taken is

FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141.

This is the number I'm calling N.  The number above you have called p is the number I would call p as well, but I don't think that's the right number for this purpose.

THe person who has it wrong could very well be me, becuase chances are I implemented it, saw it worked, and forgot about it further.  I could have had a brainfart and used the other number instead, but this is the number I always thought i used.

Ok we both agree:


According to the docs p is the prime number specifying the finite field used and n is the prime number specifying the order of G.

So I think the number p should be used for all the finite field math operations, for example a = b*c mod p

And n has something to do with G (the base point of the system).

So, I believe that I am correct in that the "overflow" in the finite field math is at p.

I am trying to remember exactly what n means and how it is used.  I remember reading it and understanding it at one point but I forget now exactly what it means.

If I find the reference again I will post it here.

We need to nail this down because it affects the all important calculation of the final private key f = a*b mod ?

So you could easily experimentally determine which one it is.  Calculate the final private key using each number and let us know which one calculates the correct final private key.

Any plans or thoughts on selling a "checkbook" of xx checks rather than xx loose checks?

Make a QR code sticker/hologram.......WIN

These will now only be sold in bulk orders of 100. This will likely change back in May, but for now, the small orders are just not worth the time. I would like to sell plastic credit card format printcoins, so let me know if you would like to do bulk orders of these.

missed this thread, found it in google images while looking for something.

You can now print your own at:

http://print.printcoins.com/

Totally cool! Great idea.  Thanks!!!

Due to the increase in valuation printcoins is now offering 0.1 BTC bills which are about equal to a $2 bill. Bills that are greater that 10 BTC have been taken off. Also, Ron Paul bills have been discontinued.