<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div dir="auto">Dear Mert Ali,<br></div><div dir="auto"><br></div><div dir="auto">Thank you for your interest in the project.<br></div><div dir="auto">You have accurately identified the key issue—one that, in principle, should have been the starting point for our entire discussion—given that a constant, fixed issuance rate is atypical in current implementations of monetary systems. Unfortunately, Bitcoin failed to establish itself as a viable medium of exchange for precisely the reasons you enumerated. Monero, for its part, attempted to preserve a "tail emission" mechanism to provide long-term incentives for maintaining network nodes.<br></div><div dir="auto"><br></div><div dir="auto">The presence of network transaction fees—as well as the potential for "buying influence" within the network—necessitates the imposition of such constraints in legacy systems.<br></div><div dir="auto"><br></div><div dir="auto">In designing our tokenomics, we aimed to address several specific objectives:<br></div><div dir="auto">1. To establish an inflation rate that asymptotically approaches zero, thereby laying the foundation for a truly functional monetary payment system.<br></div><div dir="auto">2. To generate intrinsic demand for "Time Coins"—specifically within the ecosystem built upon the Time Protocol—thereby ensuring their practical utility and market demand.<br></div><div dir="auto"><br></div><div dir="auto">As our user base expands, these converging forces should, over the long term, serve to stabilize and balance the value of the Time Coin.<br></div><div dir="auto"><br></div><div dir="auto">On an experimental basis, we plan to launch a pilot program wherein Time Coins are distributed based on a user's VPN uptime. This initiative is designed to serve as a conceptual proof-of-concept for our users—demonstrating that time can, in fact, be technically and tangibly linked to intrinsic value.<br></div><div dir="auto">To establish a benchmark exchange rate for this experiment, we have anchored our valuation to a verifiable real-world transaction involving the sale of "time" across two distinct realms:<br></div><div dir="auto">Specifically, we reference the artwork *Everydays: The First 5000 Days* by the artist Beeple, which sold for $69.3 million—a transaction that effectively prices a single second of time at $0.16.<br></div><div dir="auto"><br></div><div dir="auto">I fully appreciate that this approach may be considered a contentious decision; however—as I must reiterate—this remains a strictly experimental test, and I would be very keen to hear your thoughts and feedback on the matter.<br></div><div dir="auto"><br></div><div dir="auto">Thank you in advance for your input.<br></div><div dir="auto"><br></div><div dir="auto">-- <br></div><div dir="auto"> Защищено с помощью Tuta Mail: <br></div><div dir="auto"> <a href="https://tuta.com/free-email" rel="noopener noreferrer" target="_blank">https://tuta.com/free-email</a><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">18 мая 2026 г., 13:40 От mrtblt@hotmail.com.tr:<br></div><blockquote class="tutanota_quote" style="border-left: 1px solid #93A3B8; padding-left: 10px; margin-left: 5px;"><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">Dear Alejandro,<br></div><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">Thank you for your answer, i looked entire of repository. Your project is truly futuristic. Currently, due to circumstances, I don't have the opportunity to join the network, but I've started following your project and might be able to join in the future but
i need to tell this Bitcoin's havling system did indeed prevent money from being spent, but the possibility of an unlimited supply in the long run raises concerns about inflation and because of the blockchain logic, these funds cannot be withdrawn from the
network, and I think that's why the supply needs to be restricted. <br></div><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">-Mert Ali<br></div><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div><div id="ms-outlook-mobile-body-separator-line" data-applydefaultfontstyles="true" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;" dir="auto"><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;"><br></div></div><div style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);" id="ms-outlook-mobile-signature" dir="auto"><div dir="auto" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div></div><div dir="auto" id="mail-editor-reference-message-container" class=""><div dir="auto"><br></div><div dir="auto"><hr style="display: inline-block; width: 98%;"><br></div><div id="divRplyFwdMsg" style="font-size: 11pt;" dir="auto"><div dir="auto"><b>From:</b> alejandromontana@tutamail.com <alejandromontana@tutamail.com><br></div><div dir="auto"> <b>Sent:</b> Monday, May 18, 2026 1:39:02 AM<br></div><div dir="auto"> <b>To:</b> Mert Ali Bulut <mrtblt@hotmail.com.tr><br></div><div dir="auto"> <b>Cc:</b> Cryptography <cryptography@metzdowd.com><br></div><div dir="auto"> <b>Subject:</b> Re: [Cryptography] Montana: A Post-Quantum Blockchain with Time as Scarcity<br></div></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">--<br></div><div dir="auto">Защищено с помощью Tuta Mail:<br></div><div dir="auto"><a href="https://tuta.com/free-email" target="_blank" rel="noopener noreferrer">https://tuta.com/free-email</a><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">17 мая 2026 г., 14:02 От mrtblt@hotmail.com.tr:<br></div><blockquote style="margin-left: 5px; padding-left: 10px; border-left: 1px solid rgb(147, 163, 184);"><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">-----BEGIN PGP SIGNED MESSAGE-----<br></div><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">Hash: SHA256<br></div><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">The protocol dictates a flat reward of 13 units per window, forever, with no halving or supply cap. You are essentially baking infinite, linear inflation into the baseline. Why would rational node operators continue to burn real-world energy (and pay real electricity
bills) to sustain a network whose native token is mathematically guaranteed to dilute infinitely over time?<br></div><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">-----BEGIN PGP SIGNATURE-----<br></div><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">iIYEARYIAC4nHE1lcnQgQWxpIEJ1bHV0IDxtcnRibHRAaG90bWFpbC5jb20udHI+<br></div><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">BQJqCZ68AAoJEL6pvU8yCx+RWTUA/iCeCSEE43AZSrGUlGSxtpdWHcpAD+L8kNQ5<br></div><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">jEORc5QrAP9aGJtwIoJDPbAF9LLx23EQ14PF3draPiKTM2bhKVkGCw==<br></div><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">=cnMG<br></div><div dir="auto" class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);">-----END PGP SIGNATURE-----<br></div><div class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div><div class="tutanota_quote" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div><div id="ms-outlook-mobile-body-separator-line" data-applydefaultfontstyles="true" dir="" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif; font-size:12pt"><div style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;"><br></div></div><div id="ms-outlook-mobile-signature" dir="" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(33,33,33)"><div style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(33, 33, 33);"><br></div></div><div dir="auto"><hr dir="auto" style="display: inline-block; width: 98%;"><br></div><div class="tutanota_quote"><br></div><div id="divRplyFwdMsg" dir="auto"><div dir="auto" style="font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><div dir="auto"><b>From:</b> cryptography <cryptography-bounces+mrtblt=hotmail.com.tr@metzdowd.com> on behalf of Alejandro Montana via cryptography <cryptography@metzdowd.com><br></div><div dir="auto"> <b>Sent:</b> Saturday, May 16, 2026 8:42:30 AM<br></div><div dir="auto"> <b>To:</b> Cryptography <cryptography@metzdowd.com><br></div><div dir="auto"> <b>Subject:</b> Re: [Cryptography] Montana: A Post-Quantum Blockchain with Time as Scarcity<br></div></div><div dir="auto"> <br></div></div><div dir="auto" class="tutanota_quote">2 мая 2026 г., 11:34 От alejandromontana@tutamail.com:<br></div><blockquote style="margin-left: 5px; padding-left: 10px; border-left: 1px solid rgb(147, 163, 184);"><p class="tutanota_quote"># Montana: A Post-Quantum Blockchain with Time as Scarcity<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">**Alejandro Montana**<br></p><p class="tutanota_quote">[<a href="http://github.com/efir369999/Montana" target="_blank" rel="noopener noreferrer" style="margin-top: 0px; margin-bottom: 0px;">github.com/efir369999/Montana</a>](<a href="https://github.com/efir369999/Montana" target="_blank" rel="noopener noreferrer" style="margin-top: 0px; margin-bottom: 0px;">https://github.com/efir369999/Montana</a>)<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## Abstract<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">A post-quantum cryptocurrency would allow value to be transferred between parties without reliance on classical cryptographic primitives that quantum adversaries can break. Existing chains rely on signatures (ECDSA, EdDSA) whose security
collapses under Shor's algorithm and on transaction-fee-based anti-spam mechanisms that price out small users at scale. We propose a blockchain whose security rests entirely on post-quantum primitives standardized by NIST in 2024 (ML-DSA-65, ML-KEM-768) and
on hashing (SHA-256), and whose anti-spam mechanism operates on time rather than money. A verifiable delay function over SHA-256 produces a globally ordered chain of windows of approximately 60 seconds each. Each window is sealed by a sequential proof of work
whose computation cannot be parallelized and cannot be skipped. Operations within a window are rate-limited per identity, by the cumulative chain length of the operating account, and by seniority constraints — three different scarcities derived from time elapsed,
not balance held. As long as honest operators run the verifiable delay function, the chain extends, regardless of how many actors hold tokens or what fees they would have paid.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 1. Introduction<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Bitcoin and its descendants demonstrate that decentralized monetary consensus is achievable without trusted intermediaries. Two limitations prevent these systems from serving as a general financial substrate at the scale of a billion
users.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">First, all production cryptocurrencies derive their signature security from elliptic-curve discrete logarithm assumptions. Shor's algorithm [8], when run on a sufficiently large quantum computer, breaks these assumptions in polynomial
time. The U.S. National Institute of Standards and Technology standardized post-quantum signature and key encapsulation mechanisms in 2024 (FIPS 203 [2], 204 [3], 205); existing major chains have not migrated. The migration is not a trivial parameter change
— wire formats, address derivation, multisig schemes, light-client proofs all depend on the underlying primitive.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Second, the anti-spam mechanism in fee-based chains scales poorly under adoption. As block space becomes scarce, small operations are priced out, defeating the original use case of low-friction online payments. Layer-two systems (state
channels, rollups) shift the economics rather than remove the underlying scarcity.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">We propose Montana, a chain whose security rests on post-quantum primitives only and whose anti-spam mechanism operates on time rather than money. The chain advances by a verifiable delay function over SHA-256, producing globally ordered
windows of approximately 60 seconds. Operations are rate-limited by per-identity windows, account chain length, and seniority — three independent scarcities derived from time elapsed.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 2. Time as a Scarce Resource<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">In a fee-based chain, the scarce resource is block space; access is allocated by willingness to pay. Spam is deterred by the price of inclusion. Two failure modes follow. Under congestion, ordinary users are excluded by price. Under
abundance, spammers re-enter at marginal cost. The mechanism does not converge on a stable point; it oscillates with demand.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">We replace block-space scarcity with time scarcity. The verifiable delay function (VDF) [5,6,7] over SHA-256 forces a sequential computation that cannot be parallelized: D iterations of SHA-256 must be performed in series, where D
is calibrated so that the computation takes approximately 60 seconds on commodity x86_64 hardware. The output of one window is the input to the next. The total length of the chain measures wall-clock time elapsed since genesis, recoverable by anyone who can
verify the VDF output.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Time is uniformly available to all participants. An attacker with one hundred times the resources of an honest operator does not get one hundred times more time. The attacker may run more parallel chains, but each chain still advances
at the same wall-clock rate. Sybil identities do not produce more time per identity — they produce more identities, each subject to the same per-identity per-window rate limit.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Time as scarcity does not require a price feed, an exchange, a pricing oracle. Its valuation is fixed by the protocol: one window equals one window, regardless of currency value.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 3. The TimeChain<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Let `T_r` denote the VDF output at window `r`. The TimeChain advances by<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote">T_r = SHA-256^D (T_{r-1})<br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">where `T_0` is the genesis seed and `D` is the per-window iteration count. `D` is initialized at 325 000 000 and recalibrated every 20 160 windows (approximately fourteen days) according to a formula tied to median observed wall-clock
window times across honest operators. The recalibration is canonical: every honest operator computes the same new `D` from public inputs.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">The verifiability of the VDF allows any node to confirm `T_r` from `T_{r-1}` by performing the same `D` iterations. There is no trusted setup; the output is a public function of the input and the parameter.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">A new operator joining the network is required to produce a candidate VDF chain of length at least 20 160 windows (approximately ten hours of wall-clock time on commodity hardware). This requirement is the protocol's Sybil defense:
producing N false identities requires N candidate chains, each consuming N times the wall-clock time. There is no shortcut.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 4. Post-Quantum Primitives<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Signatures are produced and verified by ML-DSA-65, the FIPS 204 module-lattice signature scheme. Key encapsulation, where used (operator handshake, encrypted application payloads), is performed by ML-KEM-768, the FIPS 203 module-lattice
scheme. Both are members of the NIST PQC standardization output. Key sizes are: public key 1952 bytes (ML-DSA-65), secret key 4032 bytes, signature 3309 bytes; ML-KEM-768 public key 1184 bytes, ciphertext 1088 bytes, shared secret 32 bytes.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Hashing is SHA-256 (FIPS 180-4 [4]). Grover's algorithm [9] reduces the effective preimage security of SHA-256 from 256 to 128 bits in the quantum model, which remains adequate.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Key derivation from a 24-word mnemonic uses PBKDF2-HMAC-SHA-256 with iter=2^20 to compute a master seed, then HKDF-SHA-256 to derive per-purpose keys (account signing, node signing, encrypted app payloads). The mnemonic wordlist is
256 Russian-language words selected for distinguishability under typing, listening, and transcription. The protocol is alphabet-agnostic; the wordlist is a deployment choice and may be substituted with any 256-word set whose entropy claim per word is identical
(8 bits).<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 5. Operations and the Account Table<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">The state is a single Account Table mapping account identifiers to records:<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote">AccountRecord {<br></p><p class="tutanota_quote"> account_id 32 bytes (SHA-256 of account public key)<br></p><p class="tutanota_quote"> public_key 1952 bytes (ML-DSA-65)<br></p><p class="tutanota_quote"> balance 16 bytes (u128, denominated in nɈ; 1 Ɉ = 10^9 nɈ)<br></p><p class="tutanota_quote"> account_chain_length 8 bytes (u64, count of cemented operations from this account)<br></p><p class="tutanota_quote"> last_active_window 8 bytes (u64, window index of most recent operation)<br></p><p class="tutanota_quote"> is_node_operator 1 byte (boolean flag)<br></p><p class="tutanota_quote"> ...<br></p><p class="tutanota_quote">}<br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Operations transform state through `apply_proposal(state, proposal) → state'`. The transformation is deterministic, byte-exact reproducible by any node from the same `(state, proposal)` pair. The set of operation classes is closed:
Transfer, OpenAccount, ChangeKey, NodeRegistration, Anchor, NicknameBid, TransferActivation, CloseAccount. Each operation has a fixed canonical encoding, a fixed validation rule, and a fixed apply function.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Conservation invariants hold per operation: the sum of balance deltas across all affected records equals the emission delta plus the burn delta. No operation creates or destroys value silently.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 6. Lottery<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">The operator who completes the VDF for window `r` is selected by a deterministic lottery from the set of registered operators. Each operator submits a `VdfReveal` with the window's VDF output and a signature; the lottery winner is<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote">winner = argmin_{operator} ticket(operator, r)<br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">where<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote">ticket(operator, r) = SHA-256(operator.node_id || cemented_bundle_aggregate(r-2) || r)<br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">The `cemented_bundle_aggregate(r-2)` term is the lottery's network-bound unpredictability source: it incorporates signatures from honest operators in window `r-2`, which an attacker cannot precompute without privkeys held by honest
participants. This closes the class of attacks where an adversary with hardware advantage precomputes future windows and grinds attacker-chosen fields against them.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 7. Incentive<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">The lottery winner of window `r` receives 13 base units of Ɉ (`13 × 10^9 nɈ`), credited to the operator account. There are no transaction fees. There is no second-tier inflation. There is no premine, no presale, no founder allocation.
The total emission at window `r` is exactly `13 × r` units, a closed-form function of window count.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Storage of accumulated value is not separately incentivized. The protocol does not pay for holding tokens. The single reward path is operating the VDF for a window and winning that window's lottery.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">For any operator, the expected income per unit time depends on the share of cemented `VdfReveal`s contributed by that operator across windows. With `N` operators of equal computational power running honest VDF, the expected reward
per operator per window is `13/N` Ɉ. With unequal power, the share is proportional to the number of valid `VdfReveal`s submitted in time.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 8. Anti-Spam Without Fees<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Spam protection is the composition of three time-based mechanisms:<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">**Per-identity rate.** Operations of class A (Transfer, NicknameBid, etc.) are limited to one per account per window τ_1 = 1 window. An attacker with N Sybil identities can perform at most N operations per window, but each Sybil identity
has its own creation cost (see below). The rate is uniform across identities; there is no fast lane.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">**Chain-length threshold.** Privileged operations (e.g. NodeRegistration, NicknameBid) require the operating account's `account_chain_length` to exceed a threshold k. An account must be active for at least k windows before issuing
such an operation. The threshold cannot be purchased; it can only be earned by elapsed activity.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">**Seniority gating.** Lottery weight in the operator selection scales with the operator's `account_chain_length` up to a saturation point. New operators have lower weight; they accrue weight by participating across windows. This dampens
flash-mob attacks where many adversarial operators register simultaneously.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">These mechanisms together close DoS without monetary barriers. The protocol contains no `fee` field on any operation.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 9. State Lifecycle and Pruning<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Every persistent record in consensus state has either a cost-based barrier, a lifecycle bound, or a hard quota. Account creation requires the creator to submit an opening operation whose validation includes a chain-length precondition.
Accounts whose balance falls below `MIN_ACCOUNT_BALANCE = 1 nɈ` and whose `last_active_window` precedes the current window by more than `8 × 20 160` windows are pruned by `apply_candidate_expiry` at the next epoch boundary.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Pruning is not optional; it is part of the canonical state transition. Two honest nodes following the protocol prune identically. The Account Table size is bounded above by<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote">|AccountTable(W)| ≤ creation_rate × retention_window<br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">which is independent of accumulated wall-clock time, ensuring that long-running chains do not produce unbounded state.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 10. Privacy<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">The protocol exposes balances, transfers, account graphs, and operator identities by default. Application-layer privacy is achieved through Anchor objects: an account commits a 32-byte hash to chain, and the contents (encrypted under
the owner's key) are held off-chain by the owner or by a delegated peer. The Anchor mechanism does not give the protocol visibility into the contents.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Privacy is a user choice rather than a protocol-imposed feature. Mass-surveillance through privacy-by-protocol is not within scope; selective privacy through user-managed encryption is. This boundary aligns the protocol with regulatory
frameworks (FATF, MiCA) that have rejected protocol-level privacy mixers while accepting end-user encryption of off-chain content.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 11. Network and Synchronization<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">The protocol's wire format and synchronization mechanism are described in [`mt-net`](<a href="https://github.com/efir369999/Montana/tree/main/Код/crates/mt-net" target="_blank" rel="noopener noreferrer" style="margin-top: 0px; margin-bottom: 0px;">https://github.com/efir369999/Montana/tree/main/Код/crates/mt-net</a>) and
[`mt-net-transport`](<a href="https://github.com/efir369999/Montana/tree/main/Код/crates/mt-net-transport" target="_blank" rel="noopener noreferrer" style="margin-top: 0px; margin-bottom: 0px;">https://github.com/efir369999/Montana/tree/main/Код/crates/mt-net-transport</a>) of
the reference implementation. Operators discover peers, exchange `VdfReveal` and `BundledConfirmation` messages, and replicate the cemented chain via libp2p over TCP+TLS.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">A new node synchronizes by acquiring the current TimeChain head from any honest peer, verifying the VDF chain locally, and replicating the Account Table snapshot rooted in the current Merkle commitment. Synchronization is verify-only;
no trust in the source peer is required beyond the TLS connection.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 12. Calculations<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">We consider a scenario where an honest operator and an attacker compete to win windows. The probability that the attacker wins a given window is proportional to the attacker's share of total VDF computational power. With attacker share
`p` and honest share `1 − p`, the probability that the attacker wins `k` consecutive windows is `p^k`, decreasing geometrically.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">For the lottery to be biased in favor of the attacker, the attacker must control more than half of all registered operator power. With per-operator wall-clock VDF being constant (no parallelization), Sybil identity multiplication does
not increase total power; it only fragments the same power across more identities. The attacker's share is bounded by the number of physical machines they operate, not by capital.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">This is the security argument: monetary capital does not buy more time. The operator economy reduces to a hardware economy in which the unit good (one VDF window) is uniformly priced in joules.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote">P(attacker wins k consecutive windows) = p^k<br></p><p class="tutanota_quote">```<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">For `p = 0.3` and `k = 10`, P = 5.9 × 10^-6, comparable to the Bitcoin probability of an attacker reorganizing a chain after 10 confirmations under analogous attacker share.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## 13. Conclusion<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">We have proposed a blockchain whose security rests on post-quantum cryptographic primitives and whose anti-spam mechanism operates on time rather than fees. The construction does not require trusted setup, does not require a price
feed, and does not impose a monetary barrier on participation. The mechanism scales to a billion active accounts as a baseline architectural target.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">The reference implementation in Rust is available at the cited URL under permissive license (Apache-2.0 / MIT). Further work includes the network-layer integration into the node binary (M6 multi-node deployment), the snapshot-based
fast synchronization (M7), and the conformance suite expansion to second implementations in independent languages (M9).<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">## References<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[1] S. Nakamoto, "Bitcoin: A Peer-to-Peer Electronic Cash System," 2008.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[2] National Institute of Standards and Technology, "Module-Lattice-Based Key Encapsulation Mechanism Standard," FIPS 203, 2024.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[3] National Institute of Standards and Technology, "Module-Lattice-Based Digital Signature Standard," FIPS 204, 2024.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[4] National Institute of Standards and Technology, "Secure Hash Standard (SHS)," FIPS 180-4, 2015.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[5] D. Boneh, J. Bonneau, B. Bünz, B. Fisch, "Verifiable Delay Functions," CRYPTO 2018.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[6] K. Pietrzak, "Simple Verifiable Delay Functions," ITCS 2019.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[7] B. Wesolowski, "Efficient verifiable delay functions," EUROCRYPT 2019.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[8] P. W. Shor, "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer," SIAM Journal on Computing, 1997.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">[9] L. K. Grover, "A fast quantum mechanical algorithm for database search," STOC 1996.<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">---<br></p><p class="tutanota_quote"><br></p><p class="tutanota_quote">Alejandro Montana<br></p><p class="tutanota_quote"><br></p><div class="tutanota_quote"><br></div></blockquote><div class="tutanota_quote"><br></div><div dir="auto" class="tutanota_quote">I've been working on a new blockchain whose security rests entirely on<br></div><div dir="auto" class="tutanota_quote">post-quantum cryptographic primitives, with no transaction fees and time as<br></div><div dir="auto" class="tutanota_quote">the scarce resource in place of money.<br></div><div class="tutanota_quote"><br></div><div dir="auto" class="tutanota_quote">The paper is available at:<br></div><div dir="auto" class="tutanota_quote"><a href="https://github.com/efir369999/Montana/blob/main/Whitepaper" target="_blank" rel="noopener noreferrer">https://github.com/efir369999/Montana/blob/main/Whitepaper</a> Montana.md<br></div><div class="tutanota_quote"><br></div><div dir="auto" class="tutanota_quote">The main properties:<br></div><div dir="auto" class="tutanota_quote"> Post-quantum signatures (ML-DSA-65) and key encapsulation (ML-KEM-768)<br></div><div dir="auto" class="tutanota_quote"> from primitives up. No ECDSA, no curve25519, no RSA in the protocol.<br></div><div dir="auto" class="tutanota_quote"> Consensus is a verifiable delay function over SHA-256 producing a globally<br></div><div dir="auto" class="tutanota_quote"> ordered chain of windows of approximately 60 seconds each.<br></div><div dir="auto" class="tutanota_quote"> Anti-spam operates on time, not on fees: per-identity per-window rates,<br></div><div dir="auto" class="tutanota_quote"> account chain-length thresholds, seniority gating.<br></div><div dir="auto" class="tutanota_quote"> No mint, no premine, no transaction fee. The single emission is 13 base<br></div><div dir="auto" class="tutanota_quote"> units of Ɉ to the operator who completed each window's VDF.<br></div><div dir="auto" class="tutanota_quote"> Architecturally targets one billion active accounts as the design baseline.<br></div><div class="tutanota_quote"><br></div><div dir="auto" class="tutanota_quote">Full paper and reference implementation in Rust:<br></div><div dir="auto" class="tutanota_quote"><a href="https://github.com/efir369999/Montana" target="_blank" rel="noopener noreferrer">https://github.com/efir369999/Montana</a><br></div><div class="tutanota_quote"><br></div><div dir="auto" class="tutanota_quote">Alejandro Montana<br></div><div class="tutanota_quote"><br></div></blockquote><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">Thank you, Ali, for your question.<br></div><div dir="auto"><br></div><div dir="auto">Constant emission at this volume is an architectural decision. Bitcoin's halving model and limited supply have already empirically proven that it failed to become a monetary system for precisely this reason. Its deflationary, limited model makes
it a store of value that people don't spend and have no incentive to spend, due to the perceived scarcity of the asset, like an old Lego set that appreciates over time and outperforms gold in profitability.<br></div><div dir="auto"><br></div><div dir="auto">We've implemented a decreasing inflation model with a predetermined emission rate over time, such that inflation tends toward zero. Even if the first rational node operators find it unprofitable to maintain them, they can almost immediately
spend money on renting these servers using Time Coins. We're creating a legal layer for this, the company <a href="https://whitebird.io" target="_blank" rel="noopener noreferrer">https://whitebird.io</a>, which will convert Time Coins almost immediately, thanks to our fiat-based structure.<br></div><div dir="auto"><br></div><div dir="auto">We become the first buyers of Time Coins, commission-free, instantly, and allow them to buy servers and pay for them with servers.<br></div><div dir="auto"><br></div><div dir="auto">The first coins are already accrued for using the VPN layer and can be exchanged for fiat or used to pay for servers.<br></div><div dir="auto"><br></div><div dir="auto">We address your issue from two perspectives:<br></div><div dir="auto">1. Nodes pay for servers from the network and are registered to their hosting or local nodes. In countries with internet restrictions, people already run nodes to maintain internet access for $5 a month.<br></div><div dir="auto">2. We mathematically prove that the token will not only stabilize, but also tend to predictably reduce inflation, since the emission ratio of the total supply decreases each year. I disagree with you here.<br></div><div dir="auto"><br></div><div dir="auto">In essence, our model is already anti-plutocracy, since influence in the network is tied to time, not hardware or money.<br></div><div dir="auto"><br></div><div dir="auto">I have to run a node for my family's VPN anyway, so I don't question whether I'm ready. And if you set up your node, we will be two providers of a mesh VPN network, which is much harder to block than all existing analogues. This is also one
of the layers of utility.<br></div><div dir="auto"><br></div><div dir="auto">The coins will be usable almost immediately, as soon as we finish adding VPN apps for Android and Apple.<br></div><div dir="auto"><br></div><div dir="auto">There's already a test version for Android that shows how Time coins start accumulating when a VPN is enabled. The exchange rate, based on the price of Time Anchor in Bill's film "5000 Days," is $69.3 million. That's $0.16 per second.<br></div><div dir="auto"><br></div><div dir="auto">Have you looked at the entire Ali repository?<br></div><div dir="auto"><br></div></div></blockquote><div dir="auto"><br></div> </body>
</html>