Overview

A cypherpunk is one who advocates the widespread use of strong cryptography and privacy-enhancing technologies as a means of effecting social and political change. The cypherpunk movement originated in the late 1980s and gained traction with the establishment of the "Cypherpunks" electronic mailing list in 1992, where informal groups of activists, technologists, and cryptographers discussed strategies to enhance individual privacy and resist state or corporate surveillance.

Deeply libertarian in philosophy, the movement is rooted in principles of decentralization, individual autonomy, and freedom from centralized authority. Its influence on society extends to the development of technologies that have reshaped global finance, communication, and privacy practices, such as the creation of Bitcoin and other cryptocurrencies, which embody cypherpunk ideals of decentralized money.

The movement has also contributed to the mainstreaming of encryption in everyday technologies, such as secure messaging apps and privacy-focused web browsers.

Before the mailing list

Until about the 1970s, cryptography was mainly practiced in secret by military or spy agencies. However, that changed when two publications brought it into public awareness: the first publicly available work on public-key cryptography, by Whitfield Diffie and Martin Hellman, and the US government publication of the Data Encryption Standard (DES), a block cipher which became very widely used.

The technical roots of Cypherpunk ideas have been traced back to work by cryptographer David Chaum on topics such as anonymous digital cash and pseudonymous reputation systems, described in his paper "Security without Identification: Transaction Systems to Make Big Brother Obsolete" (1985).

Etymology and the Cypherpunks mailing list

In late 1992, Eric Hughes, Timothy C. May, and John Gilmore founded a small group that met monthly at Gilmore's company Cygnus Solutions in the San Francisco Bay Area and was humorously termed cypherpunks by Jude Milhon at one of the first meetings—derived from cipher and cyberpunk. In November 2006, the word was added to the Oxford English Dictionary.The Cypherpunks mailing list was started in 1992, and by 1994 had 700 subscribers.

At its peak, it was a very active forum with technical discussions ranging over mathematics, cryptography, computer science, political and philosophical discussion, personal arguments and attacks, etc., with some spam thrown in. An email from John Gilmore reports an average of 30 messages a day from December 1, 1996, to March 1, 1999, and suggests that the number was probably higher earlier. The number of subscribers is estimated to have reached 2,000 in the year 1997.

In early 1997, Jim Choate and Igor Chudov set up the Cypherpunks Distributed Remailer, a network of independent mailing list nodes intended to eliminate the single point of failure inherent in a centralized list architecture. At its peak, the Cypherpunks Distributed Remailer included at least seven nodes. By mid-2005, al-qaeda.net (Riad S. Wahby) ran the only remaining node. In mid-2013, following a brief outage, the al-qaeda.net node's list software was changed from Majordomo to GNU Mailman, and subsequently the node was renamed to cpunks.org.

The CDR architecture is now defunct, though the list administrator stated in 2013 that he was exploring a way to integrate this functionality with the new mailing list software.

For a time, the cypherpunks mailing list was a popular tool with mailbombers, who would subscribe a victim to the mailing list in order to cause a deluge of messages to be sent to them (usually as a prank, in contrast to the style of terrorist referred to as a mailbomber). This precipitated the mailing list sysop(s) to institute a reply-to-subscribe system. Approximately two hundred messages a day was typical for the mailing list, divided between personal arguments and attacks, political discussion, technical discussion, and early spam.

Early discussion of online privacy

The list was discussing questions about privacy, government monitoring, corporate control of information, and related issues in the early 1990s that did not become major topics for broader discussion until at least ten years later. Some list participants were highly radical on these issues.

Those wishing to understand the context of the list might refer to the history of cryptography; in the early 1990s, the US government considered cryptography software a munition for export purposes (PGP source code was published as a paper book to bypass these regulations and demonstrate their futility). In 1992, a deal between NSA and SPA allowed export of cryptography based on 40-bit RC2 and RC4 which was considered relatively weak (and especially after SSL was created, there were many contests to break it).

The US government had also tried to subvert cryptography through schemes such as Skipjack and key escrow. It was also not widely known that all communications were logged by government agencies (which would later be revealed during the NSA and AT&T scandals) though this was taken as an obvious axiom by list members.

The original cypherpunk mailing list, and the first list spin-off, coderpunks, were originally hosted on John Gilmore's toad.com, but after a falling out with the sysop over moderation, the list was migrated to several cross-linked mail-servers in what was called the "distributed mailing list." The coderpunks list, open by invitation only, existed for a time. Coderpunks took up more technical matters and had less discussion of public policy implications.

There are several lists today that can trace their lineage directly to the original Cypherpunks list: the cryptography list (cryptography@metzdowd.com), the financial cryptography list (fc-announce@ifca.ai), and a small group of closed (invitation-only) lists as well.

Main principles

The basic ideas can be found in A Cypherpunk's Manifesto (Eric Hughes, 1993): "Privacy is necessary for an open society in the electronic age. ... We cannot expect governments, corporations, or other large, faceless organizations to grant us privacy ... We must defend our own privacy if we expect to have any. ... Cypherpunks write code. We know that someone has to write software to defend privacy, and ... we're going to write it."

Some are or were senior people at major hi-tech companies and others are well-known researchers (see list with affiliations below).

The first mass media discussion of cypherpunks was in Crypto Rebels, a 1993 Wired article by Steven Levy. The three masked men on the cover of that edition of Wired were prominent cypherpunks Tim May, Eric Hughes and John Gilmore. Later, Levy wrote a book, Crypto: How the Code Rebels Beat the Government – Saving Privacy in the Digital Age, covering the crypto wars of the 1990s in detail. "Code Rebels" in the title is almost synonymous with cypherpunks.