Public-Key Cryptography: The Mathematics of Trust

Every time you send Marscoin, cast a vote in the Congress, or prove your citizenship in the Martian Republic, you are relying on a piece of mathematics discovered in the 1970s that changed the world more profoundly than the nuclear bomb, the transistor, or the internet itself. Public-key cryptography — the idea that you can have two related keys, one public and one private, where knowing one does not reveal the other — is the foundation of every blockchain, every secure website, every encrypted message, and every digital signature on Earth. And eventually, on Mars.

Without it, there is no Bitcoin. No Marscoin. No HTTPS. No secure email. No SSH. No digital commerce. No way for two strangers to communicate securely without first meeting in a dark alley to exchange a secret. The entire digital economy — trillions of dollars in daily transactions, billions of encrypted communications, every password you have ever entered on a website — depends on a handful of mathematical problems that are easy to compute in one direction and practically impossible to reverse.

This article explains how it works, why it works, and why it matters for the Martian Republic. No hand-waving. No "trust us, it's math." The actual math, the actual history, and the actual implications.

The Problem: Sharing Secrets Without a Shared Secret

Before 1976, all encryption was symmetric. The same key that locked a message also unlocked it. Caesar's cipher shifted each letter by three positions: A became D, B became E, and so on. The Enigma machine used a far more complex system of rotors and plugboards, but the fundamental principle was identical — the sender and receiver both needed to know the machine's settings. The key was shared.

This creates an inescapable problem that cryptographers call the key distribution problem. If Alice wants to send Bob an encrypted message, she first needs to share the encryption key with Bob. But if she has a secure channel to share the key, why not just use that channel to send the message? And if she doesn't have a secure channel, how does she share the key without an eavesdropper intercepting it?

For millennia, the answer was physical transportation. The Roman Empire used trusted couriers. During World War II, the German military distributed Enigma codebooks by hand, changing settings daily. During the Cold War, the United States and the Soviet Union maintained the "hot line" — originally a teletype circuit, not a telephone — secured by one-time pads that were physically exchanged by diplomatic pouch. Governments used couriers with briefcases handcuffed to their wrists, accompanied by armed guards, to distribute cryptographic keys to embassies worldwide.

This works, barely, for nation-states with diplomatic infrastructure. It does not work for two strangers on the internet who want to buy and sell goods. It does not work for a billion smartphones that need to establish secure connections to servers they have never contacted before. And it absolutely does not work across 140 million miles of space, where a courier would take six to nine months to arrive, assuming you could even send one.

The Breakthrough: Diffie-Hellman (1976)

On November 6, 1976, Whitfield Diffie and Martin Hellman published a paper in IEEE Transactions on Information Theory titled "New Directions in Cryptography." It was eleven pages long. It broke open a problem that had been considered unsolvable for three thousand years of cryptographic history.

The key insight was deceptively simple: there exist mathematical operations that are easy to perform in one direction but practically impossible to reverse. Mathematicians call these trapdoor functions or one-way functions. The most intuitive analogy is mixing paint. If you mix yellow paint and blue paint, you get green paint. Easy. Now, given only the green paint, separate it back into the exact shades of yellow and blue that produced it. Essentially impossible. The mixing is easy; the unmixing is intractable.

Diffie and Hellman's specific trapdoor function was the discrete logarithm problem. Here is how it works, with actual numbers small enough to follow by hand.

The Diffie-Hellman Key Exchange, Step by Step

Alice and Bob want to agree on a shared secret over a public channel — a channel that an eavesdropper, Eve, can monitor. They agree publicly on two numbers: a large prime p and a generator g. For this example, let p = 23 and g = 5. These are public. Eve knows them. Everyone knows them.

1. Alice picks a secret integer a = 6. She computes A = g^a mod p = 5⁶ mod 23 = 15,625 mod 23 = 8. She sends A = 8 to Bob, publicly.
2. Bob picks a secret integer b = 15. He computes B = g^b mod p = 5¹⁵ mod 23 = 30,517,578,125 mod 23 = 19. He sends B = 19 to Alice, publicly.
3. Alice computes the shared secret: s = B^a mod p = 19⁶ mod 23 = 47,045,881 mod 23 = 2.
4. Bob computes the shared secret: s = A^b mod p = 8¹⁵ mod 23 = 35,184,372,088,832 mod 23 = 2.

Both arrive at the same shared secret: 2. Eve, listening to the entire exchange, saw g = 5, p = 23, A = 8, and B = 19. To compute the shared secret, she would need to find a such that 5^a mod 23 = 8, or b such that 5^b mod 23 = 19. With p = 23, this is trivial — she could try all 22 possibilities in seconds. But when p is a 2048-bit prime (a number with 617 digits), the number of possibilities is so vast that no computer on Earth, or any conceivable computer, could try them all before the heat death of the universe.

The Secret History: GCHQ Got There First

In 1997, the British Government Communications Headquarters (GCHQ) declassified documents revealing that the fundamental concepts of public-key cryptography had been discovered years before Diffie and Hellman's publication — in secret, by British intelligence.

In 1969, James Ellis, a GCHQ cryptographer, wrote an internal paper titled "The Possibility of Secure Non-Secret Digital Encryption" that laid out the theoretical framework for public-key cryptography. In 1973, Clifford Cocks — a 22-year-old Cambridge mathematics graduate who had joined GCHQ just six weeks earlier — devised a practical implementation that was essentially identical to what would later be called RSA. And in 1974, Malcolm Williamson developed a key exchange protocol equivalent to Diffie-Hellman.

All three discoveries were classified. Ellis, Cocks, and Williamson received no public credit until 1997, more than two decades later. Ellis died in November 1997, just weeks after the declassification. He never received the recognition that Diffie, Hellman, Rivest, Shamir, and Adleman enjoyed for decades. It is one of the great injustices of the history of mathematics.

RSA: The First Public-Key Encryption System (1977)

Diffie-Hellman solved key exchange but not encryption. It allowed two parties to agree on a shared secret, but it did not provide a way to encrypt a message directly with a public key and decrypt it with a private key. That came the following year.

In 1977, Ron Rivest, Adi Shamir, and Leonard Adleman at MIT developed the first practical public-key encryption system. They published it in the Communications of the ACM in February 1978 under the title "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems." The system, named RSA after their initials, was based on a different mathematical problem: the difficulty of factoring large composite numbers.

The RSA premise is straightforward. Take two large prime numbers, p and q. Multiply them to get n = p × q. Publishing n is safe because, given only n, finding the original p and q is computationally intractable for sufficiently large primes. The public key is derived from n; the private key requires knowledge of p and q. Anyone can encrypt a message using the public key, but only the holder of p and q can decrypt it.

How hard is factoring? In February 2020, a team of researchers factored RSA-250 — a 250-digit (829-bit) number specifically published as a challenge — using approximately 2,700 CPU-core-years of computation across multiple research institutions. The effort consumed the equivalent of a single modern CPU running continuously for 2,700 years. RSA-2048, the standard used in practice, uses 617-digit numbers. Factoring RSA-2048 with current technology is estimated to require more computation than exists on the planet. No one has done it. No one is close.

RSA remains foundational to internet security. When your browser connects to a website over HTTPS, the TLS handshake often uses RSA (or its successors) for key exchange and authentication. RSA proved that public-key cryptography was not just theoretically possible but practically deployable at scale. It earned Rivest, Shamir, and Adleman the ACM Turing Award in 2002 — computer science's equivalent of the Nobel Prize.

Elliptic Curve Cryptography: The Blockchain Standard

In 1985, two mathematicians working independently — Neal Koblitz at the University of Washington and Victor Miller at IBM — proposed using the algebraic structure of elliptic curves over finite fields as the basis for cryptographic systems. The resulting field, Elliptic Curve Cryptography (ECC), would take two decades to gain mainstream adoption and would eventually become the cryptographic backbone of every major blockchain.

The critical advantage of ECC is key size. A 256-bit elliptic curve key provides approximately the same security as a 3,072-bit RSA key. This is not a minor improvement. It is an order-of-magnitude reduction in key size, signature size, and computation time. For a blockchain — where every byte is stored by every full node, replicated across the network, and preserved for the lifetime of the chain — this difference is the difference between feasibility and impossibility.

secp256k1: The Bitcoin and Marscoin Curve

Not all elliptic curves are equal. The specific curve used by Bitcoin, Litecoin, Marscoin, and most cryptocurrency systems is called secp256k1, defined by the Standards for Efficient Cryptography Group (SECG). Its equation is deceptively simple:

Why did Satoshi Nakamoto choose secp256k1 for Bitcoin? The answer is almost certainly a combination of efficiency and trust. The more commonly used NIST curves (P-256, P-384, P-521) were standardized by the National Institute of Standards and Technology with input from the NSA. After Edward Snowden's 2013 revelations about NSA backdoors in cryptographic standards — particularly the Dual_EC_DRBG random number generator, which was proven to contain an NSA backdoor — the cryptographic community developed a deep mistrust of NIST curves. Secp256k1, by contrast, was constructed using verifiably random parameters with no unexplained constants. Its simplicity (the coefficient b = 7, the coefficient a = 0) leaves little room for hidden structure. It is, in the language of cryptographers, a "nothing up my sleeve" curve.

Point Multiplication: The Trapdoor

The fundamental one-way operation in ECC is elliptic curve point multiplication. It works like this: the curve has a designated base point G (the generator point), which is a specific point on the curve published as part of the secp256k1 standard. A private key is simply a large random integer k, chosen between 1 and n − 1, where n is the order of the curve (roughly 1.16 × 10⁷⁷). The corresponding public key is computed as:

PublicKey = k × G

This is not ordinary multiplication. "k × G" means "add the point G to itself k times" using the elliptic curve addition rule, which involves geometric operations on the curve (drawing tangent lines, finding intersection points, reflecting across the x-axis). The result is another point on the curve — a pair of 256-bit coordinates (x, y) that constitutes the public key.

Here is the trapdoor: computing k × G is fast, even for a 256-bit k. Using the double-and-add algorithm (analogous to square-and-multiply for modular exponentiation), it requires at most 256 point doublings and 256 point additions — a few hundred operations that a modern processor executes in microseconds. But given G and k × G, computing k — the Elliptic Curve Discrete Logarithm Problem (ECDLP) — has no known efficient algorithm. The best known attack, Pollard's rho algorithm, requires approximately √n operations, which for secp256k1 is about 2¹²⁸ — a number so large that exhausting it would require more energy than the Sun produces in its entire lifetime.

The one-way nature is absolute for all practical purposes: given a public key, you cannot derive the private key. Not with all the computers on Earth running in parallel. Not with all the computers that will ever be built using classical physics. The mathematics is unambiguous.

Digital Signatures: Proving Ownership Without Revealing Secrets

Public-key encryption lets you receive secret messages. But for a blockchain, you need something different: you need to prove that you authorized a transaction without revealing your private key. This is the role of digital signatures, and the specific algorithm used by Bitcoin and Marscoin is the Elliptic Curve Digital Signature Algorithm (ECDSA).

How ECDSA Works

Suppose Alice wants to send 10 MARS to Bob. She constructs a transaction message m (containing the sender address, receiver address, amount, and other metadata). She needs to produce a signature that proves she controls the private key associated with the sending address, without revealing the private key itself. Here is the process:

1. Hash the message. Compute z = SHA-256(m), producing a 256-bit digest of the transaction. This ensures the signature covers the entire transaction content — any modification, even a single bit, produces a completely different hash.
2. Generate a random nonce. Alice picks a cryptographically random integer k (the "nonce") between 1 and n − 1. This nonce must be truly random and must never be reused. The importance of this will become terrifyingly clear shortly.
3. Compute the signature point. Calculate the elliptic curve point R = k × G. The x-coordinate of R is the first half of the signature: r = R.x mod n.
4. Compute the signature scalar. Calculate s = k⁻¹(z + r · d) mod n, where d is Alice's private key and k⁻¹ is the modular inverse of the nonce. The value s is the second half of the signature.
5. The signature is the pair (r, s) — two 256-bit numbers, totaling 64 bytes (or 71–73 bytes in DER encoding).

Verification is where the magic happens. Anyone on the network — any node, any miner, any observer — can verify the signature using only three things: the message m, the signature (r, s), and Alice's public key Q. The verification algorithm reconstructs a point from (r, s) and checks whether it matches the claimed relationship. If it does, the signature is valid — Alice signed this transaction with the private key corresponding to Q. The private key d is never transmitted, never exposed, never required by the verifier. Mathematics has accomplished something that sounds paradoxical: proof of possession without revelation.

Schnorr Signatures: The Elegant Alternative

ECDSA is not the only elliptic curve signature scheme. Schnorr signatures, invented by Claus-Peter Schnorr in 1989 and patented until 2008, offer several advantages. The mathematics are simpler and more elegant. Schnorr signatures are provably secure under the random oracle model (ECDSA's security proof is more complex and less clean). Most importantly for blockchain applications, Schnorr signatures support linear aggregation: multiple signatures from multiple signers can be combined into a single signature that is the same size as one individual signature.

This enables powerful features. In a multisignature wallet requiring 3-of-5 signers, ECDSA requires three separate signatures (approximately 210 bytes). Schnorr key aggregation produces a single 64-byte signature that is indistinguishable from a regular single-signer signature. This saves block space, reduces fees, and improves privacy — observers cannot tell whether a transaction used a multisig or a standard wallet.

Bitcoin adopted Schnorr signatures as part of the Taproot upgrade, activated at block 709,632 on November 14, 2021. The upgrade also introduced MuSig2, a secure multi-signature scheme built on Schnorr. Batch verification — verifying many Schnorr signatures simultaneously faster than verifying them individually — further improves node performance for blocks with many transactions. Marscoin's potential migration path to Schnorr remains an active topic in the community, particularly as the block size and transaction throughput demands of a growing colony economy become relevant.

From Public Key to Address: The Hashing Pipeline

In Marscoin, as in Bitcoin, a user's address is not their public key. It is the output of a carefully designed pipeline of cryptographic hash functions applied to the public key. This pipeline serves multiple purposes — security, compactness, and error detection — and understanding it reveals the layered defense-in-depth philosophy of blockchain cryptography.

The Full Derivation

1. Private key (256 bits): A random number between 1 and approximately 1.16 × 10⁷⁷. This is the root secret. Everything else derives from it.
2. Public key (512 bits uncompressed, 264 bits compressed): Computed as PrivateKey × G on secp256k1. The uncompressed form is a 04 prefix byte followed by the 256-bit x-coordinate and 256-bit y-coordinate (65 bytes total). The compressed form drops the y-coordinate (which can be recomputed from x) and uses a 02 or 03 prefix byte depending on whether y is even or odd (33 bytes total). Modern wallets use compressed keys exclusively.
3. SHA-256 hash (256 bits): The compressed public key is hashed with SHA-256, producing a 256-bit digest.
4. RIPEMD-160 hash (160 bits): The SHA-256 output is hashed again with RIPEMD-160, producing a 160-bit (20-byte) digest. This is the "public key hash."
5. Version byte: A single byte is prepended to identify the network. For Marscoin mainnet, this is 0x32 (decimal 50), which produces addresses starting with the letter "M." For Bitcoin mainnet, it is 0x00, producing addresses starting with "1."
6. Checksum: The versioned hash is double-SHA-256 hashed, and the first 4 bytes of the result are appended as a checksum.
7. Base58Check encoding: The versioned-hash-plus-checksum is encoded in Base58 (a subset of alphanumeric characters that excludes visually ambiguous characters like 0/O and l/1/I). The result is a human-readable address like M9xHwGbfENcyXasH2...

Why Hash the Public Key?

Why not just use the public key directly as the address? Three reasons:

• Post-quantum defense in depth. A Marscoin address does not reveal the public key. The public key is only revealed when you spend from an address (because the spending transaction must include the public key for signature verification). If ECDSA were broken by a quantum computer, funds sitting in addresses that have never spent — whose public keys have never been broadcast — would remain protected behind the SHA-256 and RIPEMD-160 hash barriers. This is not a complete solution to the quantum threat, but it adds a meaningful layer of defense.
• Shorter addresses. A compressed public key is 33 bytes (66 hex characters). A RIPEMD-160 hash is 20 bytes. The final Base58Check address is typically 25–34 characters. Shorter addresses are easier for humans to copy, paste, and verify.
• Error detection. The 4-byte checksum embedded in every address means that a random typo has only a 1 in 2³² (roughly 1 in 4.3 billion) chance of producing a valid address. If you accidentally mistype a character when sending Marscoin, your wallet will reject the address as invalid. Without this checksum, a typo would send funds to a nonexistent address with no recovery possible.

The Security Model: How Secure Is "Secure"?

People hear "256-bit security" and nod without understanding what it means. Let us make it concrete.

A 256-bit private key is a number chosen from a space of 2²⁵⁶ possible values. 2²⁵⁶ is approximately 1.16 × 10⁷⁷. For comparison:

The number of possible 256-bit keys is roughly the same order of magnitude as the number of atoms in the observable universe. Imagine you assigned a private key to every atom in existence. You would use roughly 0.01% of the keyspace. Now imagine every atom in the universe were a computer, and each computer could check one billion keys per second, and they had been running since the Big Bang, 13.8 billion years ago. The total number of keys checked would be approximately 10⁸⁰ × 10⁹ × 4.3 × 10¹⁷ = 4.3 × 10¹⁰⁶... except that is still only checking 10¹⁰⁶ out of 10⁷⁷ keys — wait. That is actually more than enough to brute-force. But the actual ECDLP security is 2¹²⁸ (thanks to Pollard's rho algorithm halving the effective security), which is approximately 3.4 × 10³⁸. This is where the real analysis lies.

With Pollard's rho, the effective security of secp256k1 is 128 bits, meaning an attacker needs roughly 2¹²⁸ operations to break a single key. If you had a billion (10⁹) computers, each performing a billion (10⁹) operations per second, running for the age of the universe (4.3 × 10¹⁷ seconds), you would perform about 4.3 × 10³⁵ operations — roughly 0.0001% of 2¹²⁸. You would not be close. You would not be close to close.

The Real Threats

If brute force is hopeless, how do keys actually get compromised? The answer is never the mathematics and always the implementation:

• Bad random number generators. The Android SecureRandom bug of 2013 produced insufficiently random nonces for ECDSA signatures, allowing private key extraction. The mathematics was perfect; the random number generator was not.
• Side-channel attacks. Measuring the power consumption, electromagnetic emissions, or timing of a device performing cryptographic operations can leak information about the private key. Hardware wallets invest enormous engineering effort in side-channel resistance.
• Social engineering. No amount of mathematical security helps if you email your seed phrase to someone claiming to be "Marscoin Technical Support." The majority of real-world cryptocurrency theft is social engineering, not cryptanalysis.
• Software vulnerabilities. Bugs in wallet software, operating systems, or browser extensions can expose private keys. The cryptography is unbroken; the software around it is not.
• Quantum computers. The only known theoretical threat to the mathematics itself.

The Quantum Threat and Post-Quantum Cryptography

In 1994, mathematician Peter Shor, then at AT&T Bell Laboratories, published an algorithm that would later bear his name. Shor's algorithm demonstrated that a sufficiently large quantum computer could factor integers and compute discrete logarithms in polynomial time — meaning it could break both RSA and ECC efficiently. This was not a minor incremental improvement. It was a categorical change: problems that required 2¹²⁸ operations on a classical computer would require roughly 256³ operations on a quantum computer. The entire security model of public-key cryptography would collapse.

The key qualifier is "sufficiently large." Breaking secp256k1 with Shor's algorithm would require approximately 2,500 logical qubits. But quantum computers suffer from errors, and current error-correction techniques require thousands of physical qubits per logical qubit. Estimates suggest that breaking secp256k1 would require several million physical qubits with current error-correction technology.

As of early 2026, the largest quantum computers have approximately 1,000–1,200 physical qubits (IBM's Condor processor reached 1,121 qubits in 2023; Google's Willow chip demonstrated 105 qubits with improved error correction in 2024). The gap between 1,200 noisy physical qubits and the millions of error-corrected qubits needed to break secp256k1 is enormous. Estimates for when cryptographically relevant quantum computers will exist range from 10 to 30 years, with significant uncertainty. Some researchers believe it may take longer. A few believe it may never be practically achieved.

Post-Quantum Alternatives

The cryptographic community is not waiting to find out. NIST ran a six-year Post-Quantum Cryptography Standardization process, beginning in 2016 and concluding with the publication of three standards in August 2024:

• ML-KEM (CRYSTALS-Kyber): A lattice-based key encapsulation mechanism for establishing shared secrets. Replaces RSA and Diffie-Hellman for key exchange.
• ML-DSA (CRYSTALS-Dilithium): A lattice-based digital signature scheme. The primary candidate to replace ECDSA.
• SLH-DSA (SPHINCS+): A hash-based signature scheme that relies only on the security of hash functions — the most conservative and best-understood cryptographic primitive. Larger signatures but maximum confidence in security assumptions.

The most likely path forward for Marscoin and similar cryptocurrencies is a phased migration: first, adding post-quantum signature support as an option alongside ECDSA; then, encouraging migration of funds to post-quantum addresses; and eventually, requiring post-quantum signatures for all new transactions. Bitcoin's Taproot upgrade demonstrated that such protocol-level changes are possible through community consensus, and the timeline for quantum threats gives the community years to prepare.

Cryptography in Daily Martian Life

The mathematics described above is not abstract theory for Martian Republic citizens. It is the operating system of their civic life. Every meaningful action in the Republic is, at its foundation, a cryptographic operation:

• Sending MARS: When a citizen sends Marscoin — whether as payment, donation, or reward — they construct a transaction and sign it with ECDSA using their private key. The network verifies the signature against the sender's public key. No bank approves the transfer. No payment processor intermediates. The mathematics alone authorizes the movement of value.
• Applying for citizenship: A GP_ (General Petition) application is a blockchain transaction signed with the applicant's civic key. The signature proves that the person controlling this key is the person requesting citizenship. Endorsers sign CT_ (Citizen Token) endorsement transactions with their own keys, creating a cryptographically verifiable chain of trust.
• Voting in Congress: When the Republic implements post-CoinShuffle secret ballots, each vote will be a signed transaction that is anonymized through the mixing protocol. The voter proves they are an eligible citizen (via their signature) while the protocol ensures no one can link a specific vote to a specific citizen. Cryptographic authentication plus cryptographic anonymity — properties that are contradictory in traditional systems but composable in cryptographic ones.
• Endorsing a fellow citizen: A CT_ endorsement is a signed attestation that citizen A believes citizen B is a legitimate member of the community. These endorsements form a web of trust — a decentralized reputation system where trust is not granted by a central authority but accumulated through peer attestation, each link cryptographically verified.
• Updating identity information: When a citizen updates their profile, display name, or any on-chain identity attribute, the update is signed by their civic key. Only the keyholder can modify their own identity. No administrator can alter a citizen's record without their cryptographic consent.

The Key as the Root of Agency

In traditional governance systems, your identity and your rights are mediated by institutions. A government issues your ID card. A bank holds your money. A court enforces your property rights. An election commission counts your vote. You trust these institutions because you have no choice — they are the only mechanism by which your identity and your agency are recognized.

In the Martian Republic, the institution is mathematics. Your private key is the root of all identity and all agency. From that single 256-bit number flows everything: your ability to own property, to vote, to endorse citizens, to participate in governance, to transact economically, to prove that you are who you claim to be. No intermediary is required. No institution needs to vouch for you. The signature is self-authenticating.

This is not a design choice made for ideological purity. It is a design choice made for Mars. On a planet 225 million kilometers from the nearest court, the nearest bank, and the nearest government office, institutional mediation is physically impossible. You cannot call customer support when the phone call takes 48 minutes round-trip and is blocked entirely for two weeks every 26 months. You cannot appeal to a higher authority when the highest authority is on a different planet. You need a system where proof, authorization, and identity are self-contained — verifiable by anyone, dependent on no one.

Public-key cryptography provides exactly that system.

"The computer can be used as a tool to liberate and protect people, rather than to control them."

— Hal Finney, pioneer of digital cash and first recipient of a Bitcoin transaction, 2009

The Invisible Architecture of Digital Trust

Public-key cryptography is, by design, invisible. When it works — and it almost always works — you never think about it. The padlock icon in your browser. The wallet app that sends Marscoin with a tap. The vote that registers on the blockchain. Behind each of these interactions is a cascade of mathematical operations: key generation, hashing, signing, verification, each one resting on the hardness of problems that the best mathematicians in the world have spent fifty years trying and failing to crack.

Every transaction in the Martian Republic, every vote, every citizenship proof is ultimately a mathematical statement: "The holder of private key X authorized this action." No government seal. No notary stamp. No institutional intermediary. No trust required in any person, organization, or authority. Just mathematics — elegant, verifiable, and unforgeable.

On a planet 225 million kilometers from the nearest notary public, where the speed of light imposes a permanent embargo on Earth-based authority, this is not a philosophical preference. It is the only viable architecture of trust. The Martian Republic does not ask its citizens to trust the Foundation, or the Congress, or any individual leader. It asks them to trust prime numbers, elliptic curves, and hash functions — entities that have no ambition, no corruption, and no off day.

On Mars, where there are no institutions to trust, mathematics is exactly the trust model you want.