Cyberspace Design Rationale

This document explains the design decisions behind the Cyberspace protocol, the problems it attempts to solve, its limitations, and how it connects to the fictional visions that inspired it.

This document is non-normative. The canonical protocol specification is CYBERSPACE_V2.md.

1. Why Build a Thermodynamic Spatial Protocol?

The Precedent: Bitcoin Captured Time

Bitcoin proved that thermodynamic work could anchor a digital system to physical reality. By making the creation of new coins require real energy expenditure, Bitcoin solved a problem previously thought impossible: transferring value through time without trusted intermediaries. Before Bitcoin, digital scarcity required institutions to enforce it. After Bitcoin, scarcity could be enforced by mathematics alone.

This opened a question: if proof-of-work can capture the time dimension in a digital system, could the same principle capture the spatial dimensions? Not to create another currency, but to impose locality itself—the fundamental property of space—on a mathematical substrate.

The Problems Locality Would Solve

Locality is not just a constraint. It is a capability. Physical space enables things that digital systems cannot replicate:

Embodiment for digital entities. AI systems currently have no spatial constraints. An AI can “be everywhere” simultaneously, accessing systems across the globe at the same instant. This matters because many security and social assumptions depend on spatial constraints: a person can only sign one document at a time, a witness can only be in one place. Locality would enable verifiable embodiment for digital entities, constraining them to “be somewhere” and not anywhere else in a provable way.

An Augmented Reality-native Geospatial Overlay. The dataspace plane maps directly to physical reality: Earth is centered at 2^84 on every axis, a Gibson is about the diameter of a hydrogen atom, Cantor Height 34 is two meters, and each axis runs about 4.5 trillion kilometers, far beyond geosynchronous orbit (CYBERSPACE_V2.md §9.2 and §9.7). This creates a cryptographic overlay on the physical world, where cyberspace coordinates correspond to actual locations on Earth. By trustlessly placing cyberspace objects at physical locations, a decentralized and permissionless overlay of infinite layers can be projected over reality with no central servers. Who owns the AR cloud? Nobody.

Hiding without trust. In physical reality, you can hide something by controlling where it is. A message in a bottle, a buried treasure, a note in a hollow tree. These require no keys, no permissions, and no trusted authorities. Only those who travel there can find them. The fundamental mechanism for hiding things is proof-of-work, whether it is physical travel or digital. Digital systems are spaceless and have no equivalent. All current approaches to hiding information require trusting someone: key holders, access control administrators, or hardware manufacturers. Locality would enable hiding through presence alone.

Communities with boundaries. Physical communities have natural membership constraints: you must be there. This creates shared context, accumulated trust, and local reputation. Online communities lack these constraints. Anyone can join from anywhere, instantly, at zero cost. This enables sybil attacks, context collapse, and governance capture. Locality would reintroduce the constraint of presence, making membership require traversal rather than just a click.

2. Why Cantor Pairing Trees?

The Design Requirements

The system needed to satisfy:

Work requirement: Movement should require mathematical computation, not arbitrary hash grinding
Distance scaling: Larger movements should cost more
Compact proofs: Verifiable without gigabytes of data
Location encryption: A stable secret should be computable for a given coordinate such that it requires real work but can be computed at will.
No observer advantage: The work required to observe the cyberspace protocol is equal to the work of utilizing the protocol. Observers have no inherent advantage, and perform the same work.

The Rejected Approach: Interleaved 256-bit Cantor Tree

The initial design used the interleaved 256-bit coordinate directly in a single Cantor pairing tree. This seemed elegant—one tree for one coordinate.

Why it failed:

Axis asymmetry: Due to bit interleaving (XYZXYZ…), X movements cost ~4× more than Z movements for the same distance. The protocol would privilege certain directions.
Impractical scaling: Moving 64 Gibsons took ~115 seconds in testing. Sector traversal (2³⁰ Gibsons) would take months. This is not a traversable space.
Memory explosion: Large movements produced multi-gigabyte Cantor numbers. Proofs would not fit in Nostr events.

The lesson: mathematical elegance does not always yield practical systems.

The Adopted Approach: Per-Axis Cantor Trees

Each axis (X, Y, Z) gets its own independent 85-bit Cantor tree. Movement proofs are computed separately for each axis, then combined using nested Cantor pairing.

Why it works:

Axis symmetry: Equal distances cost equal work regardless of direction. No privileged axis.
Practical performance: 1,024 Gibsons in ~1ms instead of ~33 seconds. Sector traversal becomes possible (many hops, but each is fast).
Bounded computation: 85-bit trees are manageable. Memory stays in kilobytes, not gigabytes.
Parallelizable: Three independent computations can run in parallel.
Preserves semantics: Still requires “traversing mathematical fabric”—just structured more practically.

Ensuring Every Hop Costs Work (Temporal Axis)

The per-axis Cantor roots are region identifiers. This makes spatial work cacheable: once a client has computed the Cantor root for an aligned region, it can reuse that result in later hops that traverse the same region.

This is desirable for discovery (higher subtrees change rarely), but it creates a movement loophole: a mover could generate arbitrarily long hop sequences at near-zero marginal cost by reusing cached spatial results. They would only be able to travel places they had already been to once before, but instantly teleporting over previously trod terrain breaks the proof-of-work requirement continuity of cyberspace as a thermodynamic system.

Cyberspace v2 addresses this by extending movement proofs into a fourth dimension: a temporal work axis derived from the Nostr movement chain. Each hop includes an additional Cantor-tree computation whose height K is derived from the hop destination coordinate (a deterministic “terrain” function) and whose seed is derived from the previous movement event id. Because each Nostr event id commits to the previous event (including its proof), the temporal seed for hop N is not known until hop N-1 is complete; the work cannot be precomputed or amortized.

Importantly, this does not change what place means. Stable spatial region identifiers (used for location-based encryption and discovery) remain a pure function of coordinates, independent of time or identity. The temporal axis exists only to make advancing the movement chain cost work.

This is not a continuous “heartbeat” cost: an avatar’s last hop event remains its state indefinitely. The temporal axis work is paid only when moving.

Why Not Just Hash Grinding?

Standard proof-of-work (e.g., “find a nonce such that sha256(data + nonce) < target”) is arbitrary. The work is real, but the structure is not—you are searching a hash space, not traversing a space.

Cantor pairing trees create actual mathematical structure:

Each Cantor number represents a real subtree
Computing it means building the tree from leaves to root
The number is mathematically meaningful, not arbitrary

This is the difference between “digging a hole” (arbitrary work) and “following a path” (structured traversal). Both cost energy, but only one has spatial semantics.

3. The Chalk on the Sidewalk Metaphor

What Location-Based Encryption Is Actually For

The purpose is not primarily secrecy. There are better cryptographic systems for secure communication—Signal, PGP, authenticated encryption.

The purpose is to model traversable reality.

Consider a message written in chalk on a sidewalk:

It is not “encrypted” in any technical sense
Anyone who walks by can read it
But you cannot read it without walking there
Even if someone tells you about it, they had to walk there to know

This is a form of location-gated access that requires no keys, no permissions, no infrastructure. Only presence.

How Cyberspace Implements This

Region-derived keys are computed from Cantor roots. A ciphertext can be published publicly, but deriving the decryption key requires computing the region preimage.

The Discovery Radius

Each Cantor number represents a region, not a point. A number computed at height 10 covers 1,024 coordinates. This creates a natural discovery radius:

Height 4 (16 coordinates): like leaving a note on a street corner
Height 10 (1,024 coordinates): like a billboard in a neighborhood
Height 20 (~1 million coordinates): like a city-wide broadcast

Anyone who traverses through the region computes the same Cantor number. They derive the same decryption key. They discover the same content.

Hints: Whose Choice Is Discoverability?

The lookup id reveals nothing about a bag’s location, and a scan reaches only a few heights around the scanner, so a bag with no further information is discovered only by someone who happens to compute its region. In a 2^256 coordinate space that is the right property for a private message and a useless one for anything meant to be found: unhinted chalk is chalk nobody walks past.

The hint (spec §7.7) leaves that choice with the hider. The hider publishes an aligned box, one height per axis, on the bag. A seeker sweeps the box by deriving keys at the bag’s height for every candidate region inside it, so the gap between the box and the bag’s own region is the price of the search, and the work equivalence of §7.1 makes that sweep cost the same from anywhere. Reading a bag therefore has no distance term. Reaching it does: standing in the region requires the movement work of §4 to §6 and is proven by a movement chain. The protocol keeps the two apart on purpose. The hider gets a difficulty knob. Applications get a clean fact to reward. Nothing new is introduced to make this work: no registry, no referee, no trusted index.

Per-axis heights come free with aligned geometry, and they do real work. An exact X with coarse Y and Z is a two-dimensional hunt. A sector on all three axes says where to go, not where to look. Three heights equal to the bag’s height is a destination. One tag covers all of these cases, and the sector tags of §10 follow whenever a hint fixes a sector, so a relay can answer “what is hidden in this sector” with the filters it already has.

4. What Cyberspace Does NOT Solve

Honest Limitations

Physical location proof. Computing a Cantor number proves cryptographic presence at a coordinate, not that your body is at that GPS location. The Dataspace plane maps to physical coordinates, but you can “be” there computationally while physically elsewhere.

This is not a bug—it is inherent to any software-only system. True physical presence proof requires physical secrets (e.g., time-varying codes broadcast locally) that software-only systems cannot access.

Sybil resistance. One person can control multiple keypairs. The single-location constraint applies per-keypair, not per-person. An entity could “be” in multiple places by operating multiple identities.

This is acceptable. The protocol constrains identities, not people. Applications requiring unique human presence must layer additional mechanisms.

Traversal necessity. The Cantor number for any region can be computed directly without maintaining a movement chain. Someone could pick random coordinates, compute their Cantor numbers, and decrypt content there.

This is by design. The work is identical either way—observers have no computational advantage over travelers. What traversal provides is verifiable commitment: a movement chain proves you were on a specific path, at specific times, in a specific order.

Exclusive territory. A region’s Cantor root is a public function of its coordinates. Anyone who does the work gets the same value, so nothing in the mathematics can make a region belong to one party. The protocol offers holding (§6 below), which is a capability; it does not offer claims, title or exclusion, because those require a registry, and the protocol has none by design.

Why These Limitations Are Acceptable

The goal is not to create a perfect simulation of physical space. It is to create a thermodynamically meaningful spatial substrate where:

Presence requires work
Work is structured, not arbitrary
Observers have no advantage over participants
Movement history is auditable

5. From Fiction to Reality

The Vision

Cyberpunk fiction described cyberspace as:

A shared, consensual hallucination
A space where distance had meaning
Where skill and hardware determined power
Where nothing could happen without real work
Where you could be, move, and discover

The Layered Architecture

┌─────────────────────────────────────────────────────────┐
│  APPLICATION LAYER                                      │
│  avatar visualization, commerce, IOT interfaces         │
│  territory governance, AI embodiment constraints        │
├─────────────────────────────────────────────────────────┤
│  SPATIAL LAYER (Cyberspace Protocol)                    │
│  Coordinates, Cantor traversal, location-based          │
│  encryption, movement verification, discovery radius    │
├─────────────────────────────────────────────────────────┤
│  TRANSMISSION LAYER (Nostr)                             │
│  Events, relays, keypairs, signatures, propagation      │
├─────────────────────────────────────────────────────────┤
│  VALUE LAYER (Bitcoin/Lightning)                        │
│  Payments, incentives, economic weight                  │
└─────────────────────────────────────────────────────────┘

6. Use Cases

AI Embodiment Constraints

Cyberspace provides a form of digital embodiment:

an agent operating through a keypair has a verifiable location,
it cannot claim to be in two places at once without forking,
its movement history is auditable,
higher-level systems can gate capabilities on verified presence in addition to payments, signature challenges, etc.

Location-Based Secrets Without Infrastructure

Cyberspace does not require GPS trust, cell towers, or secure enclaves—only the mathematical work.

Territory: Holding, Not Owning

Computing a region’s root leaves every sub-region’s root in your hands; keeping them on disk is holding the region (spec §7.6). Holding buys latency on keys and nothing else. You read the whole wall at every height while a passerby reads the small print at eye level; you write at any height at once; and you can lock content to KDF(region_key || your_secret) so that reading it requires both presence and your permission. Anyone who does the work holds identical keys, chains are public to everyone, and nothing you hold affects anyone else.

Holding is not ownership, and the analogy to physical property breaks in an instructive place. Physical territory is rival: two bodies cannot share a point. Cyberspace territory is not: two avatars can share a coordinate, and two holders hold the same keys. Conflict over land follows from rivalry, so in cyberspace it does not follow from anything. It can only be chosen, as a game; see docs/territory-conflict-game-layer.md.

What holding costs is disk for as long as it is held (about 19 TB for the full trees of a 2 m cube, about 1.1 TB for the nested cubes around one position). That is the whole of the protocol’s maintenance economics: stop paying and your keys are a recomputation away again.

One privacy consequence is worth stating plainly: the holder can read everything location-encrypted inside the holding. Visitors who want privacy inside a held region layer their own end-to-end encryption on top. The landlord can bug the room.

Location is a privacy dial for holdings as for everything else (DECK-0001 §9.5): a region near a stop is reachable by anyone for a few GPU-hours; a region h60 inland is reachable by no one.

Continuous presence in a region still establishes verifiable history, which is the part applications build reputation on.

Ephemeral Regional Communication

Local, temporary messages (“blips”) are an example of higher-layer use, not a protocol requirement.

7. Work Equivalence: The Key Property

In almost every digital system, observers have advantages over participants. Cyberspace aims for a rare property: computing the region preimage costs the same whether you traveled there via a movement chain or computed it directly.

This serves the goal of modeling locality thermodynamically: you cannot know what is somewhere without doing the work.

8. Integration with Nostr

Nostr provides:

keypair identity,
event propagation,
signature verification,
permissionless relays.

Cyberspace adds:

where (coordinates and sectors),
distance (movement cost),
locality (region-derived keys and discovery).

9. Open Questions and Future Work

Making traversal mathematically necessary for computing region numbers (not just verifiable).
Relay specialization / indexing by region.
Terrain tuning: alternative deterministic “terrain” functions for deriving the temporal height K (and different cell scales / distributions).
Privacy enhancements (e.g., ZK proofs, obfuscated paths).

10. Conclusion

Cyberspace is an attempt to answer a specific question: can spatial properties be thermodynamically modeled in a digital system?

The protocol does not perfectly simulate physical space, but it does provide:

thermodynamically meaningful distance,
verifiable movement history,
location-gated access without trusted infrastructure,
work equivalence between observers and travelers.