Namecoin

Summary

Namecoin is a key/value store on a Bitcoin-derived proof-of-work chain, merged-mined with Bitcoin since 2011. The key innovation: it was the first deployed system to put a human-readable name (example.bit) on a blockchain, with the property that the name is owned by whoever first registered it and only that person can update or transfer it. The same chain can store other identity data — GPG keys, Bitmessage addresses, TLS certificate fingerprints — and the same consensus rules apply.

Namecoin was the first to claim it squared Zooko's triangle: human-meaningful + decentralized + secure, all three, on a single Bitcoin-derived chain. The implementation has been around for 15 years, longer than any other blockchain-DNS effort, and is still maintained by a small but active team (Jeremy Rand, lead maintainer).

The current production reality: technical leadership and protocol innovation are real, but mainstream adoption of .bit is tiny. The reference deployment is ncdns plus ncp11 plus generate_nmc_cert (now ncgencert), which together make .bit sites work in stock Firefox and Chrome with no browser patching. This is the most polished end-to-end dDNS stack of any chain-DNS system.

Historical context

Architecture

The chain

• Algorithm: SHA-256 proof-of-work; merged-mined with Bitcoin since 2011 (block 19,200 of Namecoin).
• Block time: 10 minutes.
• Supply cap: 21,000,000 NMC (same as Bitcoin).
• Block reward: halving cycle same as Bitcoin (every 210,000 blocks).

A Bitcoin miner with getauxval-style support mines Namecoin blocks in parallel with Bitcoin ones at near-zero marginal cost. The merged-mining security model is the same as Bitcoin's for whatever fraction of hashrate mines Namecoin, which historically has been a large fraction when a major pool like F2Pool / ViaBTC / AntPool opts in.

Names as key/value records

A Namecoin name is a path of the form namespace/name. The most-used namespace is d/ (DNS). A d/example record corresponds to example.bit and stores DNS-related data in Namecoin’s JSON-based record format.

Names have: - A name (the key). - A value (data; up to ~520 bytes for typical operations). - An expiration (default 36,000 blocks ≈ 200 days; renewable). - An owner (the pubkey script of the registrant).

The record fee is small (0.01 NMC) plus the Bitcoin-style transaction fee. First-come-first-served: whoever registers first owns the name until expiration. No smart contracts; the name-update logic is in the consensus rules.

Resolver stack

ncdns + ncp11 + ncgencert is the working end-to-end path. With those three, a .bit site can serve HTTPS in an unmodified browser — a milestone that Handshake, Namecoin's spiritual successor, has not matched.

The cert problem (solved differently than Handshake)

Namecoin's answer to "no CAs sign certs for .bit" is ncp11 + AIA (Authority Information Access) + PKCS#11. Here's the dance:

1. A .bit operator generates a self-signed certificate.
2. The cert contains an AIA URL pointing to a chain-trust file hosted on the Namecoin chain (or, with Encaya, an off-chain file).
3. ncp11 runs as a PKCS#11 provider in the browser's NSS library.
4. When the browser validates the cert, NSS resolves the AIA URL against the Namecoin chain via ncdns, gets the trust anchor, and trusts the self-signed cert.

This is the interoperability magic of AIA and PKCS#11 that Jeremy Rand cites in talks: a special form of TLS cert that works in stock browsers without browser patching and without MITM-by-CA. The October 2025 work on Encasha (off-chain SSHFP) and the September 2025 work on AIA URLs (Windows 11 CryptoAPI URL length limit) are iterations of the same idea.

Maturity and active development

Interpretation: Namecoin is a real, active project with a small but expert maintainer team and continuous upstream Bitcoin Core rebases. The 28.0 release in Dec 2024 is a major proof of life — the codebase is current and not abandoned.

Use cases

1. Censorship-resistant web presence

A .bit site hosted on a self-managed server, with a Namecoin-anchored HTTPS cert. The end-to-end stack (ncdns + ncp11 + ncgencert) means a user with ncdns configured gets a working, secure, decentralized HTTPS site with no trust in any CA, registrar, or registry.

In practice, the user base is small (a few thousand power users), but the technological answer to "can a decentralized name have HTTPS?" is the most polished of any dDNS system.

2. Identity / NameID

The NameID protocol (2013) maps a Namecoin name to an OpenID-compatible identity. The use case has not scaled — the OpenID ecosystem itself declined — but the same id/ namespace mechanism is still available for self-asserted identity records: GPG keys, Bitmessage addresses, OTR keys, BTC addresses, TLS fingerprints.

3. Anchored identity for other systems

A Namecoin name can carry a GPG or SSH key fingerprint in a id/ namespace record. The pattern: register pgp/alice.bit once, reference the same record from email signatures, PGP keyservers, and other systems. The record is anchored to the Namecoin chain; the keyserver mirrors are not the source of truth.

4. SSHFP records via Encasha

The September 2025 Encasha work extends off-chain TLSA to off-chain SSHFP, providing a Namecoin-anchored SSH server fingerprint. Use case: SSH clients verifying host keys without trusting TOFU + known_hosts alone.

Trade-offs

Strengths

• First mover, longest track record — 15 years of operation, longer than any chain-DNS competitor.
• Squares Zooko's triangle — first to claim it, technically defensible.
• End-to-end HTTPS works in stock browsers — ncp11 + AIA is the cleanest answer to the cert problem of any dDNS system.
• Merged mining with Bitcoin — the security budget is Bitcoin's hashrate when miners opt in.
• Active development — Namecoin Core 28.0 in Dec 2024, plus a steady stream of resolver / TLS / SSHFP improvements through 2025.
• Real community events — FOSDEM 2026, 39C3 in Dec 2025, GCER 2025.
• Open governance — no company, no token-holder vote, no DAO smart contract.

Limitations

• Tiny user-facing ecosystem. A handful of working sites; mainstream awareness is low.
• Name squatting — first-claim-wins with no auction; valuable names (short, common) were taken in 2011–2013 and have not been released.
• Renewal friction — names expire every 36,000 blocks (~200 days) unless renewed; lose the key, lose the name.
• Namecoin transaction fees — registration and updates are Namecoin transactions; merged mining does not make Bitcoin’s transaction-fee market the fee market for names.
• OpenNIC dropped .bit (2019) — public alternative-root support evaporated.
• No smart contracts — limits composability (compared to ENS, Cardano DNS, DNSSEC-into-ENS).
• On-chain privacy — name registrations are public, like all UTXO-chain transactions.

Attack surface

Comparison

Namecoin is the system to study if you want the most "no-trust-at-all" answer to "can a decentralized name have HTTPS without a CA?" — and if you're willing to live with a small ecosystem.

Operational notes

If you want to use Namecoin in 2026:

1. Run a Namecoin node or use a hosted RPC. For a .bit site operator, run namecoind and ncdns on the server.
2. Generate a name keypair for the .bit name. Store the privkey on a hardware wallet or a strong passphrase-protected wallet.
3. Register the name (a name_firstupdate transaction), then renew before expiration (every 200 days).
4. Generate the TLS cert with ncgencert (renamed from generate_nmc_cert in Sep 2025).
5. Configure ncp11 on every client that needs to verify your cert — most easily via Firefox, which loads NSS PKCS#11 modules.
6. Configure ncdns as the system resolver for .bit, or use a community resolver.

For a .bit site visitor:

1. Install ncdns locally.
2. Configure your system resolver to use ncdns for .bit.
3. (Optional) Install ncp11 in Firefox for the TLS verification path.

Primary sources

• Namecoin Core
• ncdns resolver
• ncp11 PKCS#11 module
• Encaya
• Namecoin Core 28.0 release
• Namecoin: post-quantum TLS
• Namecoin: ncp11 code quality
• Handshake proof-of-work implementation
• Namecoin documentation
• DNNS implementation overview