[42203] in Cypherpunks
Re: How can e-cash, even on-line cleared, protect payee identity?
daemon@ATHENA.MIT.EDU (Hal)
Tue Oct 24 20:12:33 1995
Date: Tue, 24 Oct 1995 16:49:02 -0700
From: Hal <hfinney@shell.portal.com>
To: weidai@eskimo.com
Cc: cypherpunks@toad.com
From weidai@eskimo.com Tue Oct 24 14:03:02 1995
> Using the above protocol, payee anonymity will not be compromised by
> collusion between the bank and the payer, but the payee and the bank can
> collude to identify the payer! (This reverses the situation in normal
> Chaumian ecash, and of course in certain circumstances may be preferable.)
>
> This collusion can succeed even if Alice (the payer) reblinds the coin
> she gets from Bob before asking the bank to sign it, because Alice must
> withdraw the coin after Bob gives it to her and before returning it to Bob.
> Bob can ask the bank to record the names of everyone who withdrew money
> during that period, and after two or three repeated transactions can
> narrow the list of possible payers down to one person. (This is reminescent
> of the time-correlation attack on remailers.) In the original protocol
> this isn't possible because Alice can withdraw the money ahead of time.
It is interesting that the situation is so symmetrical. Given
collusion with the bank by the other party, with regular ecash we
protect Alice's but not Bob's anonymity. With this "reverse ecash" we
protect Bob but not Alice. (Alice is the payor, Bob the payee.)
If people were allowed to exchange coins anonymously, either system
will provide anonymity for both parties. (In the reverse ecash system
Alice hands the the blinded proto-coins along with some regular coins
to the bank and receives blinded new coins.)
Earlier there was discussion of an ecash coin-exchanging service
("Charlie") designed to provide payee anonymity in the regular ecash
system. Bob would send his newly-received coins to Charlie along with
blinded proto-coins. Charlie would then exchange them at the bank and
send the new (blinded) coins back to Bob. Charlie and Bob can be
anonymous to each other, but Bob has to trust Charlie with his coins.
A similar service would work for the reverse ecash system to protect
Alice's anonymity. Bob blinds some proto-coins and sends them to
Alice, who further blinds them and sends them to Charlie along with
some regular coins of the same values. Charlie exchanges the regular
coins for new coins using the doubly blinded proto-coins. He gives the
blinded coins back to Alice, who unblinds them and gives them to Bob,
who removes the last blinding to reveal the valid coins. It is Alice
in this protocol who has to trust Charlie with her coins.
Hal
