Efficient Anonymous Cash Using the Hash Chain Member:劉岱穎，吳展奇，林智揚 近代電腦密碼學 Efficient Anonymous Cash Using the Hash Chain Member:劉岱穎，吳展奇，林智揚 Source: IEICE TRAN. COMMUN., VOL. E86-B, NO.3 2003 Author: Sangjin KIM and Heekuck OH

Outline Introduction Electronic Cash System Security Analysis Account Setting Withdrawal Protocol Initial payment protocol Subsequent payment protocol Anonymity Control Security Analysis Conclusion

Introduction Credit-based and vendor-specific Debit-based and vendor-independent

Advantage Debit-based Vendor-independent Provide trace mechanisms to counter illegal use

The flow User use withdrawal protocol to get money from bank(withdrawal protocol) User use the money that is provide by the bank to buy some things in a shop(payment protocol) The shop store the money to the shop’s account(deposit protocol) Authority can trace the coins and owners

Blind Signature signs coins database Bank 2. t 7. Coin 3. td mod N 1. t=SN×ke mod N SN: Serial # k: random number 2. t 7. Coin 3. td mod N Consumer Merchant 5. Coin 4. s=(td)/k mod N=SNd mod N 6. Verify the signature s Coin: SN＋s

System Setup Four types of players Clients Shops Bank Trusted authority

Initialization Bank: TA: Choose five generators of Gq: gb, gu,gs,gr,gl Secrete key: xb Public key: TA: Choose gt of Gq Secrete key: xct, xot Public key: ,

Initialization User: Secret key: xu , blind factor: r Public key: Compute: CT: , OT: hash chain (c0,c1,…,cl) of length L where ci = H(ci+1)

Withdrawal Protocol

Proof(E)

BlindSig Sig(C) =

Initialization Shop: Secrete key: xs Public key:

Initial payment protocol

Subsequent payment protocol

Anonymity Control Coin tracing Owner tracing Provide a way to deanonymize withdrawn cash so that the bank can recognize the cash at the time of deposit. Bank send CT to the trusted authority Authority computes CTxct =gbr Bank computes C/gbr=C Owner tracing Provide a way to deanonymize deposited cash so that the identity of the withdrawn is revealed Bank send OT to the trusted authority Authority computes OTxot =guxu Bank computes C/grcogllgtr=guxu ~

Security of the System Impersonation Unforgeability Manipulation Anonymity Straling Double spending

Conclusion This system is the only vendor-idependent one that provides full anonymity and variable payments