Micropayments Revisited Written by Silvio Micali and Ronald Rivest Presented by Charles Song and Michael Wasser

Digital Payments Involves Buyers, Merchants, and Brokers Simplest form is ‘electronic checks’  Usually involves manual entry/signing Some transactions are too small  Sum of micropayments may not equal a macropayment

Micropayment Goals Make payments of variable size with little user intervention Aggregate small transactions into larger ones Simple yet secure All parties incur low transaction costs and:  Buyer: No user intervention in process with no risk  Merchant: Low expenses (low transaction cost)  Bank: Verifiable transactions

Common Deviations Buyers make fake payments or underpay Venders try to overcharge or cheat the broker Collusion between two parties against the third

PayWord Buyer creates “H-chain”  x0, x1, x2,..., xnxi = H(xi+1) for i = 0, 1,... n where xn is random Sends x0 to merchant Buyer makes payments to merchant (xi, i) Merchant decides when to send bank (xi, i) and x0 Bank verify payment amount by running H() function

PayWord Analysis Pros  If H is good, hard for parties to cheat the system  Cost of reversing the function can outweigh the benefit Cons  Merchant cannot combine payments from multiple buyers, deposit might cost more than payment value  Every unit of payment requires calculation

Rivest's Lottery Merchant creates “H-chain” and gives the buyer w0 Buyer creates “H-chain” and gives the merchant x0 Buyer makes payments to merchant (xi, i) and calculates (xi mod 1/s) Merchant gives (wi, i) to buyer and calculates (wi mod 1/s)

Rivest's Lottery if (xi mod 1/s) == (wi mod 1/s) then payment is worth 1/s * payment unit Probability of (xi mod 1/s) == (wi mod 1/s) is exactly s On average buyer pays and merchant receives the correct amount

Rivest's Lottery Anaylsis Pros  Lowers processing cost due to less payable transactions Cons  Buyer and merchant must interact to determine payability  Buyer has the risk of over paying in short term, psychological burdens for buyer

MR1 T - transaction contains merchant, buyer, bank, merchandise, transaction time and value. F - public function that outputs values between 0 and 1 C - digital check

MR1 Buyer sends C to merchant, C = SIGu(T) Merchant calculates F(SIGm(C)) If F(SIGm(C)) < s then C is payable, merchant sends bank C and SIGm(C) Bank can send SIGm(C) to buyer for verification 1/s payment unit is made

MR1 Analysis Pros  Two-way interaction not required for transactions Cons  Buyer still suffer from psychological burdens

MR2 SN - Serial number starting from 1 and incremented sequentially MaxSN - maximum serial number processed by the bank so far

MR2 Buyer sends C to merchant, C = SIGu(T), along with SN and time Merchant calculates F(SIGm(C)) If F(SIGm(C)) < s then C is payable, merchant sends bank C and SIGm(C) along with SN and time from buyer Bank makes 1/s payment unit to merchant Bank charge buyer SN – MaxSN, set MaxSN = SN

MR2 Anaylsis Pros  Two-way interaction not required for transactions  User has no risk of over paying Cons  Bank takes on all the risk of under payment  Punishment system might be hard to enforce  Honest user might be blamed for wrong-doing

MR3 t' and t - time of M's last and current deposit

MR3 Buyer sends C to merchant, C = SIGu(T), along with SN Merchant groups all Cs between t' and t into (L1...Ln), values are (V1...Vn), total value V Merchant computes Ci = H(Li, Vi) then sends C1,...,Cn to the bank  SIGm(t, n, V, H(L1,V1),...,H(Ln,Vn))

MR3 Bank selects k indices, i1, i2,...ik, and sends them to merchant Merchant de-committing Ci1,...,Cik Bank credits merchant account with V and debits the buyers in Li1,...,Lik according to the Sns Selected buyers pay everything owed since last time they are selected

MR3 Analysis Pros  Two-way interaction not required for transactions  User has no risk of over paying  Bank determines which checks are payble Cons  Bank takes on all the risk of under payment  Punishment system might be hard to enforce  Honest user might be blamed for wrong-doing