Class 12 Anonymous Digital Currency CIS 755: Advanced Computer Security Spring 2014 Eugene Vasserman

Administrative stuff Exam I returned – Questions? Corrections to today’s paper: – Published table incorrect – Number of communication rounds typo – Corrected paper at: cash-icdcs07.pdf

What is eCash? Merchant eWallet Wallet Exchanger

Properties of eCash Unforgeability Non-reusability Anonymity – Untraceability – Unlinkability

Comparisons eCash versus – Cash – Credit cards – Micropayments Motivations – Like cash, but digital!

Applications of eCash Online payment – Lower processing costs than credit cards Micropayments – Content – Advertising replacement – New business models

Challenges Double-spending – What is it? – Why is it a problem?

Double-spending Chaum, 1982 – Centralized online agent Offline double-spending detection – Chaum – 1988 Revocable anonymity – Problem! Brands – Tamper-proof agent/device (online)

Problem Statement Design an eCash scheme that provides – Anonymity – Real-time double-spending protection – Decentralization – No trusted hardware – No client security deposit – Practical/deployable

Key Components Broker WitnessClient Merchant

Witnesses Method to transform centralized entity into group of peers – Witnesses do online double-spending detection Use merchants as witnesses – CCI assumption – Long-term presence assumption A coin is assigned uniquely to witness

Witnesses Challenges Who chooses witnesses? – Bank Anonymity loss – Client Collaboration, load balancing/fairness Incentives Fairness

Withdrawal Broker Client Hi

Withdrawal Key Points Witness selection based on h(bare coin) and witness list version/date Signature on witness assignment Broker does not know h(bare coin)!

Commit Witness Client

OK Payment Client Merchant Witness

Payment Key Points “Bare coin” – Includes secret extractable information – Signed by broker

OK Redeem Broker Merchant

Security Properties Provably untraceable and unlinkable Provably secure against forgery and re-use

Complexity Analysis Overhead – Should be dominated by network times ExpHashSigVerComm Withdrawal Client Broker3100 Payment Client Witness7621 Merchant7603 Deposit Merchant Broker6401 Renewal Client Broker9400

Implementation Proof of concept – Python 2.4 – 1200 lines of code in four modules Simplicity – REST (REpresentational State Transfer) Performance – Python crypto is less than stellar

Future work Performance – Convert to OpenSSL call blocks Firefox extension – Payment tag plus Java extension to implement client-side crypto

Summary I Broker WitnessClient Merchant

Summary II What stops collusion? What happens if compromised: – Broker? – Merchant? – Witness? – Client?

Expiration Dates Two expiration dates: – After (1), coin: Can be renewed Can not be spent Can not be deposited – After (2), coin is completely useless Prevents broker coin database from growing too big

Questions? Reading discussion