Introduction to Modern Cryptography, Lecture 13 Money Related Issues ($$$) and Odds and Ends

Homework #3 Consider a verifyable secret sharing scheme (VSS) based on Shamir's polynomial secret sharing as follows. A dealer has a secret S, a public prime p and a public generator g of Z p *. The dealer gives player p j a share s(j) in a degree-t polynomial whose value at zero is a random a 0. The dealer publicizes S * a 0, as well as commitments to all shares in the form g s(j) (mod p). Suppose that an auditing agency wishes to check that the dealer is not corrupt. The agency can view all public information, but no secret data (in particular, no private share of any player). Furthermore, it cannot interact with the players, who might not be on-line during the check. Describe how the auditing agency can verify that all the commitments to shares are consistent, i.e., that any subset of t+1 commitments defines the same, unique committed secret.

Homework #3 Suppose Bob has split a secret amongst n people such that k out of them can reconstruct the secret. –Suppose Bob wants to increase k? –Increase n? –Decrease k? –Decrease n? What should he do?

Homework #3 Voting schemes: –You want to arrange a Yes/No vote so that Everyones vote is secret Anyone can verify that the final result is correct What can you do? Look up the literature on voting schemes.

Electronic Checks Simple: Sign a document transferring money from your account to another account This document goes to your bank The bank verifies that this is not a copy of a previous check The bank checks your balance The bank transfers the sum

Problems Requires online access to the bank Is expensive (?) $0.25 per bank transaction minimum The bank / income tax authorities / etc. can easily trace your activities

Online Non-Anonymous Cash Let ’ s follow the flow of a $1 bill: The bank debits the customer account by $1, takes the string “ account number ” || “ serial number ”, signs it, and sends it to the customer The customer presents this to the merchant The merchant sends this to the bank, that verifies that the bill has not been used previously

Problems Requires online access to the bank Is expensive (?) $0.25 per bank transaction minimum The bank / income tax authorities / etc. can easily trace your activities Only difference from electronic check: does not have to check balance, does have to check non-reuse

Some concepts Untraceable electronic cash –Online –Offline Micropayment protocols “ Real Protocols ” – SET, EMC, –EMC is really used, old –SET seems to be dead in the water

Main idea (Chaum): blind signatures RSA: m 1/e mod n Blind RSA: –Two party protocol: Alice sends Bob (r e m) mod n Bob computes (r e m) 1/e = r m 1/e mod n Alice computes m 1/e mod n Problems: –Alice can get Bob to sign anything, –Bod does not know what he is signing

Online Non-Anonymous Cash Let ’ s follow the flow of a $1 bill: Alice takes the string m = “ account number ” || “ serial number ”, chooses a random r, and sends m r e mod n to the bank The bank signs this message and sends m 1/e r to Alice Alice extracts a signature on “ account number ” || “ serial number ” (m 1/e ), and gives it to the merchant The merchant sends this to the bank, that verifies that the bill has not been used previously

Problems No anonymity What is Alice having signed anyway? The bank does not know. –Imagine that a signature on the string “ f(s) ” means one dollar –Alice could prove to the bank that this is the format of what she is asking for Could be done via general multiparty computation Could be done via cut and choose (the rabbit problem)

Online Anonymous Cash Alice chooses a random s, r, sends r e (f(s)) to the bank The bank debits Alice ’ s account by $1 and send r (f(s)) 1/e to Alice Alice extracts (f(s)) 1/e, and gives it and s to the merchant The merchant sends this to the bank, that verifies that the bill (s) has not been used previously

Advantages & Problems: The bank has given Alice a bill, but does not know what the bill looks like The bank cannot later identify Alice with the bill The bank must be online at all times to identify bills Multiparty computation is entirely inefficient

How to do cut and choose here Alice sends the bank many values z 1, z 2, …, z k The bank asks Alice to reveal ½ of the values z i = r i (f(s i )) The bank extracts the root of the multiplication of all the others The bill is valid if it is of the root of a product of (f(s i )) Remark: in this case, it ’ s not clear that we need for Alice to prove anything to the bank, any deviation from protocol for Alice can only harm her

How to do Offline Anonymous Cash? If Alice “ double spends ” – she will be caught and identified If Alice does not – her anonymity is guaranteed The merchant cannot reuse the money (other than send it to the bank)

Idea: encode Alice ’ s identity into the money Alice generates f(s 1 ), f(s 2 ), … f(s k ), t 1 || f(t 1 ), f(t 2 ), …, f(t k ), such that s i xor t i = “ Alice ” Alice sends blinded versions of all of these to the bank The bank verifies the correctness and sends Alice the root of the product of the indices not revealed The merchant asks alice for the signature and for a random subset of the indices If Alice double spends, her identity becomes known to the bank.