1. Efficient Anonymous Cash Using the Hash Chain Member:劉岱穎，吳展奇，林智揚
近代電腦密碼學
Efficient Anonymous Cash Using the Hash Chain
Member:劉岱穎，吳展奇，林智揚
Source: IEICE TRAN. COMMUN., VOL. E86-B, NO
Author: Sangjin KIM and Heekuck OH

2. Outline Introduction Electronic Cash System Security Analysis
Account Setting
Withdrawal Protocol
Initial payment protocol
Subsequent payment protocol
Anonymity Control
Security Analysis
Conclusion

3. Introduction Credit-based and vendor-specific
Debit-based and vendor-independent

4. Advantage Debit-based Vendor-independent
Provide trace mechanisms to counter illegal use

5. The flow
User use withdrawal protocol to get money from bank(withdrawal protocol)
User use the money that is provide by the bank to buy some things in a shop(payment protocol)
The shop store the money to the shop’s account(deposit protocol)
Authority can trace the coins and owners

6. Blind Signature signs coins database Bank 2. t 7. Coin 3. td mod N
1. t=SN×ke mod N
SN: Serial #
k: random number
2. t
7. Coin
3. td mod N
Consumer
Merchant
5. Coin
4. s=(td)/k mod N=SNd mod N
6. Verify the signature s
Coin: SN＋s

7. System Setup Four types of players Clients Shops Bank
Trusted authority

8. Initialization Bank: TA: Choose five generators of Gq: gb, gu,gs,gr,gl
Secrete key: xb
Public key:
TA:
Choose gt of Gq
Secrete key: xct, xot
Public key: ,

9. Initialization User: Secret key: xu , blind factor: r Public key:
Compute:
CT: , OT:
hash chain (c0,c1,…,cl) of length L where ci = H(ci+1)

10. Withdrawal Protocol

11. Proof(E)

12. BlindSig
Sig(C) =

13. Initialization
Shop:
Secrete key: xs
Public key:

14. Initial payment protocol

15. Subsequent payment protocol

16. Anonymity Control Coin tracing Owner tracing
Provide a way to deanonymize withdrawn cash so that the bank can recognize the cash at the time of deposit.
Bank send CT to the trusted authority
Authority computes CTxct =gbr
Bank computes C/gbr=C
Owner tracing
Provide a way to deanonymize deposited cash so that the identity of the withdrawn is revealed
Bank send OT to the trusted authority
Authority computes OTxot =guxu
Bank computes C/grcogllgtr=guxu ~

17. Security of the System Impersonation Unforgeability Manipulation
Anonymity
Straling
Double spending

18. Conclusion
This system is the only vendor-idependent one that provides full anonymity and variable payments