Download presentation
Published byIsabel Buchanan Modified over 11 years ago
1
Simple and Practical Anonymous Digital Coin Tracing
Trustee Tokens Simple and Practical Anonymous Digital Coin Tracing Ari Juels RSA Laboratories
2
Quick Review of Chaumian E-cash
(DigiCashTM)
3
Anonymous digital $1 coin
Alice BANK PK SK Signs Alice -$1 Anonymous digital $1 coin
4
r, x rf1/3(x) r3f(x) (x, f1/3(x)) rf1/3(x) = (x, Sig(x)) = PK SK mod n
Alice BANK PK SK mod n Signs 3 r3f(x) r, x rf1/3(x) r3f(x) (x, f1/3(x)) = (x, Sig(x)) = rf1/3(x) rf1/3(x)
5
Improved Computer Viruses
(Young and Yung) An Application for Anonymous E-Cash An Application for Anonymous E-Cash
6
Improved Computer Virus
r3f(x) Generates unsigned, blinded coin Generates encryption key pair Edgar
7
Improved Computer Virus
r3f(x) PK
8
Alice
9
Hard Disk
10
Files Encrypted under PK *&DUHF(&$YY$H&*^$RH(*&UH
*&(#*R&(*&(*$&(*$&(*U(*F&(*&* *&HKJF(*$YHF(*H$(*^FH*($HF& J(*F&$(*HS(*&$JF*($&SH$*&F$ *(&$*(F&(*$F$(*F&S(*&*F(&*E$$ )*F&(*$&*$&F(*$&F(*$&(*&(#(*$ Encrypted under PK PK Files
11
If you Want SK, i.e., your files, withdraw this Ransom Note
12
Alice BANK Oh, my files! Alice -$1
13
HETTINGA SUCCEEDS GREENSPAN AT FED
14
Anonymous coin Edgar
15
Answer: Trustee-based Tracing
How can we prevent this?
16
The Idea: Trustee Tracing
Anonymous coin
17
Tracing: Basic Idea I order the Trustee to trace this coin. Edgar
Anonymous coin Judge Trustee Secret SK
18
Coin is anonymous unless trustee traces it
19
Many Trustee-based Tracing Schemes
Brickell et al. ( ‘95) Stadler et al. (‘95) Jakobsson and Yung (‘96, ‘97) Camenisch et al., Frankel et al. (‘96) Davida et al. (‘97)
20
Trend in schemes Our Scheme Security Trustee Simplicity Computational
Features Trustee Flexibility Simplicity Computational Efficiency
21
How our scheme works
22
1. 2. Two stages Token withdrawal Alice Trustee Coin withdrawal Alice
BANK 2.
23
Token withdrawal Proves identity Alice Trustee Checks that Trustee
coin contains [“Alice”]PK Trustee Token
24
Trustee Token Proves identity Alice r, x Trustee Trustee Checks that
x contains [“Alice”]PK SigSK(r3f(x))
25
Coin withdrawal , Conditionally anonymous digital coin SK Alice Checks
BANK SK Signs , Checks Conditionally anonymous digital coin
26
Observe: No change in coin structure or underlying withdrawal protocol
27
Tracing Trustee Token scheme guarantees
that coins contain creator identity
28
Blackmail scenario Edgar registers his coin and gets caught or
Alice can’t make the withdrawal for Edgar
29
Enhancements
30
No coin storage Alice can pseudo-randomly generate coins and blinding factors -- no coin storage
31
Bulk token withdrawal Alice can withdraw many tokens at once and store prior to coin withdrawals
32
One token - multiple coins
33
Result of Enhancements
Little interaction with Trustee Tokens fit on, e.g., smart card
34
Pros and Cons
35
Advantages over other schemes
Very simple Provably secure No change in coin structure, underlying protocol Seamless incorporation with DigiCashTM
36
Disadvantages Trustee interaction needed
Security with multiple trustees needs trusted dealer Seamless incorporation with DigiCashTM - but no DigiCashTM
37
But... Can be used for general blind RSA
E.g., X-cash Method can perhaps be extended to other e-cash systems (?)
38
Questions?
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.