Digital Cash
Mehdi Bazargan
Fall 2004
Introduction
•
•
•
•
•
•
•
Definition
Motivations
Overview
Properties
Blind Signatures
Brands Scheme
Analysis
Definition
• Since hard currency or paper cash carries total
anonymity in transactions, the term digital cash is coined
to refer to anonymous electronic token based payment
systems.
• Digital Cash is meant to work as paper cash.
• There are different implementation of Digital Cash.
• Digital Cash is a technical product of anonymous digital
commerce in strategic level.
• It is a highly political subject.
Well…
• Anonymous? How can I prove I made my payments?
• Private? What keeps the bank from stealing from me?
• If a government doesn't know who pays whom, how can
it collect an income tax?
• If the ownership of financial assets is indeterminate,
what happens to taxes on financial assets?
Motivations
• Comparing to paper
cash, paper cash is: slow,
vulnerable, costly, and
difficult to transfer.
• Compared to credit
cards, digital cash
provides more anonymity
and security.
Overview
2
1
3
4
5
1. Alice deposits cash into the bank
2. Alice receives some coins
3. Alice sends over the coins to Bob
4. Bob receives the coins
5. Bob cashes the coins and send Alice the product
Overview
• There are several approaches in implementing digital
cash: “Simple Anonymous Cash” by Fiat-Caum-Naor,
“Traceable Anonymous Cash” by Ferguson, the Brands
scheme, and “Auditable, Anonymous Electronic Cash” by
Sander-Ta-Shama.
• The introduced methods have advantages and
disadvantages. The Brands scheme provides reasonable
security and anonymity; however, it is more complicated.
Overview
• In Brands Scheme, we will mostly get benefit from a set
of algorithms and mathematical toolkits:
• Prime Factorization:
In short, it is hard to calculate prime factors of N=p.q
where p and q are large primes.
• Discrete Log Problem:
In short, if you have x= ga mod p, it is hard to find a
where x and g are known.
Overview
• Representation Issue in Groups with Prime Order
Given a prime group G and a generator tuple of G (g1,
g2,..gn), and constant h, it is hard to find a
representation of h as Πki=1 (giai) where ai belongs to Z.
However, it would be easy if you know the generator
tuple and integers ai.
• Schnorr’s Digital Signature
A method of signing messages and verifying validity of
signatures.
Properties
Some important features of the system include these:
• The on-line system is a self-contained subset of the off-line system,
and if the off-line features are not used, the remaining software-only
system still could be efficiently implemented.
• Payments are private-- i.e. untraceable and unlinkable.
• The customer is protected from fraudulent bank claims that the
customer is double-spending (i.e. protected from framing attempts by
the bank),
• There is non-repudiation-- customers cannot deny having made a
valid payment.
Restrictive Blind Signature
• Let M denote a message. This message may be
anything, including a piece of digital cash to be signed. To
sign this message, the bank will raise it to the power x
mod p, yielding
[1] z = signed(M) = M^x.
• If we raise the message M to a random power w, we will
call the result b a pseudo- signature. That is,
[2] b = pseudo-signed(M) = M^w.
Restrictive Blind Signature
•The public key of the signer is a generator g raised to the
power x. So let's call the generator g raised to a random
power w a pseudo-public key. Label this a. Thus we
have:
[3] public key h = g^x,
[4] pseudo-public
key a = g^w.
Restrictive Blind Signature
• The steps in the restrictive blind signature protocol are
as follows (all calculations in this protocol are done mod
p, unless otherwise stated):
•Step 1: The customer, Alice, sends a message M to the
bank. It is intended that the bank sign M with its secret
key x: z = M^x
•The proof is to guarantee to the customer that the bank
has signed M with a valid signature; namely with its
secret key x.
Restrictive Blind Signature
• Step 2: The bank, generates a random number w and
sends to the receiver, Alice, the following elements:
the signed message z = M^x
the pseudo-public key a = g^w
the pseudo-signed message b = M^w
• We shall see that b & a will be used in part to provide
zero-knowledge proof for Alice that the bank’s signature is
valid.
Restrictive Blind Signature
• Step 3: The receiver generates a challenge c. To do
this, the customer first generates four random numbers:
s, t and u, v. Using s and t, the customer computes
modifications of M and z, namely the blinded message M'
and the signed blinded message z':
[5] M' = M^s * g^t (blinded message)
[6] z' = z^s*h^t
= (M^x)^s*(g^x)^t
= [M^s*g^t]^x
= M'^x (signed blinded message)
Restrictive Blind Signature
• Using u and v, the receiver (customer) computes
modifications of a, and b, namely, a', and b':
[7] a' = a^u*g^v = (g^w)^u*g^v = g^w',
[8] b' = [a^(u*t)]*[b^(u*s)]*M'^v
= [(g^w)^(u*t)]*[(M^w)^(u*s)]*M'^v
= [(g^t)^(u*w)]*[(M^s)^(u*w)]*M'^v
= [M'^(u*w)]*M'^v
= M'^w'.
where
[9] w' = u*w + v mod q.
Restrictive Blind Signature
• The customer then computes the hash value
[10] c' = H(M', z', a', b'),
and sends to the bank the challenge c:
[11] c = c'/u mod q .
•Step 4: The signer (bank) responds with
[12] r = w + c*x mod q.
•Notice this is a point on a line with slope x (the secret
key) and intercept w.
Restrictive Blind Signature
• Step 5: The receiver, Alice, uses the challenge c and
the response r to check that
[13] a*h^c = g^r
and
[14] b*z^c = M^r .
• If so, the receiver accepts the signature.
Brand’s Scheme
• Uses the concepts in
signature blinding as
discussed. Brand’s
implementation of Digital
Cash considers:
• Opening an Account
• Withdrawal
• Deposit
• Payment
Opening an Account
• The user has public/private key pairs. These are not
used in the protocols that follow so will not be denoted by
individual symbols. But we require that the user be able to
send digitally signed messages to the bank.
• To open an account, the user U generates a random
number u1 from Z(q)*, and computes an identifier or
public key
[15] hu = g1^u1 mod p .
Opening an Account
•The user checks that hu*g2 is not equal to 1 mod p, and
if so sends hu to the bank, keeping u1 secret. The bank
stores hu along with any other information it requires on
U. The bank computes and returns to the user U a
signature with its secret key x as follows:
[16] z = (hu*g2)^x mod p .
Withdrawal
• Before the user U is allowed to withdraw a coin, U must
first prove ownership of his account.
•Step 1: The bank generates a random number w from
Z(q)*, and sends the pseudo-public key a and the
pseudo-signed message b to the user U:
[17] a= g^w mod p
[18] b = (hu*g2)^w mod p
Withdrawal
•Step 2: The user U
generates three random
numbers s, x1 , and x2 from
Z(q)*. These are used to
calculate:
[19] A = (hu*g2)^s mod p
[20] B = g1^x1*g2^x2 mod p
[21] z' = z^s mod p
Withdrawal
• U also generates two random numbers u, v from Z(q)*.
These are used to calculate
[22] a' = a^u*g^v mod p
[23] b' = b^(s*u)*A^v mod p
• The user U then computes the challenge c' as:
[24] c' = H(A, B, z', a', b')
then sends the blinded challenge c back to the bank:
[25] c = c'/u mod q .
Withdrawal
• The coin is the set of numbers {A, B, (z',a',b',r')}.
• (z',a',b',r') is Schnorr’s signature on A, B.
• Denominations… take different g for each different
denomination.
Withdrawal
• Step 3: The bank sends the response r :
[26] r = w + c*x mod q
and debits U's account in the amount equal to the value
of one coin.
•Step 4: U accepts the debit only if
[27] g^r = a*h^c mod p
[28] (hu*g2)^r = b*z^c mod p .
•The user U also calculates r':
[29] r' = v + r*u mod q .
Payment
• When the user U is ready to spend the coin, the
following protocol is enacted between the user and the
shop S:
•Step 1: The user sends {A, B, (z',a',b',r')} to S.
•Step 2: The shop returns the challenge d:
[30] d = Ho(A, B, SHOP-ID, DATE-TIME) .
•Step 3: The user U calculates the responses r1, r2:
[31] r1 = d*(u1*s) + x1 mod q
[32] r2 = d*s + x2 mod q
Payment
• Step 4: The shop S
accepts the coin only if:
[33] g^r' = a'*h^c' mod p
[34] A^r' = b'*z'^c' mod p
[35] A^d*B = g1^r1*g2^r2
mod p
Deposit
• When the shop S is ready to deposit the coin at the
bank, the shop sends the payment transcript consisting of
the coin {A, B, (z',a',b',r')}, along with (r1, r2) and the
DATE-TIME of the transaction. The bank already knows
the SHOP-ID, which is used in the communication.
• Step 1: The bank verifies equations [33] to [35] to see
that this is a valid coin.
Deposit
• Step 2: If the coin is valid, the bank checks its database
to see if the coin was spent previously.
• CASE A: If the coin is not in the database, then it was
not previously spent. Hence the bank credits the account
of S, and records the coin in the form
{A, B, DATE-TIME, r1, r2}.
Deposit
• CASE B: If the coin is already in the database, then a
fraud has occurred. If S previously deposited the coin,
and the DATE-TIME are the same, then S is trying to
deposit the same coin or transcript twice. The deposit is
rejected for that reason. The bank knows the identity of
the shop S responsible.
Deposit
• CASE C. Otherwise, the coin has been double-spent,
and the bank takes steps to unmask the double-spender.
The bank has two sets of information on the coin:
{A, B, DATE-TIME, r1, r2}.
{A, B, DATE-TIME', r'1, r'2}.
•Hence, the bank can calculate
•(r1 - r'1) / (r2 - r'2) = [d*(u1*s) - d'*(u1*s)] / [d*s - d's]
= u1 mod q.
•Thus it can check its database for the user identity!
Analysis
• Advantages:
Security of this system rests
on the difficulty in finding
discrete logarithmic factors.
Other systems rely on prime
factorization used in RSA.
So the ability in factoring for
large primes would not break
this system as it would be
the case in other systems.
Analysis
• Advantages:
The major advantage of this
mechanism is that the user
does not need to keep track
many copies of identity and
many different bills as is the
case in other systems.
Analysis
• Disadvantages:
This scheme is difficult to understand and is more
complex compared to other mechanisms used such as
Chaum’s system. Moreover, since we use discrete
logarithmic signatures, we have to deal with larger
signatures compared to other methods.
References
• Jahanian Farsi, Mandana. Digital Cash. Retrieved: November. 2004
www.simovits.com/archive/dcash.pdf
• Cormen, Leiserson, Rivest, and Stein. Introduction to Algorithms.
Massachussetts: McGraw Hill, 2001.
• Sander, Ta-Shama. Auditable, Anonymous Electronic Cash. Retrieved:
November. <2004 www.cs.tau.ac.il/~amnon/Papers/ST.crypto99.pdf>
• Bleumer, Gerrit. Electronic Cash. 25 April. 2004.
http://www.win.tue.nl/~henkvt/GBl.ElectronicCash.pdf
• Orlin Grabbe,J . Stefan Brands' System of Digital Cash . 1997.
http://www.aci.net/kalliste/stefbrdc.htm
Questions, Comments…
?