Electronic Banking

Some time back Tim May suggested that we should do some experiments
with electronic cash.  He offered to do some Xeroxing if people would
"pay" him.

There are lots of proposals for electronic cash in the literature,
mostly very complex.  I think one of Chaum's simpler proposals would be
adequate for email "banking".  This proposal, from the beginning of
his paper "Untraceable Electronic Cash" in Crypto 88(?), goes like
this:

1. Alice chooses a random x and r, and supplies the bank with
B=r^3*f(x) mod n, where f is a one-way function (like MD5), and n is
the modulus for the bank's public key.

2. The bank takes the third root of B (e.g. via an RSA decryption) and
sends it back to Alice: D = r * f(x)^(1/3), and withdraws one dollar from
her account.

3. Alice extracts C = f(x)^(1/3) by dividing D by r.  (Note that
division can be done mod n without knowing the factors of n, but it's
rather complicated.)

4. To pay Bob one dollar, Alice gives him (x, C).

5. Bob can verify that C = f(x)^(1/3), but he still has to send (x, C)
to the bank in order to make sure that x hasn't been used before.
Otherwise Alice could spend (x, C) twice.  The bank increases Bob's
account by one dollar.

This scheme is pretty simple and provides untraceability - the bank
saw B and D but not C, so although it can verify that (x, C) is legit,
it can't correlate that with Alice's withdrawal.

The main disadvantage of this approach is that Bob has to send (x, C)
to the bank right away (or at least before sending Alice anything in
return for her cash) to verify that the cash hasn't been used before.
But in email, where turnarounds of a day or more aren't unusual, this
should be tolerable.

Alice and Bob could be pseudonyms, using anonymous addresses to
communicate with each other and with the bank.

Different denominations of cash could correspond to different
exponents than "3" in the example above.  (That is, $1 would use
C=f(x)^(1/3), $2 would use C=f(x)^(1/5), $4 would use C=f(x)^(1/7),
and so on.)

Technically, this would be quite easy to implement, using the code in
PGP for the arithmetic, and MD5 for the one-way function.  We'd need
to define a few message formats.  The RFC1113 ascii encoding from PGP
could be used as well.

The "social" problems are more challenging, it seems to me.  What is
the backing for this electronic money?  Why do people care what their
bank balances are?  Is this stuff really worth anything?

One possibility is to base digital cash on real money.  People would
open a pseudonymous account via email, then postal-mail dollars to the
bank, enclosing their account number so the bank would know whom to
credit with the deposit.  Later, if someone wanted to withdraw "real
money" from their account they would have to give a real postal
address where it could be mailed.  Now the electronic money is worth
real dollars.  Even if people didn't deposit or withdraw very often,
it still has value because of the backing.

Unfortunately, this approach would currently be illegal (at least,
unless you actually were a real bank!).  If there were some way the
bank itself could be anonymous, it might survive, but I don't see how
to mail it money while keeping the anonymity.  Still, we could
consider experimenting with this on a small scale with accounts of no
more than a few dollars.  As long as it was clearly an experiment I
doubt that any prosecutions would result even if it attracted
government attention, because the expense involved in court costs
would be so disproportionate to the few dollars involved in this
technically illegal act.

Another approach would be not to try backing the digital cash at all,
or rather backing it implicitly by the determination of various people
to accept it and perform services or supply goods in return for it.
Tim's offer to Xerox papers in return for digital cash would be one
example.  Perhaps others could provide some other services.  It would
be great if some shareware author would accept digital cash as a
symbol of support for crypto anonymity.

One problem that I see with this approach is how you determine the
size of the money supply.  Or, in other words, how does new digital
cash get started circulating?  How do people get new accounts, and how
much money is in them?

If these problems can be solved, a big advantage of this approach is
that the banker can be anonymous.  He would be known only by his
anonymous address and his public key(s).  This would provide some
safety in the event that even a small-scale experiment like this
was targetted for a crackdown.

Another issue is the prospect of multiple "banks", each issuing their
own (incompatible) cash.  How would they compete?  Perhaps in terms of
rapid turnaround?  Some might choose to be anonymous, others would go
public.  The latter would have the advantage that people might trust
them more, but OTOH there is more chance of your bank account
disappearing after a crackdown for a public bank than an anonymous
one.

Lots to think about here!

Hal
74076.1041@compuserve.com

[Hal Finney describes Chaum's blind signature scheme.]

>The "social" problems are more challenging, it seems to me.  

One such social problem that Hal does not mention is that the blind
signature is a patented algorithm.  You'd have to get a signature from
Chaum.  Since any such company which wanted to deploy with blind
signatures whould be competing with Chaum's own company, DigiCash,
there might be a problem here.

>One possibility is to base digital cash on real money.  

>Unfortunately, this approach would currently be illegal (at least,
>unless you actually were a real bank!).  

If you wanted to do this as a business, you can start a bank with
(roughly) a million dollars in capital or you can buy an existing one
with at minimum (roughly) fifty thousand.  These minimum investments
are for bank regulation purposes, not operating costs.

So, if you really want to _be_ a bank, it's not that hard.  Your
greatest startup expense will most likely be attorney's fees for a
specialist in bank regulation law.

Eric

Hal Finney makes some very good points about anonymous banking and
some experiments we may try in the near future.

(First let me dispose of a minor item.)

> Some time back Tim May suggested that we should do some experiments
> with electronic cash.  He offered to do some Xeroxing if people would
> "pay" him.

(A minor note: I ended up doing the Xeroxing for free, which hasn't
yet been declared illegal...though I presume you'll all carefully note
this on your tax returns, as such "barter exchanges" are reportable
income. In theory, which shows how hopeless tax collection is
becoming, all of our "mutual consulting" on this list, and on the Net
in general, is _taxable income_--just as if we were plumbers and carpenters
getting together to work on each other's houses. A crazy system.)

Back to the important stuff. Hal continues:

> There are lots of proposals for electronic cash in the literature,
> mostly very complex.  I think one of Chaum's simpler proposals would be
> adequate for email "banking".  This proposal, from the beginning of
> his paper "Untraceable Electronic Cash" in Crypto 88(?), goes like
> this:

(Hal's excellent summary of Chaum's system elided)

> Technically, this would be quite easy to implement, using the code in
> PGP for the arithmetic, and MD5 for the one-way function.  We'd need
> to define a few message formats.  The RFC1113 ascii encoding from PGP
> could be used as well.

This sounds great! (But I worry that the handful of you already doing
the programming of PGP, new versions, MacPGP, remailers, etc., will
get overloaded and/or burned out. I'd offer to help, but my
programming these days is limited to fiddling with Mathematica and a
little bit of Smalltalk and Scheme/LISP.)

> The "social" problems are more challenging, it seems to me.  What is
> the backing for this electronic money?  Why do people care what their
> bank balances are?  Is this stuff really worth anything?

And the lesson we learned from PGP 2.0 is that actually getting
_something_ out there for people to play around with is crucial.
Getting "PGDC" ("Pretty Good Digital Cash") in use will be a harder
sell than PGP deployment was, because most people don't understand the
ideas, see no real pressing need, and can't do much in any case
without an "economy" of users.

I've long thought that a "Black Market AMIX" would be one such use,
but I won't get into that here.

> One possibility is to base digital cash on real money.  People would
> open a pseudonymous account via email, then postal-mail dollars to the
> bank, enclosing their account number so the bank would know whom to
> credit with the deposit.  Later, if someone wanted to withdraw "real
> money" from their account they would have to give a real postal
> address where it could be mailed.  Now the electronic money is worth
> real dollars.  Even if people didn't deposit or withdraw very often,
> it still has value because of the backing.
> 
> Unfortunately, this approach would currently be illegal (at least,
> unless you actually were a real bank!).  If there were some way the
> bank itself could be anonymous, it might survive, but I don't see how
> to mail it money while keeping the anonymity.  Still, we could
> consider experimenting with this on a small scale with accounts of no
> more than a few dollars.  As long as it was clearly an experiment I
> doubt that any prosecutions would result even if it attracted
> government attention, because the expense involved in court costs
> would be so disproportionate to the few dollars involved in this
> technically illegal act.

Warning! Recently, a bunch of bowlers (women, no less) were busted for
illegal gambling because of their "pot" they were bowling for. After
much public outcry and laughter at the authorities, the charges were
either dropped or reduced. I mention this because casual bowlers evoke
sympathy, hackers and cypherpunks do not.

> One problem that I see with this approach is how you determine the
> size of the money supply.  Or, in other words, how does new digital
> cash get started circulating?  How do people get new accounts, and how
> much money is in them?

We're in new territory here. The start of a new kind of economy. Lots
of experimentation and trial and error work will be needed.

> If these problems can be solved, a big advantage of this approach is
> that the banker can be anonymous.  He would be known only by his
> anonymous address and his public key(s).  This would provide some
> safety in the event that even a small-scale experiment like this
> was targetted for a crackdown.

Yes. And also anonymous "escrow services" which are like banks but
which serve other functions, such as holding the money in a
transaction so that Alice cannot take the money from Bob and refuse to
deliver on her side of the deal.

All of these entities must be "pseudonymous" (a clumsy word), in that
digital pseudonyms are supported (a la the work of Hughes, Finney, and
Janek Martinson) and True Names cannot be traced.

> Another issue is the prospect of multiple "banks", each issuing their
> own (incompatible) cash.  How would they compete?  Perhaps in terms of
> rapid turnaround?  Some might choose to be anonymous, others would go
> public.  The latter would have the advantage that people might trust
> them more, but OTOH there is more chance of your bank account
> disappearing after a crackdown for a public bank than an anonymous
> one.

Banks, escrow services, etc. will all have "reputations" and credit
ratings (from crypto versions of Standard and Poors, themselves
operating only as a pseudonym!). All of this will evolve over time.

> Lots to think about here!
> 
> Hal

That's for sure. Incredibly good points being made by everyone!

--Tim


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^756839 | PGP Public Key: by arrangement.

> > Unfortunately, this approach would currently be illegal (at least,
> > unless you actually were a real bank!).

Please point out the law(s) that make it illegal.  Speculation is fine,
but let's do some informed speculation.

	John

Currencies will almost certainly have to be backed by goods in order
to be astablished.  Would you want to keep your money in something
that could collapse easily?  There's been a lot of thought put into
using things like mutual fund shares as the currency.

dean