[Gavin Doughtie: Electronic escrow?]

------- Forwarded Message

Date: Wed, 28 Apr 1993 17:56:13 -0700
From: Gavin Doughtie <gavin@well.sf.ca.us>
Message-Id: <199304290056.AA26690@well.sf.ca.us>
To: gnu@toad.com
Subject: Electronic escrow?

How could two paranoid entities make use of digital cash and encryption to
sell a chunk of data (letUs say something really valuable like a list of
famous women linked to Elvis Presley in 1992) without 1) revealing their
identities to each other or 2) involving a third party to act as an RescrowS
agent.  The paradox IUm thinking about is one where the purchaser of the
information doesnUt want the sellerUs digital cash to be worth anything
until the data being sold can be provably decrypted, and the seller doesnUt
want the info being sold to be decryptable until the cash turns out to be
genuine.

You're a well-known cryptography person; I'm a struggling writer. If
you're not inclined to respond, perhaps you can direct this message to
someone who can.

Thanks very much!

Gavin.

------- End of Forwarded Message

The most salient thing for this response that Gavis says is
>I'm a struggling writer. 

There are lots of interesting technical issues here, but I'll confine
my comments to the overall situation.

[exchange of money for data]
>without 1) revealing their
>identities to each other or 2) involving a third party to act as an RescrowS
>agent.  

The first thing to realize about electronic money is that there is
always a third party involved.  Since information does not obey mass
conservation such as, say, gold does, you can't have free floating
money electronically.  The information has to start somewhere and end
in the same place.

So to say that there is no escrow agent is already stretching the
point, since in certain ways the transaction is already mediated.

>The paradox IUm thinking about is one where the purchaser of the
>information doesnUt want the sellerUs digital cash to be worth anything
>until the data being sold can be provably decrypted, 

"Provably decrypted" is really a useless concept here.  Suppose I am
selling information.  If I want to rip you off, I can send random bits
and claim that it is encrypted text.  I can also make up random text
and encrypt that.  In both cases, the bits I have sent you are
meaningless.  One uses valid encryption, one doesn't.  The separating
invariant here is meaning, not encryption.

>and the seller doesnUt
>want the info being sold to be decryptable until the cash turns out to be
>genuine.

There are protocols which allow for simultaneous disclosure of
information, where two parties want to exchange information
simultaneously.  This is not really the appropriate protocol, since
money is not necessarily valid by form alone.

But since you have electronic money in the first place, you have an
intermediary.  There's no reason for this intermediary not to be an
escrow agent.  In fact, there's really no risk for escrow agents who
requires that all bits be encrypted when passing through their
machines; there's no knowledge of content and it's just a commercial
transaction like any other.

As far as anonymity, that's easily solved by mail or packet forwarding
services.

Eric