Digital Cash

Tim writes:

 > If Frank the Forger, to pick a standard sort of crypto
 > example, takes a set of bits (possibly made with the
 > elaborate system Mike Duvos described in an earlier posting)
 > and copies that set of bits n times and then "spends" them n
 > times, how can any of his recipients know that parallel
 > transactions are happening, that the "same" money is being
 > spent n times and that it is very likely that n - 1 of the
 > recipients will be screwed?

I didn't mean to oversell the degree to which the scheme deters
multiple spending.  It doesn't prevent multiple spending.  It
merely breaks the anonymity of the perpetrator if two or more
people he has transacted the same note with break their own
anonymity and voluntarily cooperate with the bank.

There is nothing to prevent you from making N copies of your
floppy, spending each one, and hopping the next plane to
Argentina.  Sad but true.

In the real world, there would have to be some sort of limit on
the number of times such a spoofed transaction could propagate
before being cleared with the central bank, much like
restrictions on multiple-party checks today.  Merchant
cooperation would also be necessary.  Probably easy to get with
the corner store than with the local cocaine dealer.

 > The other main approach is to build in to the blinding
 > protocols which protect anonymity ways to detect the
 > identity of those who spend a unit of digital money more
 > than the specified number of times. "Double spenders" is the
 > common term. This can avoid online clearing, but at the
 > expense of additional protocol complexity and some peculiar
 > wrinkles which can develop.

This is really all I had in mind.  Again, double spending is
discouraged but not prevented.  If you are leaving town and never
returning, you can go on a shopping spree.

-- 
     Mike Duvos         $    PGP 2.3a Public Key available    $
     mpd@netcom.com     $    via Finger.                      $

Just a thought on ways to deter all of this multiple spending 
gunk - when you start off, have a centralized bank server. While traffic 
is low, you can have each individual certificate cleared with the bank 
server upon creation and execution. After that, things start getting 
tricky. Maybe a network of bank servers linked by high priority internet 
links (i don't suppose there really is such a thing, but this is 
dreamland, after all). This would mean that to cash a certificate more 
than once would require very fast and accurate timing, and if you combine 
this with a fairly low upper limit for certificate value, it becomes a 
waste of time try.
	Oh well. Just my A$0.02.

MJH

*       *       Mikolaj J. Habryn
                dichro@tartarus.uwa.edu.au
    *           "Life begins at '040."
                PGP Public key available by finger
    *           "Spaghetti code means job security!"

We've recently had a flurry of postings about digital money, and the
apparently new realization by some that "double spending" is a serious
issue. Folks, this is not a new issue---this is the core issue of all
serious efforts on digital money (and, indeed, is the core issue of
money, period).

I urge everone interested in digital money to dig up and read the
various articles that have appeared, including one of David Chaum's in
the July or August of 1992 "Scientific American." The usual places
apply, as always"

- the usual books: Schneier, Brassard, Denning, etc.

- Proceedings of the Crypto Conferences, aka "Advances in Cryptology,"
part of the Springer-Verlag series "Lecture Notes in Computer
Science." (A series of silver-grey paperbacks, available in many
technical bookstores, and in many university bookstores and
libraries).

- ditto for Eurocrypt and other crypto conferences.

I urge this because there is little to be gained by slowly reinventing
the wheel. The recent realization here by some that "double spending"
is a Big Issue is indicative of this. Double spending, and related
issues, is obviously just the _start_ of the really interesting problems
with any digital money scheme. This is the _starting point_ of most
discussions, not a belated realization.

As I often say, I don't want to sound snippy or holier-than-thou here.
It's just that there's a basic corpus of papers on the
highly-technical areas of crypto that everyone working in these areas
has to be assumed to be familiar with.

Rocket scientists have to know that rockets don't work by pushing on
air, and cryptologists have to know what's already been written about.

With more than 700 people on the Cypherpunks list---though a far
smaller group appears to be actively posting--it is natural that a
range of backgrounds, interest levels, and dedication to the issues
will exist. I'm not saying that only "experts" in digital money should
speak on these issues, only that the basic papers ought to at least be
skimmed.

Best wishes for all,

--Tim May







-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."