Cash, cheaters, and anonymity

Here's a long response. But it's my only post of today, as the list was
going on and on about atom bombs, uranium sabots, and alpha particles, and
with debate about why some of us are ignoring these posts and the posts of
ranters and baiters.

This topic is more in line with my reasons for being on this list. Sorry
for  the length.

Hal Finney writes:

>One question is the ease of theft in a digital cash environment, and
>the consequences of claiming that secrets have been stolen.  This
>problem was recognized very early on in discussions of digital
>signatures.  The whole point of a signature is so that someone can be
>held to a commitment.  But an easy "out" would be to "accidentally on
>purpose" let the secret keys be stolen, then to claim that the
>signature was actually forged.  Contrariwise, a business might
>be vicitimized by actually having its secrets stolen and a forged
>signature created that committed it to an unfavorable action.

Hal is right the problem of *repudiation* or *disavowal* was recognized
early on. Alice is confronted with a digital signature, or whatever. She
says; "But I didn't sign that" or "Oh, that's my old key--it's obsolete" or
"My sysadmin must have snooped through my files," or "I guess those key
escrow guys are at it again."


APPROACHES TO REPUDIATION

**The purist approach: you *are* your key. If another biological unit
obtains your key, he or she is effectively you. Guard your key carefully.

**The modern American "excuse" approach: Hey, if you want to disavow a
contract, like, just claim your key was stolen or, like, you lost it.

I understand the reasoning behind adopting a more intermediate stance, but
I think that only the purist stance will hold water in the long run.(A hint
of this: untraceable cash means, for most transactions of interest with
digital cash, that once the crypto stuff has been handled, whether the sig
was stolen or not is moot, because the money is gone...no court can rule
that the sig was invalid and then retrieve the cash!)

[It is true that Chaum went to great lengths to develop system which
preserve anonymity for single-spending instances, but which break anonymity
and thus reveal identity for double-spending instances. I'm not sure what
market forces caused him to think about this as being so important, but it
creates many headaches. Besides being clumsy, it require physical ID, it
invokes a legal system to try to collect from "double spenders," and it
admits the extremely serious breach of privacy by enabling stings. For
example, Alice pays Bob a unit of money, then quickly Alice spends that
money before Bob can...Bob is then revealed as a "double spender," and his
identity revealed to whomver wanted it...Alice, IRS, Gestapo, etc. A very
broken idea. Acceptable mainly for small transactions. More on this later.]


NEGOTIATED PROTOCOLS TO REDUCE RISKS

However, just as most folks make arrangements with their bank/ATM machines
(semantic meaning #2 of "ATM") to limit cash withdrawals to, say, $200 a
day (it varies), so too can digital cash arrangements make similar
contractual deals to limit losses. Some possible plans:

* Plan A: The protocol insists on retinal scan or other biometric
authentication between the "smartcard" used as the cryptographic keying
device and the putative owner. The "Thunderball" plan. (issues: preserving
anonymity with biometric authentication, spoofing of the channel between
card and physical apparatus, theft of smartcard, etc.)

* Plan B: The protocol only allows, say, $1000 per transaction. And no more
than 3 transactions per day. Each transaction that is cleared sends a demon
message to the account owner through a separate communications channel.

(This sounds complex...the idea is to provide a signal that an account is
being accessed, allowing the account owner to put a hold on the account.
Even if he can't stop the transactions underway, or recently completed,
because of the lags that may exist in this feedback, he can limit losses.
Kind of a mix between off-line and on-line transactions....such mixes are
to be expected, with the choice up to parties, depending on costs, risks,
speed of communications, etc.)

* Plan C: Use off-line cash only for "small" transactions, such as those
now handled with physical coins and small bills. Use on-line clearing for
larger amounts, with various forms of biometric security.

This echoes how things are done today: off-line cash is what you can carry,
in bill, coin specie, etc. Larger amounts (hundreds of dollars and up) is
almost always handled on-line, via either credit cards (on-line clearing,
albeit not anonymous/untraceable) or checks, cashier's checks, etc.

(Coins and cash bills are really "on-line clearing" though, in that their
existential properties make them acceptable immediately; they are not
replicable, at least not easily, and hence can be conserved in transations.
All the usual stuff about the nature of cash money.)

Which will be used? (and there are many variants...) As usual, markets will
allow choice. Many people will choose to limit exposure with Plan B-type
transactions. Others will contract with insurance agents who cover risks by
insisting on their own protocols for added security. (I don't mean
conventional insurance agents, naturally.)


MISCELLANEOUS STUFF

>On the other hand, I would hope that people actually can learn to use
>care in safeguarding their secrets.  The pass words and PINs we use
>today may be complemented by physical checks for voice patterns, thumb
>prints, perhaps (ironically) handwriting.  Another approach would be

Most smartcards in use today support some form of local PIN entering, some
way to provide a truly memorizable extra piece of identiy. Other biometric
measures remain a hot area of research. Stroke recognition, thumbprints,
etc. In about 5 years, when I think digital cash will be ready for prime
time (pun intended), these additional mechanisms should be deployable, for
a price. (Market-driven again: those who want to pay less in insurance will
take better steps. Companies may adopt standards. Banks may enforce them.)

...
>suggestions (one here a couple of days ago) to use various kinds of
>information exchange between the authenticating device and the human
>user in order to prove authorization in such a way that even a thief
>who has snooped on past exchanges will not be able to use the device.
>This approach is sometimes called the use of "pass algorithms".

"Zero knowledge interactive proof systems" have been used for password
systems; no amount of past snooping or eavesdropping helps. (Of course, the
user still has to have physical security over his local computer, or PDA,
dongle, or secret decoder ring.) This seems like a readily-solvable problem
(and one we already accept with existing ATM machines).



THE INCREDIBLE IMPORTANCE AND ELEGANCE OF ON-LINE CLEARING

...
>Applying this to the double-spending case, I suspect that Bob Hettinga
>is more on the right track in seeing the solution in the legal system
>rather than a simple "shucks, you caught me" forfeiting of a bond
>worth triple damages.  There really should be no excuse for double

*On-line clearing* for larger amounts is, in my opinion, the Right Thing.
Networks are getting deployed widely and are speedy. ATM, SONET, ISDN, and
all the rest.

I want to elaborate on this, even though I think most of Hal's points are
made with off-line clearing in mind. I want to make the case for why
on-line clearing is the One True Digital Cash.

Conceptually, the guiding principle idea is simple: he who gets to the
train locker where the cash is stored *first* gets the cash. There can
never be "double spending," only people who get to the locker and find no
cash inside. Chaumian blinding allows the "train locker" (e.g., Credit
Suisse) to give the money to the entity making the claim without knowing
how the number correlates to previous numbers they "sold" to other
entities. Anonymity is preserved, absolutely. (Ignoring for this discussion
issues of cameras watching the cash pickup, if it ever actually gets picked
up.)

Once the "handshaking" of on-line clearing is accepted, based on the "first
to the money gets it" principle, then networks of such clearinghouses can
thrive, as each is confident about clearing. (There are some important
things needed to provide what I'll dub "closure" to the circuit. People
need to ping the system, depositing and withdrawing, to establish both
confidence and cover. A lot like remailer networks. In fact, very much like
them.)

In on-line clearing, only a number is needed to make a transfer.
Conceptually, that is. Just a number. It is up to the holder of the number
to protect it carefully, which is as it should be (for reasons of locality,
for self-responsibility, and because any other option introduces
repudiation, disavowall, and the "Twinkies made me do it" sorts of
nonsense). Once the number is transferred and reblinded, the old number no
longer has a claim on the money stored at Credit Suisse, for example. That
money is now out of the train locker and into a new one. (People always
ask, "But where is the money, really?" I see digital cash as *claims* on
accounts in existing money-holding places, typically banks. There are all
kinds of "claims"--Eric Hughes has regaled us with tales of his
explorations of the world of commericial paper. My use of the term "claim"
here is of the "You present the right number, you get access" kind. Like
the combination to a safe. The train locker idea makes this clearer, and
gets around the confusion about "digimarks" of "e$" actually _being_ any
kind of money it and of itself.)

Off-line systems may be useful for paying for movies, toll roads, etc., but
there the protocols can be set up to limit exposure to fraud. (Ontological
constraints, such as number of movie theater attendees, etc., will limit
the losses. Scams will likely still exist, but the problem seems manageable
with some work.)

And as networks get much faster, expect even off-line cash to fade. Depends
on costs, insurance rates, benefits, and of course on regulations.


>spending, even of a penny, and the penalties could be made strong
>enough to deter most people.  If a bank does not think they will be
>able to find and prosecute a person who is withdrawing off-line
>digital cash, they will probably not give any to him.  Then if the

The "first to the locker" approach causes the bank not to particularly care
about this, just as a Swiss bank will allow access to a numbered account
(or used to...please let's not have a dozen posts arguing about this, as is
so often the case on this list!) by presentation of the number, and perhaps
a key. Identity proof *may* be needed, depending on the "protocol" they and
the customer established, but it need not be. And the last thing the bank
is worried about is being able to "find and prosecute" anyone, as there is
no way they can be liable for a double spending incident.

The beauties of local clearing! (Which is what gold coins do, and paper
money if we really think we can pass it on to others.)


IS PROOF OF PHYSICAL IDENTITY NEEDED?

...
>money is double-spent, the person who withdrew it would be prima facie
>responsible, with a reasonable presumption that they did it unless
>there is significant evidence otherwise.  I don't know that this is
>how it will work out but it is one possibility (unless the uncertainty
>just scares everybody away - but I think the digital signature
>experience will get people used to the concepts and problems).

I recall some analyses of these situations a while back. I looked in my
"Crypto" Proceedings but didn't find it.

The danger of making the "person who withdrew it" a culprit if the money
has already been "spent" is clear: he is just as likely to be an innocent
victim of a setup as the guilty party. With off-line clearing, and not the
"handshaked" beauty of immediate clearing, one has to rely on
"trust"--tough with an anonymous person.

On-line clearing has the possible danger implicit in all trades that Alice
will hand over the money, Bob will verify that it has cleared into his
account (in older terms, Bob would await word that his Swiss bank account
has just been credited), and then Bob will fail to complete his end of the
bargain. If the transaction is truly anonymous, over computer lines, then
of course Bob just hangs up his modem and the connection is broken. This
situation is as old as time, and has always involved protcols in which
trust, repeat business, etc., are factors. Or escrow agents.


REAL ESCROW AND TRUE NYMS


Long before the "key escrow" of Clipper, true escrow was planned. Escrow as
in escrow agents. Or bonding agents.

Alice and Bob want to conduct a transaction. Neither trusts the other;
indeed, they are unknown to each other. In steps "Esther's Escrow Service."
She is _also utraceable_, but has established a digitally-signed presence
and a good reputation for fairness. Her business is in being an escrow
agent, like a bonding agency, not in "burning" either party. (The math of
this is interesting: as long as the profits to be gained from any small set
of transactions is less than her "reputation capital," it is in her
interest to forego the profits from burning and be honest. It is also
possible to arrange that Esther cannot profit from burning either Alice or
Bob or both of them, e.g., by suitably encrypting the escrowed stuff.)

Alice can put her part of the transaction into escrow with Esther, Bob can
do the same, and then Esther can release the items to the parties when
conditions are met, when both parties agree, when adjudication of some sort
occurs, etc. (There a dozen issues here, of course, about how disputes are
settled, about how parties satisfy themselves that Esther has the items she
says she has, etc.)


UNTRACEABLE MARKETS FOR ASSASSINATIONS

To make this brutally concrete, here's how escrow makes murder contracts
much safer than they are today to negotiate. Instead of one party being
caught in an FBI sting, as is so often the case when amateurs try to
arrange hits, they can use an escrow service to insulate themselves from:

1. From being traced, because the exchanges are handled via pseudonyms

2. From the killer taking the money and then not performing the hit,
because the escrow agent holds the money until the murder is verified
(according to some prototocol, such a newspaper report...again, an area for
more work, thankfully).

3. From being arrested when the money is picked up, as this is all done via
digital cash.

There are some ways to reduce the popularity of this Murder, Incorporated
system. (Things I've been thinking about for about 6 years, and which we
discussed on the list and on the Extropians list. I'll save this for
another time.)

My point here is to show how on-line clearing works in conjunction with an
escrow agent function.(Esther clears the cash, and can issue new cash to
Bob, who "trusts" her that if he does the job, the cash will clear, as
she's the escrow agent he's dealt with many times before.)


THE DANGER OF EVER USING PHYSICAL IDENITY VERIFICATION

>The other point I wanted to discuss was this issue of the bank
>authenticating the people who receive the cash.  This does raise the
>spectre of a big brother system where there is some way to identify
>people with 100% certainty.  Obviously this could be abused.

Danger! Danger! Danger! Any such system, that relies on physical IDs is
substantially less private that banks today in many countries, and is not
at all what I would call "digital cash."

On-line clearing makes this unnecessary.

>Without the authentication, you're not going to have off-line cash,
>IMO.  You will be stuck with on-line systems in which everyone has to
>verify everything before accepting it.  This means you pay a cost in
>communications overhead and possibly other foregone opportunities.

Agreed. But acceptable with a two-tiered system:

- off-line cash for small transactions, with smartcards, "observer"
protocols, and with built-in limits

- on-line , immediately-cleared cash for larger transactions, also with
various agreed-upon limits or requirements


RISKS


Is there a danger that people will lose the numbers that they need to
redeem money? That someone could steal the number and thus steal their
money?

Sure. There's the danger that I'll lose my bearer bonds, or forget my Swiss
bank account number, or lose my treasure map to where I buried my money (as
Alan Turing supposedly did in WW II).

People can take steps to limit risk. More secure computers. Dongles worn
around their necks. Protocols that involve biometric authentication to
their local computer or key storage PDA, etc. Limits on withdrawals per
day, etc. People can store key numbers with people they trust, perhaps
encrypted with other keys, can leave them with their lawyers, etc. All
sorts of arrangements can be made.

Where I'm not sure I agree with what Hal is saying is that _personal
identification_ is but one of these arrangements. Often used, but not
essential to the underlyng protocol. Again, the Swiss banks (maybe now the
Liechtenstein anstalts are a better example) don't require physical ID for
all accounts. (More generally, if Charles wants to create a bank in which
deposits are made and then given out to the first person who sings the
right tune, why should we care? This extreme example is useful in pointing
out that _contractual arrangements_ need not involve governmental or
societal norms about what constitutes proof of identity.)


PAPIEREN, BITTE

Hal goes on to talk about blinded credentials. A very important idea in our
permission slip-happy society, and an idea that is not getting nearly
enough attention. (Chaum's seminal "Transaction Systems to Make Big Brother
Obsolete," from Oct or Nov of 1985, in "Communications of the ACM," remains
required reading here.)

But I also take a more radical view. Ask yourself why credentials are
_ever_ needed. Maybe for driving a car, and the like, but in those cases
anonymity is not needed, as the person is in the car, etc.

Credentials for drinking age? Why? Let the parents enforce this, as the
argument goes about watching sex and violence on t.v. (If one accepts the
logic of requiring bars to enforce children's behavior, then one is on a
slippery slope toward requiring television set makers to check smartcards
of viewers, or of requiring a license to access the Internet, etc.)

In almost no cases do I see the need to carry "papers" with me. Maybe a
driver's license, like I said. In other areas, why?

This gets to a core issue: the incredible benefits of locally clearing a
transaction. Caveat emptor, buyer beware, etc. Cash on the barrelhead.

In transactions where "future performance" is needed, as in a contract to
have a house built, or to do some similar job, then of course the idea of
on-line or immediate clearing is bogus...like paying a stranger a sum of
money on his promise that he'll be back the next day to start building you
a house.

Parties to such long-term, non-locally-cleared cases may contract with an
escrow agent, as I described above. This is like the "privately-produced
law" we've discussed so many times. The essence: voluntary arrangements.

Maybe proofs of identity will be needed, or asked for, maybe not. But these
are not the essence of the deal. An interesting area.

I apologize if this essay, while long, is not quite long enough to capture
the ideas I wanted to express. To me, these are core ideas. Maybe not as
core to those of you who favor talking about depleted uranium sabots (but
what about Chobham armor and explosive armor?) or about "PGP rulz, d00d!,"
but core isseus to me.

Your smileage may vary.

--Tim May


..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets,
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

tcmay@localhost.netcom.com (Timothy C. May) writes:
  > **The purist approach: you *are* your key. If another biological unit
  > obtains your key, he or she is effectively you. Guard your key carefully.
  > 
  > **The modern American "excuse" approach: Hey, if you want to disavow a
  > contract, like, just claim your key was stolen or, like, you lost it.
  > 
  > I understand the reasoning behind adopting a more intermediate stance, but
  > I think that only the purist stance will hold water in the long run.(A hint
  > of this: untraceable cash means, for most transactions of interest with
  > digital cash, that once the crypto stuff has been handled, whether the sig
  > was stolen or not is moot, because the money is gone...no court can rule
  > that the sig was invalid and then retrieve the cash!)

I would love the purist stance, except that it is untenable. Every security
system is breakable, if enough effort, money, and professionalism are involved.
We should never kid ourselves about this. One time pads are provably secure,
but someone can still break in and physically steal your plaintext, or steal
you and bring out the rubber hoses...
If crypto does become widespread, then it will be used in situations where
the value of the key justifies considerable effort and expense to steal it,
and it will happen. There must always be a mechanism to deal with repudiation.

As to your later point about mootness, I would not be comfortable saying that
there are limits to what a court will attempt to coerce cooperation.

  > * Plan A: The protocol insists on retinal scan or other biometric
  > authentication between the "smartcard" used as the cryptographic keying

This is just a second private key, and no more immune to forgery or theft by
a professional.

>   > **The purist approach: you *are* your key. If another biological unit
>   > obtains your key, he or she is effectively you. Guard your key carefully.

> I would love the purist stance, except that it is untenable. Every security
> system is breakable, if enough effort, money, and professionalism are involved.

So the purist stance is untenable? Less than 2 years ago I was a
homeless person, living on the banks of the San Lorenzo River. Then I
met a person named "Timothy C. May." He wasn't interested in being on
the Net anymore--he said it took too much of his time--so he game me
his account, his password (which I've since changed, of course), and
said "Have fun." 

The purist stance is much more common than many might think. 

> We should never kid ourselves about this. One time pads are provably secure,
> but someone can still break in and physically steal your plaintext, or steal
> you and bring out the rubber hoses...
> If crypto does become widespread, then it will be used in situations where
> the value of the key justifies considerable effort and expense to steal it,
> and it will happen. There must always be a mechanism to deal with repudiation.

There are plenty of items of property that can be stolen, and are
stolen. And yet these items continue to exist, be sold, traded, etc.

If someone is really, really worried about havin their codes stolen,
they can arrange to use codes only usable in their banker's office
(not altogether a bad idea, by the way), or with a duress code
built-in, etc. Or none at all. Choice, and costs.

In any case, the free markets will have a major effect. With strong
crypto, the communications transparently cross borders, making legal
moves problematic.

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

tcmay@netcom.com (Timothy C. May) writes:
  > So the purist stance is untenable? Less than 2 years ago I was a
  > homeless person, living on the banks of the San Lorenzo River. Then I
  > met a person named "Timothy C. May." He wasn't interested in being on
  > the Net anymore--he said it took too much of his time--so he game me
  > his account, his password (which I've since changed, of course), and
  > said "Have fun." 
  > 
  > The purist stance is much more common than many might think.

I don't think this is really the purist stance. You defined it as 'you are
your key', and my view is that revocation will have to be possible. All
that your argument above is saying is 'email address and claimed name are
insufficient to prove identity' -- surely no one disputes that?

  > There are plenty of items of property that can be stolen, and are
  > stolen. And yet these items continue to exist, be sold, traded, etc.

Yes. And physical possession of them is not generally considered to be
unquestionable legal proof that you are the person who originally
owned them.

  > If someone is really, really worried about havin their codes stolen,
  > they can arrange to use codes only usable in their banker's office
  > (not altogether a bad idea, by the way), or with a duress code
  > built-in, etc. Or none at all. Choice, and costs.

In all honesty, I don't see physical key theft to be a major problem
for individuals, since it can generally be made unprofitable. Where I
see legal key revocation as essential, is for corporate situations.
That is where a multi million dollar cost of stealing a key could still
be quite profitable. We need to figure a way to extend web of trust to
revocations and corporate identity.

  > In any case, the free markets will have a major effect. With strong
  > crypto, the communications transparently cross borders, making legal
  > moves problematic.

Unfortunately, I think that the courts will expand too. The courts may not
be able to freeze and confiscate your foreign assets, but they may be able
to block you from doing a great deal of business without very frequent
changes of 'name' and reestablishment of reputation. Also, there is always
the possibility of being hampered in the physical world. We all have to
buy groceries, and the physical means of communication will always be
vulnerable to pressure.

This is not to say that I don't think crypto will weaken government. It
will. Making court rulings effective will be far more expensive than it
currently is.

Timothy C. May writes
> Alice pays Bob a unit of money, then quickly Alice spends that
> money before Bob can...Bob is then revealed as a "double spender," and his
> identity revealed to whomver wanted it...Alice, IRS, Gestapo, etc. A very
> broken idea.

Correctly implemented, with offline cash that grows in each transaction
until cleared online, this should reveal Alice's identity, not Bob's

If we fear double spending we insist on the spender presenting 
an expensive identity, an identity that would be tedious or costly
to replace.  The larger the amount, the stronger our concerns
of identity.  But the identity is known only to the parties to
the transaction.  (Who may be different tentacles of the same
biological person.)

The tentacle trick is what makes the existing identity based
checks on Bermudan and Hong Kong banks effectively anonymous.

If we do not like the identity, we ask for online clearance.

> I want to elaborate on this, even though I think most of Hal's points are
> made with off-line clearing in mind. I want to make the case for why
> on-line clearing is the One True Digital Cash.

Quite so.  And with a smooth interface between the truly anonymous
online cash and the controlled nomity offline cash - an interface
sufficiently smooth that the spender rarely notices which his
software is using, we can have the best of both worlds.

It is all in the software interface, something notoriously lacking
from existing implementations.

> Off-line systems may be useful for paying for movies, toll roads, etc., but
> there the protocols can be set up to limit exposure to fraud. (Ontological
> constraints, such as number of movie theater attendees, etc., will limit
> the losses. Scams will likely still exist, but the problem seems manageable
> with some work.)

Exactly so.  Like the use of slugs in vending machines.
> 
> 
> IS PROOF OF PHYSICAL IDENTITY NEEDED?

No, but for offline cash proof of an identity that would be
expensive or tedious to replace is needed.

> This
> situation is as old as time, and has always involved protcols in which
> trust, repeat business, etc., are factors. Or escrow agents.

Exactly so.  We need varied kinds of digicash, for varied situations,
and a smooth interface between them.

> REAL ESCROW AND TRUE NYMS
> 
> 
> Long before the "key escrow" of Clipper, true escrow was planned. Escrow as
> in escrow agents. Or bonding agents.
> 
> Alice and Bob want to conduct a transaction. Neither trusts the other;
> indeed, they are unknown to each other. In steps "Esther's Escrow Service."
> She is _also untraceable_, but has established a digitally-signed presence
> and a good reputation for fairness. 

Exactly so:

> I apologize if this essay, while long, is not quite long enough to capture
> the ideas I wanted to express. To me, these are core ideas.

Keep going, you mentioned, rather than explained, the problem of local
and extended clearing.

It seems to me, that rather than the one true protocol, we need a
collection of standardized protocol tools and anybody and his dog
can issue his own protocol for his own purpose, and the other
guys computer can understand it and can give its master a list
of options of what how the deal can go sour and who to finger 
if the deal goes sour in a particular way -- tell its master 
who the the master is trusting to pay and when.


-- 
 ---------------------------------------------------------------------
We have the right to defend ourselves and our
property, because of the kind of animals that we              James A. Donald
are.  True law derives from this right, not from
the arbitrary power of the omnipotent state.                jamesd@netcom.com

I don't have time to write much now, but lots of good points have been
made.  I'll just toss out the other main idea for handling offline cash,
which is Chaum's "Observer".  The Observer is a tamper-proof device that
sits inside (or plugs into) your computer, smart card, or PDA, and makes
sure that you don't double spend.  In fact, it is impossible to double
spend because the Observer has to participate in every transaction.  Yet
Chaum has designed the protocols such that the Observer learns nothing
about who you are or where you are spending.

The technical requirements of the Observer in Brands' scheme are that it
store 146 bytes plus 18 bytes per coin, and be able to do the discrete
log signature, which basically requires 512-bit multi-precision
arithmetic.  And it has to be tamper-proof.  At one time I was skeptical
about that but we see with Clipper that the NSA appears to be confident
that data can be protected in tamper-proof modules.

With Observers you can have off-line cash that is as secure as on-line
but without the costs of on-line validation.  As a vendor, which would
you rather accept: off-line cash where you rely on legal sanctions to
track down cheaters; on-line cash where you call the bank and verify it
for every transaction; or off-line cash where you can validate it right
there locally without checking with any bank?  Depending on the costs
which the Observer adds to the digital wallet, that latter choice might
be the most attractive.

Hal

Tim has made a lot of good points, and I'll only try to respond to a few:

>NEGOTIATED PROTOCOLS TO REDUCE RISKS

>However, just as most folks make arrangements with their bank/ATM machines
>(semantic meaning #2 of "ATM") to limit cash withdrawals to, say, $200 a
>day (it varies), so too can digital cash arrangements make similar
>contractual deals to limit losses. Some possible plans:

>* Plan A: The protocol insists on retinal scan or other biometric
>authentication between the "smartcard" used as the cryptographic keying
>device and the putative owner. The "Thunderball" plan. (issues: preserving
>anonymity with biometric authentication, spoofing of the channel between
>card and physical apparatus, theft of smartcard, etc.)

In Demolition Man, Wesley Snipes plucks the eyeball out of the victim to
hold it up to the retinal scanner and escape.  Hacked-off thumbs may provide
similar workarounds for fingerprint protection.  Maybe what we want is
a system where some pass code is an alternative to physical ID.  Giving up
a secret pass phrase is a superior alternative to giving up your life, and
worth it for a few hundred dollars.  (I'll point out that this doesn't work
if duress codes are widely used which give away the bad guys.)

>[...]
>(Coins and cash bills are really "on-line clearing" though, in that their
>existential properties make them acceptable immediately; they are not
>replicable, at least not easily, and hence can be conserved in transations.
>All the usual stuff about the nature of cash money.)

I think this is where the tamper-proof wallet idea comes from; it is the 
closest anyone has come to providing truly conserved digital cash.  With
such a system you can get the benefits of on-line clearing even in the off-
line environment, just as people will accept cash today without taking it
to the bank first.

>Which will be used? (and there are many variants...) As usual, markets will
>allow choice. Many people will choose to limit exposure with Plan B-type
>transactions. Others will contract with insurance agents who cover risks by
>insisting on their own protocols for added security. (I don't mean
>conventional insurance agents, naturally.)

I think this is the key point.  All of our speculation about the relative
advantages of the various forms of cash is largely irrelevant, as long as some
form of privacy-protecting payments comes into existance.  Then the details
of the implementations will determine the relative costs and the market
advantages of each approach.  The hard part will be getting that first cash
system in place.

Oops, I've got to go.  I'll just make a quick couple of points.

>[...]
>([...]  My use of the term "claim"
>here is of the "You present the right number, you get access" kind. Like
>the combination to a safe. The train locker idea makes this clearer, and
>gets around the confusion about "digimarks" of "e$" actually _being_ any
>kind of money it and of itself.)

Dollar bills got their start this way.  At one time they were just "claims"
on the real dollars in the bank vaults.  Yet most people find it more con-
venient to think of them as money, even back when you could still turn them
in for gold.  I think it's useful to think of ecash as being money as well,
although granted it is money with its own characteristics different in some
ways from banknotes, checks, or coins.

>Off-line systems may be useful for paying for movies, toll roads, etc., but
>there the protocols can be set up to limit exposure to fraud. (Ontological
>constraints, such as number of movie theater attendees, etc., will limit
>the losses. Scams will likely still exist, but the problem seems manageable
>with some work.)

One thing I think is clear is that off-line cash will not be issued to
anonymous recipients.  Imagine a magic quarter which would reappear in
your pocket after you put it into the coke machine.  How many people would
be willing to resist using it?  That's what you'll have with an off-line
coin issued to a pseudonym.

>And as networks get much faster, expect even off-line cash to fade. Depends
>on costs, insurance rates, benefits, and of course on regulations.

This is probably right, although ironically the infrastructure for off-line
cash might be simpler.  On-line cash needs 24-hour availability, quick
(nearly instantaneous) response, a fully automated cash validation system.
We have this now, with the Visa cards, but it didn't appear overnight.  And
I doubt that the Internet is a suitable communications medium for it (due
to reasons of availability, reliability, and security).  Off-line cash could
be handled with longer turnaraounds in a machine which is not on the net,
using manual intervention so pass words and such are not stored on-line.
Of course the disadvantage is that the off-line cash requires identity
authorization during issuing.

Tim's ideas about escrow agents and a credential-less society are very
interesting as well and I'll try to make some comments on them later.

Hal