Re: digital cash and identity disclosure

At 5:41 PM 10/19/95, Hal wrote:

>There is an attack here, but the text doesn't go into detail about it.
>You have to assume that (as with the current ecash implementation from
>Digicash) people have non-anonymous accounts with the bank.  If Alice
>wants to know Bob's identity she can collude with the bank to find
>out.  As Tim describes, she gives Bob some money, then quickly deposits
>the coins herself.  In effect, she intentionally double-spends (with
>the bank's permission).  When Bob makes his deposit, his coins are
>recognized as matching those which Alice double-spent.  So if Alice
>was, say, an agent involved in a government "sting", and bought bootleg
>software from Bob, his identity can in fact be learned when he deposits
>the money.
>
>Actually with the DigiCash system and in fact all of the ecash systems I
>know about, you don't have to get so fancy; Alice can simply give the
>bank a record of her transaction with Bob (the coins she sent him) and
>these will be recognized when Bob deposits them.
>
>Lucky Green has been discussing ways in which people could exchange coins
>anonymously even with DigiCash's ecash in order to provide some immunity
>from such attacks.

As Hal notes, there are a lot of issues and attacks to consider. I'm sorry
that my brief section on Chaumian digital cash in the Cyphernomicon doesn't
adequately cover the issues (and as the debates here show, confusion still
reigns, and no doubt some of my points are misleading, wrong, or
incomplete).

"Double spending" detection is a REAL MESS. That's my basic conclusion. It
tends to require schemes for going after double spenders, it tends to make
identity-revealing attacks possible (such as the attack I alluded to, and
that Hal more completely describes), and it's INELEGANT.

"Immediate clearing" is much more elegant, and is, I think, truer to the
spirit of "annonymous digital cash" than most of these other schemes are.
(Grep the FAQ for "online" or "online clearing" or "clearing" and you
should find some stuff. Also, several articles--including one recently by
me, about a month ago--go into the differences between the types of
clearing.)

--Tim May


Views here are not the views of my Internet Service Provider or Government.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
Corralitos, CA              | knowledge, reputations, information markets,
Higher Power: 2^756839      | black markets, collapse of governments.
"National borders are just speed bumps on the information superhighway."

-----BEGIN PGP SIGNED MESSAGE-----

 Someone claiming to be the nym calling itself tcmay@got.net (Timothy C. 
May) wrote:
>
> As Hal notes, there are a lot of issues and attacks to consider. I'm sorry
> that my brief section on Chaumian digital cash in the Cyphernomicon doesn't
> adequately cover the issues (and as the debates here show, confusion still
> reigns, and no doubt some of my points are misleading, wrong, or
> incomplete).


Boy, if I were you I would want to fix the inadequacy in C'nomicon in
order to protect my positive rep...


> "Double spending" detection is a REAL MESS. That's my basic conclusion. It
> tends to require schemes for going after double spenders,


You mean Real Life(tm) security a.k.a. force, but this isn't 
necessarily so.  We could just as well debit the double-spender's 
rep and lower the limit on how much e-cash he will be issued.


> it tends to make
> identity-revealing attacks possible (such as the attack I alluded to, and
> that Hal more completely describes),


I hesitate to pipe up in such august company, but one of us is
confused.  The attack that we have been discussing is possible because
Chaumian Ecash allows the payer to identify the payee.  This would be
true whether or not there were any protocols related to
double-spending.  (i.e., because the payer knows the actual ID number
of the bill, she can choose to relate it to the bank and then the bank
can identify who turns in that bill.  Has nothing to do with
double-spending.  If the protocol provided for re-blinding before
depositing the bill then this would not be possible, I think, and 
would still have nothing to do with double-spending.)


> and it's INELEGANT.


I personally think it is beautiful, because it allows for off-line
transactions at a cost of a relatively small risk of double-spending.
Perhaps we could modify the protocol and have the best of both worlds?
I think I'll write a separate post on this subject now...


Regards,

Bryce

Announcement: I'm about to fade out from c'punks list for a while, so
be sure and Cc: me if you want me to see your post.

signatures follow


            "To strive, to seek, to find and not to yield."   
    <a href="http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html">

                          bryce@colorado.edu                   </a>



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01

iQCVAwUBMIarbfWZSllhfG25AQEYzAQAtjBPJ6iZAepKa4sfzFjciX9oPK/orYcl
GT7WpBPJSmPeuBEUdruNDcp3GEuuBit+xOsAqvaORA3epw12BDlzlBN3gU4nq5dL
GmsDR7CKX64Ouz/+qxoMmGPUe/CH6FHg4msIvitE7A6DNltYJMPOfWrVF3lhwcx7
iguZ8TAbtTU=
=fXcK
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

Some cpunks a couple of months ago told us about "agnostic" e-cash
anonymity schemes in which the e-bank accepts both blinded and
un-blinded coin requests, leading to anonymity or non-anonymity at the
choice of the client.  They pointed out how this would be very
easy to implement, based on the current Chaumian system.  I think this
is an excellent idea for social-engineering reasons and I congratulate
them on bringing it up.  (Unfortunately I don't have time right now 
to look up who it is that I am congratulating...)


Perhaps a similar "polymorphism" could be implemented with regard to
on-line/off-line clearing.  When you as a payee receive a Chaumian
Ecash coin, you can choose based on several factors (including
reputation of the payer if he chooses to make his nym known to you,
size of the transaction, time of day, or whatever) to either accept it
immediately and credit the payer with whatever it is you are selling,
or to delay completion of the transaction while you attempt to deposit
the coin with your e-bank.  (If you are wary of "payee-ID proof
stings" like Lucky Green is, then you can go ahead and launder your
coin through an anon account during this interval...)  If your payer
has already spent this coin, then the bank will inform you immediately
and you can cancel the transaction.  (And take whatever other actions
you consider appropriate...)


It seems like such a scheme would include all of the advantages
(off-line clearing) of Chaumian Ecash as well as those
(double-spending prevention) of the on-line clearing systems.  Thus,
TCMay's objections to current Chaumian Ecash would not apply to this
new variation.


I hope that this isn't an old-news yawner to you experts.


Regards,

Bryce

Announcement:  I'm going to be fading off the the c'punks list for a
while, so be sure and Cc: me if you want me to read your post.

signatures follow


            "To strive, to seek, to find and not to yield."   
    <a href="http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html">

                          bryce@colorado.edu                   </a>



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01

iQCVAwUBMIauO/WZSllhfG25AQGXHwP+MEpnPvpj81fV66HEb8rozlMepnol3nj5
/d73LQpMxB7fLcMEDmISNQef/eU39zId8EZ1XCW7X3AujMBa4OjuBgl3+vdrAKo9
DIb6imXxc+E9dyHp0i9y/FZtzkOXKF6Abwy3SYMOSyaI2HsiCyUx2tEW/6OzDJTi
7YyOqR+FkNQ=
=cpK7
-----END PGP SIGNATURE-----

Bryce <wilcoxb@nag.cs.colorado.edu> writes:

>Perhaps a similar "polymorphism" could be implemented with regard to
>on-line/off-line clearing.  When you as a payee receive a Chaumian
>Ecash coin, you can choose based on several factors (including
>reputation of the payer if he chooses to make his nym known to you,
>size of the transaction, time of day, or whatever) to either accept it
>immediately and credit the payer with whatever it is you are selling,
>or to delay completion of the transaction while you attempt to deposit
>the coin with your e-bank.  (If you are wary of "payee-ID proof
>stings" like Lucky Green is, then you can go ahead and launder your
>coin through an anon account during this interval...)  If your payer
>has already spent this coin, then the bank will inform you immediately
>and you can cancel the transaction.  (And take whatever other actions
>you consider appropriate...)

Unfortunately, in order for a coin to be POTENTIALLY spent in an off-line
way, the protocols require that the identity of the withdrawer be
embedded, in blinded form, within the coin data.  It is this step that
Tim and others object to, because among other things it requires
participants to securely identify themselves to the bank, hence does not
work well in a fully anonymous society.  The reason for this requirement
is that if the coin is double-spent, this is not found out until
afterwards, and so the identity of the cheater has to be available so the
bank can go after him.

So letting the payee choose whether to deposit the coin right away or
wait until later will not address this basic privacy problem with offline
cash.

Hal

Tim wrote:

> "Double spending" detection is a REAL MESS. That's my basic conclusion. It
> tends to require schemes for going after double spenders, it tends to make
> identity-revealing attacks possible (such as the attack I alluded to, and
> that Hal more completely describes), and it's INELEGANT.
> 
> "Immediate clearing" is much more elegant, and is, I think, truer to the
> spirit of "annonymous digital cash" than most of these other schemes are.
> (Grep the FAQ for "online" or "online clearing" or "clearing" and you
> should find some stuff. Also, several articles--including one recently by
> me, about a month ago--go into the differences between the types of
> clearing.)

I also suggest taking a look at Stefan Brands' solution, which, while
requiring hardware, has some favorable properties.  Among these are:

   - prior restraint of double spending through hardware-based
   "secret-key certificates"

   - in the case of hardware tampering, double spenders are traceable
   as in Chaum's system; however, the protocol used to achieve this is
   much more efficient than Chaum's "cut-and-choose"

   - no possibility of a subliminal channel between the
   tamper-resistant device and the payee or bank


--
Mark Chen 
chen@intuit.com
415/329-6913
finger for PGP public key
D4 99 54 2A 98 B1 48 0C  CF 95 A5 B0 6E E0 1E 1D