anonymity and e-cash

The NSA's research report on e-cash says:

	"The ideal situation (from the point of view of privacy advocates)
is that neither payer nor payee should know the identity of the other. This
makes remote transactions using electronic cash totally anonymous:  no one
knows where Alice spends her money and who pays her.

	"It turns out that this is too much to ask: there is no way in such
a scenario for the consumer to obtain a signed receipt.  Thus we are forced
to settle for payer anonymity."

Keeping in mind I am only a lawyer, my skim of Schneier (2d ed.) didn't
illuminate.  The discussion of digital cash seemed to assume no payee
anonymity.  But the immediate previous section of dining cryptographers
involved (it seemed) recipient untraceability.

Is payee anonymity technically possible?  Under what conditions?

If so, is the issue social, e.g., as NSA notes, the lack of a signed receipt?

Thanks,
Lee

At 1:19 PM -0800 2/12/97, Lee Tien wrote:
>The NSA's research report on e-cash says:
>
>	"The ideal situation (from the point of view of privacy advocates)
>is that neither payer nor payee should know the identity of the other. This
>makes remote transactions using electronic cash totally anonymous:  no one
>knows where Alice spends her money and who pays her.
>
>	"It turns out that this is too much to ask: there is no way in such
>a scenario for the consumer to obtain a signed receipt.  Thus we are forced
>to settle for payer anonymity."
>
>Keeping in mind I am only a lawyer, my skim of Schneier (2d ed.) didn't
>illuminate.  The discussion of digital cash seemed to assume no payee
>anonymity.  But the immediate previous section of dining cryptographers
>involved (it seemed) recipient untraceability.
>
>Is payee anonymity technically possible?  Under what conditions?
>
>If so, is the issue social, e.g., as NSA notes, the lack of a signed receipt?

You missed a very good talk by Ian Goldberg at the Saturday meeting at
Stanford, where Ian talked for more than an hour on just this issue.

It was explicitly stated in Chaum's 1985 paper that methods existed to
ensure full untraceability. Chaum has in recent years emphasized a more
"surveillance friendly" system in which some of the anonymity is lost.

It was the intuition of some of us that "coin changers" could solve this
problem, e.g, by having intermediaries to "mix" the coins and thus break
the traceability chain. Lucky Green wrote some articles along these lines,
and maybe Hal Finney, too. This was a couple of years ago.

In August of '95, Doug Barnes released a long article on "Identity
Agnostic" systems. (His article is no longer at the www.communities.com Web
site, so I can't refer you to it. Maybe he'll post it again.)

Ian Goldberg has seemingly reproduced what Chaum was thinking about (but,
apparently, did not make completely clear in his papers, for whatever
reasons). Ian deals with the issue of "making change" and comes up with a
system in which intermediaries, which we may call "e-cashiers" and
"moneychangers," can take on the role of the mint/bank.

By making "negative deposits" (submitting signed withdrawal slips,
effectively), these intermediaries function as moneychangers. And so the
one-way anonymous features become two-way (effectively, each of the
transactions contributes a "one-way anonymous" component: one-way + one-way
= two-way).

(It is much easier to understand digital cash with the usual diagram
showing the usual triangle of CUSTOMER-MERCHANT-MINT and then analyzing the
flow of information, who knows what, etc. Drawing such diagrams in e-mail
is beyond my patience.)

This system used online clearing, of course.

This "disintermediates" the process, and makes for an "everyone a mint"
situation, which has some of the same nice properties that an "everyone a
remailer" ecology of remailers and users has.

And the principle can be extended further, to where the usual distinctions
between CUSTOMER and MERCHANT vanish (as it sort of does in the real world,
where the two parties are merely exchanging one item for another item), and
where the role of the MINT is minimal.

In fact, Ian showed, the Chaum patents on blinding are NOT USED by the
Mint/Bank; only the CUSTOMER uses the blinding patents (and the MERCHANT in
some cases, not in other cases). This means that "anyone a mint" does not
violate any of the Chaum/Digicash patents, and "mint clients" are likely to
be written by third parties. (The _customer_ is presumably on the honor
system to abide by the Chaum patents...except the patents are only being
licensed to banks...go figure.)

(This is where, as I recall, Doug's "agnostic" system came in...it is
possible his thinking was similar to Ian's...I don't have Doug's paper
handy.)

Ian demonstrated this on an actual system, with real live connections to
mints in various countries, but with the blinding not used (as I recall).
Draw your own conclusions about what this means.

It was heady stuff, seeing the result many of us believed to be implicit in
Chaum's 1985 paper made real. Everyone a mint. This makes the spread of
fully anonymous digital cash harder to stop.

Issues of the mint denying one has an account are always real ones, but not
important--I think--in the real world. The untraceability of the digital
coins means that a mint never knows who is testing it for reliability and
"honesty," and the mint cannot set out to "screw" a particular customer by
declaring his account not to exist (as the mint almost certainly does not
have to know who own which accounts, as deposits can be made anonymously).

I hope this helps. I plan to use this result centrally in my talk at the
panel discussion on "Governmental and Social Implications of Digital Cash"
at the upcoming CFP.

--Tim May

Just say "No" to "Big Brother Inside"
We got computers, we're tapping phone lines, I know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

Lee Tien <tien@well.com> writes:

> [...] 
> Is payee anonymity technically possible?  Under what conditions?
> [...]

It's not too hard: The payee forwards a blinded, non-signed coin
to the payer. The payer has the bank sign this, and then returns
it to the payee who strips out the blinding factor. I think
this is discussed in Schneier.

Leonard

-----BEGIN PGP SIGNED MESSAGE-----

On 12 Feb 1997 janke@unixg.ubc.ca wrote:

> It's not too hard: The payee forwards a blinded, non-signed coin
> to the payer. The payer has the bank sign this, and then returns
> it to the payee who strips out the blinding factor.

This is correct except for the fact that the payer also has to apply a blinding
factor to the coin, thus making it a "double-blinded" coin.  It gets signed by
the bank, the payer divides the coin by the blinding factor and sends it to
the payee, who then strips out his blinding factor.  Ecash coins can also be
laundered making the above scheme mostly unnecessary.  Since most people will
probably not look upon fully anonymous ecash highly, laundering will be a more
popular option as it cannot be prevented.


Mark
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQEVAwUBMwJkjyzIPc7jvyFpAQFHcwgAm2TZXg3wVDCtXyHBdq7WX44iA+nIvmHJ
GlcXCjyKBEmvRPfkvU/NUnS1cRfjsPh5ZmjNwjBc21lwxjcOLFtu+3Mcd6tNoyYQ
4Abp4lvJLnpGAtAVeSeTAw+7mzwrC0jfWgt2meNbnyp2WxLxg/JA7VGGkS39g4Jm
+i3F8H00mFJfmZUGpAiywE7GNobCXeppPJOn/QHA4/FrWJx5hE39qgB7U+AFwYVP
PHGy4SSSBeKWciK83DU3Bz6ptygznL7fHW4vOZ8UM5QZjbyiDomVriSuJHw0lKdH
r63BhOqYPXgMHgsa28XTlI9AWN5PpaIbvORTHOWv40EF3nGVrWGnMw==
=Vpit
-----END PGP SIGNATURE-----