yes, i am replying to a message that is six weeks old. hal, chaum may be barking up the wrong tree, but that doesn't mean that his students are. i read a couple of digital cash papers last night and was struck by this statement in one of them: Techniques have been developed that ... allow the construction of off-line electronic cash systems that are secure for the bank, yet at the same time honest users of the system are guaranteed to remain completely anonymous. This holds in a very strong sense: the security of banks is not compromised even if all users and shops collaborate in such an attempt, and the privacy of honest users cannot be violated in any cryptanalytic way even under adversarial behavior of the bank in coalition with all the shops. Stefan Brands, CWI this is very encouraging: digital cash technology is very far advanced, and offers almost everything you might want. (i think the jury is still out on the question of k-spendability.) but then there is the bad news: the mathematics and the protocols underlying the technology are still too complex to be practical. but there is also good news: much of the current work intends to simplify the protocols and to lessen the computational requirements of digital cash systems. peter