A million monkeys operating under the pseudonym "Hal Finney <hal@rain.org>" typed:
It is hard to understand why a system where it is impossible to track payments (Chaumian anonymity) is cheaper than one where it is possible to do so, but we choose not to. If avoiding tracking payments is cheaper than tracking them, why wouldn't participants just not bother to track them even when they theoretically could?
This is an excellent question, Hal. I've been thinking about it since I saw a similar post of yours earlier today.
Granted, there are situations where taking away someone's options can make him better off. The classic example would be the Prisoner's Dilemma, which I will assume people here are familiar with. Given the choice to cooperate or defect, standard analysis predicts that both players will defect. Remove that option, and they will be forced to cooperate, leading to a better ("lower cost") outcome for both. The structure of the game forced them to take advantage of an option which has the net result of costing them more.
In the case where the problem of nymity is that one actor can later prove the fact of the transaction, and this is a cost, I can see how the option of anonymity could make a cheaper transaction possible. However, I think that this is _not_ the case that Robert Hettinga is interested in. I think the case that Bob is talking about is when the cost is the possibility of incurring legal liability from the transaction. So it is true that _if_ the transactions were unconditionally anonymous, _then_ you would not have the costs of legal liability, but it does not follow that anonymity is the _only_ way to avoid the cost. Frankly, I think the best way to avoid that cost in the forseeable future is the time-tested method of saying "I make no warranties, etc. etc. and incur no contractual obligation blah blah and so forth.", as part of your deal. I think this can be accomplished done without using any cryptographic technique more complicated than simple authentication. Regards, Zooko Journeyman Disclaimers follow: I am not a crook. NOT speaking for DigiCash or any other person or organization. No PGP sig follows.