Re: digital cash and identity disclosure
At 5:41 PM 10/19/95, Hal wrote:
There is an attack here, but the text doesn't go into detail about it. You have to assume that (as with the current ecash implementation from Digicash) people have non-anonymous accounts with the bank. If Alice wants to know Bob's identity she can collude with the bank to find out. As Tim describes, she gives Bob some money, then quickly deposits the coins herself. In effect, she intentionally double-spends (with the bank's permission). When Bob makes his deposit, his coins are recognized as matching those which Alice double-spent. So if Alice was, say, an agent involved in a government "sting", and bought bootleg software from Bob, his identity can in fact be learned when he deposits the money.
Actually with the DigiCash system and in fact all of the ecash systems I know about, you don't have to get so fancy; Alice can simply give the bank a record of her transaction with Bob (the coins she sent him) and these will be recognized when Bob deposits them.
Lucky Green has been discussing ways in which people could exchange coins anonymously even with DigiCash's ecash in order to provide some immunity from such attacks.
As Hal notes, there are a lot of issues and attacks to consider. I'm sorry that my brief section on Chaumian digital cash in the Cyphernomicon doesn't adequately cover the issues (and as the debates here show, confusion still reigns, and no doubt some of my points are misleading, wrong, or incomplete). "Double spending" detection is a REAL MESS. That's my basic conclusion. It tends to require schemes for going after double spenders, it tends to make identity-revealing attacks possible (such as the attack I alluded to, and that Hal more completely describes), and it's INELEGANT. "Immediate clearing" is much more elegant, and is, I think, truer to the spirit of "annonymous digital cash" than most of these other schemes are. (Grep the FAQ for "online" or "online clearing" or "clearing" and you should find some stuff. Also, several articles--including one recently by me, about a month ago--go into the differences between the types of clearing.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."
Tim wrote:
"Double spending" detection is a REAL MESS. That's my basic conclusion. It tends to require schemes for going after double spenders, it tends to make identity-revealing attacks possible (such as the attack I alluded to, and that Hal more completely describes), and it's INELEGANT.
"Immediate clearing" is much more elegant, and is, I think, truer to the spirit of "annonymous digital cash" than most of these other schemes are. (Grep the FAQ for "online" or "online clearing" or "clearing" and you should find some stuff. Also, several articles--including one recently by me, about a month ago--go into the differences between the types of clearing.)
I also suggest taking a look at Stefan Brands' solution, which, while requiring hardware, has some favorable properties. Among these are: - prior restraint of double spending through hardware-based "secret-key certificates" - in the case of hardware tampering, double spenders are traceable as in Chaum's system; however, the protocol used to achieve this is much more efficient than Chaum's "cut-and-choose" - no possibility of a subliminal channel between the tamper-resistant device and the payee or bank -- Mark Chen chen@intuit.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D
-----BEGIN PGP SIGNED MESSAGE----- Someone claiming to be the nym calling itself tcmay@got.net (Timothy C. May) wrote:
As Hal notes, there are a lot of issues and attacks to consider. I'm sorry that my brief section on Chaumian digital cash in the Cyphernomicon doesn't adequately cover the issues (and as the debates here show, confusion still reigns, and no doubt some of my points are misleading, wrong, or incomplete).
Boy, if I were you I would want to fix the inadequacy in C'nomicon in order to protect my positive rep...
"Double spending" detection is a REAL MESS. That's my basic conclusion. It tends to require schemes for going after double spenders,
You mean Real Life(tm) security a.k.a. force, but this isn't necessarily so. We could just as well debit the double-spender's rep and lower the limit on how much e-cash he will be issued.
it tends to make identity-revealing attacks possible (such as the attack I alluded to, and that Hal more completely describes),
I hesitate to pipe up in such august company, but one of us is confused. The attack that we have been discussing is possible because Chaumian Ecash allows the payer to identify the payee. This would be true whether or not there were any protocols related to double-spending. (i.e., because the payer knows the actual ID number of the bill, she can choose to relate it to the bank and then the bank can identify who turns in that bill. Has nothing to do with double-spending. If the protocol provided for re-blinding before depositing the bill then this would not be possible, I think, and would still have nothing to do with double-spending.)
and it's INELEGANT.
I personally think it is beautiful, because it allows for off-line transactions at a cost of a relatively small risk of double-spending. Perhaps we could modify the protocol and have the best of both worlds? I think I'll write a separate post on this subject now... Regards, Bryce Announcement: I'm about to fade out from c'punks list for a while, so be sure and Cc: me if you want me to see your post. signatures follow "To strive, to seek, to find and not to yield." <a href="http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html"> bryce@colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMIarbfWZSllhfG25AQEYzAQAtjBPJ6iZAepKa4sfzFjciX9oPK/orYcl GT7WpBPJSmPeuBEUdruNDcp3GEuuBit+xOsAqvaORA3epw12BDlzlBN3gU4nq5dL GmsDR7CKX64Ouz/+qxoMmGPUe/CH6FHg4msIvitE7A6DNltYJMPOfWrVF3lhwcx7 iguZ8TAbtTU= =fXcK -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Some cpunks a couple of months ago told us about "agnostic" e-cash anonymity schemes in which the e-bank accepts both blinded and un-blinded coin requests, leading to anonymity or non-anonymity at the choice of the client. They pointed out how this would be very easy to implement, based on the current Chaumian system. I think this is an excellent idea for social-engineering reasons and I congratulate them on bringing it up. (Unfortunately I don't have time right now to look up who it is that I am congratulating...) Perhaps a similar "polymorphism" could be implemented with regard to on-line/off-line clearing. When you as a payee receive a Chaumian Ecash coin, you can choose based on several factors (including reputation of the payer if he chooses to make his nym known to you, size of the transaction, time of day, or whatever) to either accept it immediately and credit the payer with whatever it is you are selling, or to delay completion of the transaction while you attempt to deposit the coin with your e-bank. (If you are wary of "payee-ID proof stings" like Lucky Green is, then you can go ahead and launder your coin through an anon account during this interval...) If your payer has already spent this coin, then the bank will inform you immediately and you can cancel the transaction. (And take whatever other actions you consider appropriate...) It seems like such a scheme would include all of the advantages (off-line clearing) of Chaumian Ecash as well as those (double-spending prevention) of the on-line clearing systems. Thus, TCMay's objections to current Chaumian Ecash would not apply to this new variation. I hope that this isn't an old-news yawner to you experts. Regards, Bryce Announcement: I'm going to be fading off the the c'punks list for a while, so be sure and Cc: me if you want me to read your post. signatures follow "To strive, to seek, to find and not to yield." <a href="http://ugrad-www.cs.colorado.edu/~wilcoxb/Niche.html"> bryce@colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMIauO/WZSllhfG25AQGXHwP+MEpnPvpj81fV66HEb8rozlMepnol3nj5 /d73LQpMxB7fLcMEDmISNQef/eU39zId8EZ1XCW7X3AujMBa4OjuBgl3+vdrAKo9 DIb6imXxc+E9dyHp0i9y/FZtzkOXKF6Abwy3SYMOSyaI2HsiCyUx2tEW/6OzDJTi 7YyOqR+FkNQ= =cpK7 -----END PGP SIGNATURE-----
Bryce <wilcoxb@nag.cs.colorado.edu> writes:
Perhaps a similar "polymorphism" could be implemented with regard to on-line/off-line clearing. When you as a payee receive a Chaumian Ecash coin, you can choose based on several factors (including reputation of the payer if he chooses to make his nym known to you, size of the transaction, time of day, or whatever) to either accept it immediately and credit the payer with whatever it is you are selling, or to delay completion of the transaction while you attempt to deposit the coin with your e-bank. (If you are wary of "payee-ID proof stings" like Lucky Green is, then you can go ahead and launder your coin through an anon account during this interval...) If your payer has already spent this coin, then the bank will inform you immediately and you can cancel the transaction. (And take whatever other actions you consider appropriate...)
Unfortunately, in order for a coin to be POTENTIALLY spent in an off-line way, the protocols require that the identity of the withdrawer be embedded, in blinded form, within the coin data. It is this step that Tim and others object to, because among other things it requires participants to securely identify themselves to the bank, hence does not work well in a fully anonymous society. The reason for this requirement is that if the coin is double-spent, this is not found out until afterwards, and so the identity of the cheater has to be available so the bank can go after him. So letting the payee choose whether to deposit the coin right away or wait until later will not address this basic privacy problem with offline cash. Hal
participants (4)
-
Bryce -
chen＠intuit.com -
Hal -
tcmay＠got.net