Yes, I remember that now. My interpretation, though, was that with the bank's help you could tell when a coin had been re-used. This could impair the anonymity of the cash. Generally in the analysis of these proto- cols one wants anonymity even if the bank and the other participants collude. That is the whole point of cryptographic (non-transferable) cash, after all; otherwise the bank could just use the "Poor Man's Cash" idea which Tim May suggested here last year and just issue cash in the form of magic numbers with no blinding or digital sigs. Hal