Of course, with tamper-proof chips this problem can be solved easily. You don't need oblivious transfer. Rather, you get digital tokens from the video provider which you pass on to the tamper-proof decryption chip, where each token is worth a certain amount of decryption. Then you choose which movies you want to decrypt. The only question would be whether the tamper-proof chip would keep a record of your viewing habits. But you should be able to monitor anything it transmits (if it has to transmit anything) and it should not have to send any encrypted messages. So your secrets should be safe. One problem with this approach (and the other ones we have discussed) is that the vendor loses any information about which movies are most watched, which hurts his ability to set prices and choose which movies to carry. Perhaps he could resort to a separate anonymous public-opinion poll to determine this info (protected with is-a-person (is-a-customer?) credentials so that our friend Detweiler can't pseudo-spoof with his multiple tentacles ;-). Or, perhaps another approach is to have a different decryption key for each movie, and to simply sell those keys to anonymous buyers. They would then load them into their decryption boxes. This does seem vulnerable to pirating the keys, though. Piracy could be avoided if the decryption keys were stamped with the serial number of the particular tamper-proof decryption box they were for (so that they would only work with that one box). But then you lose the anonymity. I'm thinking that some form of blinding could be used to produce a key which would only be accepted by one box, but for which the movie seller would not be able to determine which box it was for. This is very similar to the requirement for electronic cash, and I think a similar idea would work. This solution also is a nice example of the uses of anonymous networks. I wonder whether the NII could support DC-nets? :) Hal