Is Chaum's System Traceable or Untraceable?

[Bill Frantz]

At  9:10 AM 5/20/96 -0700, Ian Goldberg wrote:
>However, if you use the "fully anonymous" protocol, change becomes trivial.
>You don't have to go online; the payer (the shop) does, which it assumedly
>already is.  Another benefit is that coins received in this way as change
>are immediately spendable by you, without having to go online in between.

Perhaps I am confused, but I see no need for change in the fully anonymous
protocol.  I see the fully anonymous protocol as:

(1) The payee generates a coin for the amount of purchase, blinds it and
gives it to the payer.
(2) The payer blinds it again and gives it to the bank, which signs it
debiting the payer's account.
(3) The payer removes his blinding and gives the signed coin to the payee.
(4) The payee removes his blinding and deposits the coin.

Step 1 could be called a request for payment (an invoice), step 2 a
withdrawal, step 3 the payment, and step 4 a deposit.

Is there another version which allows the payee to have an unconnected
wallet of coins and get change in return?


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA