Controlled nymity

[James A. Donald]

    --
James A. Donald:
> > What we want of a payment system, is that Alice can prove 
> > she paid Bob, even if Bob wants to deny it, but no one else 
> > can prove that Alice paid Bob unless Alice takes special 
> > action to make it provable.

Major Variola (ret)
> Does it help if: Alice generates a secret key for each 
> payment Alice *anonymously* deposits an *encrypted* message 
> containing payment details into Bob's acct Only Alice can 
> reveal the key for a particular transaction in Bob's account, 
> thereby stripping anonymity but also revealing payment.  For 
> only that transaction.

Presumably Alice prepares a bunch of unblinded tokens, marks 
them "for Bob" and encrypts them so that only the bank can read 
them.

Bob then gives that message to the bank, and the bank then 
tells Bob "yes, its a valid payment for 25 grams of gold to 
Bob"

Since Alice knows the secrets embedded in that message, she can 
prove that she originated that message, so she can prove she 
paid Bob, but no one else can prove it.  She can prove that to 
Bob, or to anyone, assuming the bank cooperates.

Of course this means the bank knows how much money everyone is 
paying Bob, even if it does not know who is paying Bob.

Also Alice cannot prove that the money was accompanied by the 
message "OK Bob, here is the twenty five grams of gold, deliver 
the Maltese falcon tonight." and thus cannot prove that Bob, by 
accepting the tokens valid for the gold, agreed to deliver the 
Maltese Falcon.

Perhaps these two problems can be fixed.

Alice encrypts a message to the bank containing the unblinded 
tokens.  It also contains instructions 'accept this deposit 
only if accompanied by a number whose hash is X, and only if 
the message is signed with the private key corresponding to 
this public key 89798759754.

Alice puts this encrypted message to the bank inside a a 
message to the Bob, which contains the instructions: "OK Bob, 
here is the twenty five grams of gold, deliver the Maltese 
falcon tonight.  Here is a cheque made out to cash, for 25 
grams of gold, valid if accompanied by the hash of this 
message, and signed with private key 1764383486*b, where b is 
whatever your private key is.   Signed Alice."

Bob delivers the cheque, (an encrypted message to the bank) and 
the bank validates it as correctly formed and containing valid 
unspent unblinded tokens, and gives him blinded tokens for 25 
grams of gold.

To prove that it was Bob who did indeed deposit this money, 
Alice reveals to the bank the message corresponding to the 
hash, and thus reveals that 89798759754.= B^1764383486, where B 
is Bob's public key, and thus, if the bank keeps a record of 
the exchange, proves that it was Bob who made the exchange, and 
that the money was from Alice, and was for the Maltese falcon. 

    --digsig
         James A. Donald
     6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG
     t9GmbLxgymh192YQzp+e8St5v1yhN1n014TZ3Fyf
     4k6B1/EGsY+IBb0q+xTsr05v3am+86d6UlAzY51Cz