Download presentation

Presentation is loading. Please wait.

Published byIsabel Buchanan Modified over 3 years ago

1
**Simple and Practical Anonymous Digital Coin Tracing**

Trustee Tokens Simple and Practical Anonymous Digital Coin Tracing Ari Juels RSA Laboratories

2
**Quick Review of Chaumian E-cash**

(DigiCashTM)

3
**Anonymous digital $1 coin**

Alice BANK PK SK Signs Alice -$1 Anonymous digital $1 coin

4
**r, x rf1/3(x) r3f(x) (x, f1/3(x)) rf1/3(x) = (x, Sig(x)) = PK SK mod n**

Alice BANK PK SK mod n Signs 3 r3f(x) r, x rf1/3(x) r3f(x) (x, f1/3(x)) = (x, Sig(x)) = rf1/3(x) rf1/3(x)

5
**Improved Computer Viruses**

(Young and Yung) An Application for Anonymous E-Cash An Application for Anonymous E-Cash

6
**Improved Computer Virus**

r3f(x) Generates unsigned, blinded coin Generates encryption key pair Edgar

7
**Improved Computer Virus**

r3f(x) PK

8
Alice

9
Hard Disk

10
**Files Encrypted under PK *&DUHF(&$YY$H&*^$RH(*&UH**

*&(#*R&(*&(*$&(*$&(*U(*F&(*&* *&HKJF(*$YHF(*H$(*^FH*($HF& J(*F&$(*HS(*&$JF*($&SH$*&F$ *(&$*(F&(*$F$(*F&S(*&*F(&*E$$ )*F&(*$&*$&F(*$&F(*$&(*&(#(*$ Encrypted under PK PK Files

11
If you Want SK, i.e., your files, withdraw this Ransom Note

12
Alice BANK Oh, my files! Alice -$1

13
**HETTINGA SUCCEEDS GREENSPAN AT FED**

14
Anonymous coin Edgar

15
**Answer: Trustee-based Tracing**

How can we prevent this?

16
**The Idea: Trustee Tracing**

Anonymous coin

17
**Tracing: Basic Idea I order the Trustee to trace this coin. Edgar**

Anonymous coin Judge Trustee Secret SK

18
**Coin is anonymous unless trustee traces it**

19
**Many Trustee-based Tracing Schemes**

Brickell et al. ( ‘95) Stadler et al. (‘95) Jakobsson and Yung (‘96, ‘97) Camenisch et al., Frankel et al. (‘96) Davida et al. (‘97)

20
**Trend in schemes Our Scheme Security Trustee Simplicity Computational**

Features Trustee Flexibility Simplicity Computational Efficiency

21
How our scheme works

22
**1. 2. Two stages Token withdrawal Alice Trustee Coin withdrawal Alice**

BANK 2.

23
**Token withdrawal Proves identity Alice Trustee Checks that Trustee**

coin contains [“Alice”]PK Trustee Token

24
**Trustee Token Proves identity Alice r, x Trustee Trustee Checks that**

x contains [“Alice”]PK SigSK(r3f(x))

25
**Coin withdrawal , Conditionally anonymous digital coin SK Alice Checks**

BANK SK Signs , Checks Conditionally anonymous digital coin

26
**Observe: No change in coin structure or underlying withdrawal protocol**

27
**Tracing Trustee Token scheme guarantees**

that coins contain creator identity

28
**Blackmail scenario Edgar registers his coin and gets caught or**

Alice can’t make the withdrawal for Edgar

29
Enhancements

30
No coin storage Alice can pseudo-randomly generate coins and blinding factors -- no coin storage

31
Bulk token withdrawal Alice can withdraw many tokens at once and store prior to coin withdrawals

32
**One token - multiple coins**

33
**Result of Enhancements**

Little interaction with Trustee Tokens fit on, e.g., smart card

34
Pros and Cons

35
**Advantages over other schemes**

Very simple Provably secure No change in coin structure, underlying protocol Seamless incorporation with DigiCashTM

36
**Disadvantages Trustee interaction needed**

Security with multiple trustees needs trusted dealer Seamless incorporation with DigiCashTM - but no DigiCashTM

37
**But... Can be used for general blind RSA**

E.g., X-cash Method can perhaps be extended to other e-cash systems (?)

38
Questions?

Similar presentations

© 2017 SlidePlayer.com Inc.

All rights reserved.

Ads by Google