1. Simple and Practical Anonymous Digital Coin Tracing
Trustee Tokens
Simple and Practical Anonymous Digital Coin Tracing
Ari Juels
RSA Laboratories

2. Quick Review of Chaumian E-cash
(DigiCashTM)

3. Anonymous digital $1 coin
Alice
BANK PK SK
Signs
Alice -$1
Anonymous digital $1 coin

4. r, x rf1/3(x) r3f(x) (x, f1/3(x)) rf1/3(x) = (x, Sig(x)) = PK SK mod n
Alice
BANK PK SK
mod n
Signs 3
r3f(x)
r, x
rf1/3(x)
r3f(x)
(x, f1/3(x))
= (x, Sig(x)) =
rf1/3(x)
rf1/3(x)

5. Improved Computer Viruses
(Young and Yung)
An Application for Anonymous E-Cash
An Application for Anonymous E-Cash

6. Improved Computer Virus
r3f(x)
Generates unsigned, blinded coin
Generates encryption key pair
Edgar

7. Improved Computer Virus
r3f(x) PK

8. Alice

9. Hard Disk

10. Files Encrypted under PK *&DUHF(&$YY$H&*^$RH(*&UH
*&(#*R&(*&(*$&(*$&(*U(*F&(*&*
*&HKJF(*$YHF(*H$(*^FH*($HF&
J(*F&$(*HS(*&$JF*($&SH$*&F$
*(&$*(F&(*$F$(*F&S(*&*F(&*E$$
)*F&(*$&*$&F(*$&F(*$&(*&(#(*$
Encrypted under PK PK
Files

11. If you Want SK, i.e.,
your files, withdraw this
Ransom Note

12. Alice
BANK
Oh, my files!
Alice -$1

13. HETTINGA SUCCEEDS GREENSPAN AT FED

14. Anonymous coin
Edgar

15. Answer: Trustee-based Tracing
How can we prevent this?

16. The Idea: Trustee Tracing
Anonymous coin

17. Tracing: Basic Idea I order the Trustee to trace this coin. Edgar
Anonymous coin
Judge
Trustee Secret SK

18. Coin is anonymous unless trustee traces it

19. Many Trustee-based Tracing Schemes
Brickell et al. ( ‘95)
Stadler et al. (‘95)
Jakobsson and Yung (‘96, ‘97)
Camenisch et al., Frankel et al. (‘96)
Davida et al. (‘97)

20. Trend in schemes Our Scheme Security Trustee Simplicity Computational
Features
Trustee
Flexibility
Simplicity
Computational
Efficiency

21. How our scheme works

22. 1. 2. Two stages Token withdrawal Alice Trustee Coin withdrawal Alice
BANK 2.

23. Token withdrawal Proves identity Alice Trustee Checks that Trustee
coin contains
[“Alice”]PK
Trustee
Token

24. Trustee Token Proves identity Alice r, x Trustee Trustee Checks that
x contains
[“Alice”]PK
SigSK(r3f(x))

25. Coin withdrawal , Conditionally anonymous digital coin SK Alice Checks
BANK SK
Signs ,
Checks
Conditionally anonymous digital coin

26. Observe: No change in coin structure or underlying withdrawal protocol

27. Tracing Trustee Token scheme guarantees
that coins contain creator identity

28. Blackmail scenario Edgar registers his coin and gets caught or
Alice can’t make the withdrawal for Edgar

29. Enhancements

30. No coin storage
Alice can pseudo-randomly generate coins and blinding factors -- no coin storage

31. Bulk token withdrawal
Alice can withdraw many tokens at once and store prior to coin withdrawals

32. One token - multiple coins

33. Result of Enhancements
Little interaction with Trustee
Tokens fit on, e.g., smart card

34. Pros and Cons

35. Advantages over other schemes
Very simple
Provably secure
No change in coin structure, underlying protocol
Seamless incorporation with DigiCashTM

36. Disadvantages Trustee interaction needed
Security with multiple trustees needs trusted dealer
Seamless incorporation with DigiCashTM - but no DigiCashTM

37. But... Can be used for general blind RSA
E.g., X-cash
Method can perhaps be extended to other e-cash systems (?)

38. Questions?