Presentation is loading. Please wait.

Presentation is loading. Please wait.

Simple and Practical Anonymous Digital Coin Tracing

Similar presentations

Presentation on theme: "Simple and Practical Anonymous Digital Coin Tracing"— Presentation transcript:

1 Simple and Practical Anonymous Digital Coin Tracing
Trustee Tokens Simple and Practical Anonymous Digital Coin Tracing Ari Juels RSA Laboratories

2 Quick Review of Chaumian E-cash

3 Anonymous digital $1 coin
Alice BANK PK SK Signs Alice -$1 Anonymous digital $1 coin

4 r, x rf1/3(x) r3f(x) (x, f1/3(x)) rf1/3(x) = (x, Sig(x)) = PK SK mod n
Alice BANK PK SK mod n Signs 3 r3f(x) r, x rf1/3(x) r3f(x) (x, f1/3(x)) = (x, Sig(x)) = rf1/3(x) rf1/3(x)

5 Improved Computer Viruses
(Young and Yung) An Application for Anonymous E-Cash An Application for Anonymous E-Cash

6 Improved Computer Virus
r3f(x) Generates unsigned, blinded coin Generates encryption key pair Edgar

7 Improved Computer Virus
r3f(x) PK

8 Alice

9 Hard Disk

10 Files Encrypted under PK *&DUHF(&$YY$H&*^$RH(*&UH
*&(#*R&(*&(*$&(*$&(*U(*F&(*&* *&HKJF(*$YHF(*H$(*^FH*($HF& J(*F&$(*HS(*&$JF*($&SH$*&F$ *(&$*(F&(*$F$(*F&S(*&*F(&*E$$ )*F&(*$&*$&F(*$&F(*$&(*&(#(*$ Encrypted under PK PK Files

11 If you Want SK, i.e., your files, withdraw this Ransom Note

12 Alice BANK Oh, my files! Alice -$1


14 Anonymous coin Edgar

15 Answer: Trustee-based Tracing
How can we prevent this?

16 The Idea: Trustee Tracing
Anonymous coin

17 Tracing: Basic Idea I order the Trustee to trace this coin. Edgar
Anonymous coin Judge Trustee Secret SK

18 Coin is anonymous unless trustee traces it

19 Many Trustee-based Tracing Schemes
Brickell et al. ( ‘95) Stadler et al. (‘95) Jakobsson and Yung (‘96, ‘97) Camenisch et al., Frankel et al. (‘96) Davida et al. (‘97)

20 Trend in schemes Our Scheme Security Trustee Simplicity Computational
Features Trustee Flexibility Simplicity Computational Efficiency

21 How our scheme works

22 1. 2. Two stages Token withdrawal Alice Trustee Coin withdrawal Alice

23 Token withdrawal Proves identity Alice Trustee Checks that Trustee
coin contains [“Alice”]PK Trustee Token

24 Trustee Token Proves identity Alice r, x Trustee Trustee Checks that
x contains [“Alice”]PK SigSK(r3f(x))

25 Coin withdrawal , Conditionally anonymous digital coin SK Alice Checks
BANK SK Signs , Checks Conditionally anonymous digital coin

26 Observe: No change in coin structure or underlying withdrawal protocol

27 Tracing Trustee Token scheme guarantees
that coins contain creator identity

28 Blackmail scenario Edgar registers his coin and gets caught or
Alice can’t make the withdrawal for Edgar

29 Enhancements

30 No coin storage Alice can pseudo-randomly generate coins and blinding factors -- no coin storage

31 Bulk token withdrawal Alice can withdraw many tokens at once and store prior to coin withdrawals

32 One token - multiple coins

33 Result of Enhancements
Little interaction with Trustee Tokens fit on, e.g., smart card

34 Pros and Cons

35 Advantages over other schemes
Very simple Provably secure No change in coin structure, underlying protocol Seamless incorporation with DigiCashTM

36 Disadvantages Trustee interaction needed
Security with multiple trustees needs trusted dealer Seamless incorporation with DigiCashTM - but no DigiCashTM

37 But... Can be used for general blind RSA
E.g., X-cash Method can perhaps be extended to other e-cash systems (?)

38 Questions?

Download ppt "Simple and Practical Anonymous Digital Coin Tracing"

Similar presentations

Ads by Google