1. Class 12 Anonymous Digital Currency CIS 755: Advanced Computer Security Spring 2014 Eugene Vasserman http://www.cis.ksu.edu/~eyv/CIS755_S14/

2. Administrative stuff Exam I returned – Questions? Corrections to today’s paper: – Published table incorrect – Number of communication rounds typo – Corrected paper at: http://people.cis.ksu.edu/~eyv/papers/e cash-icdcs07.pdf

3. What is eCash? Merchant eWallet Wallet Exchanger

4. Properties of eCash Unforgeability Non-reusability Anonymity – Untraceability – Unlinkability

5. Comparisons eCash versus – Cash – Credit cards – Micropayments Motivations – Like cash, but digital!

6. Applications of eCash Online payment – Lower processing costs than credit cards Micropayments – Content – Advertising replacement – New business models

7. Challenges Double-spending – What is it? – Why is it a problem?

8. Double-spending Chaum, 1982 – Centralized online agent Offline double-spending detection – Chaum – 1988 Revocable anonymity – Problem! Brands - 1993 – Tamper-proof agent/device (online)

9. Problem Statement Design an eCash scheme that provides – Anonymity – Real-time double-spending protection – Decentralization – No trusted hardware – No client security deposit – Practical/deployable

10. Key Components Broker WitnessClient Merchant

11. Witnesses Method to transform centralized entity into group of peers – Witnesses do online double-spending detection Use merchants as witnesses – CCI assumption – Long-term presence assumption A coin is assigned uniquely to witness

12. Witnesses Challenges Who chooses witnesses? – Bank Anonymity loss – Client Collaboration, load balancing/fairness Incentives Fairness

13. Withdrawal Broker Client Hi

14. Withdrawal Key Points Witness selection based on h(bare coin) and witness list version/date Signature on witness assignment Broker does not know h(bare coin)!

15. Commit Witness Client

16. OK Payment Client Merchant Witness

17. Payment Key Points “Bare coin” – Includes secret extractable information – Signed by broker

18. OK Redeem Broker Merchant

19. Security Properties Provably untraceable and unlinkable Provably secure against forgery and re-use

20. Complexity Analysis Overhead – Should be dominated by network times ExpHashSigVerComm Withdrawal Client12401 2 Broker3100 Payment Client0301 3 Witness7621 Merchant7603 Deposit Merchant0000 1 Broker6401 Renewal Client12501 2 Broker9400

21. Implementation Proof of concept – Python 2.4 – 1200 lines of code in four modules Simplicity – REST (REpresentational State Transfer) Performance – Python crypto is less than stellar

22. Future work Performance – Convert to OpenSSL call blocks Firefox extension – Payment tag plus Java extension to implement client-side crypto

23. Summary I Broker WitnessClient Merchant

24. Summary II What stops collusion? What happens if compromised: – Broker? – Merchant? – Witness? – Client?

25. Expiration Dates Two expiration dates: – After (1), coin: Can be renewed Can not be spent Can not be deposited – After (2), coin is completely useless Prevents broker coin database from growing too big

26. Questions? Reading discussion