ON DIGITAL CASH-LIKE PAYMENT SYSTEMS

Daniel A. Nagy

Queen’s University, Dept. of Math. and Stats.

Jeffrey Hall, Kingston, ON, K7L 3N6, Canada

Keywords:

online payment systems, digital cash, security, cryptography.

Abstract:

In present paper a novel approach to on-line payment is presented that tackles some issues of digital cash that

have, in the author’s opinion, contributed to the fact that despite the availability of the technology for more

than a decade, it has not achieved even a fraction of the anticipated popularity. The basic assumptions and

requirements for such a system are revisited, clear (economic) objectives are formulated and cryptographic

techniques to achieve them are proposed.

1 INTRODUCTION

Chaum et al. begin their seminal paper (D. Chaum,

1988) with the observation that the use of credit cards

is an act of faith on the part of all concerned, expos-

ing all parties to fraud. Indeed, almost two decades

later, the credit card business is still plagued by all

these problems and credit card fraud has become a

major obstacle to the normal development of elec-

tronic commerce, but digital cash-like payment sys-

tems similar to those proposed (and implemented) by

D. Chaum have never become viable competitors, let

alone replacements for credit cards or paper-based

cash.

One of the reasons, in the author’s opinion, is

that payment systems based on similar schemes lack

some key characteristics of paper-based cash, render-

ing them economically infeasible. Let us quickly enu-

merate the most important properties of cash:

1. “Money doesn’t smell.” Cash payments are – po-

tentially – anonymous and untraceable by third par-

ties (including the issuer).

2. Cash payments are ﬁnal. After the fact, the paying

party has no means to reverse the payment. We call

this property of cash transactions irreversibility.

3. Cash payments are peer-to-peer. There is no dis-

tinction between merchants and customers; anyone

can pay anyone. In particular, anybody can receive

cash payments without contracts with third parties.

4. Cash allows for “acts of faith” or na

ıve transac-

tions. Those who are not familiar with all the anti-

forgery measures of a particular banknote or do not

have the necessary equipment to verify them, can

still transact with cash relying on the fact that what

they do not verify is nonetheless veriﬁable in prin-

ciple.

5. The amount of cash issued by the issuing authority

is public information that can be veriﬁed through

an auditing process.

The payment system proposed in (D. Chaum, 1988)

focuses on the ﬁrst characteristic while partially or to-

tally lacking all the others. The same holds, to some

extent, for all existing cash-like digital payment sys-

tems based on untraceable blind signatures (Brands,

1993a; Brands, 1993b; A. Lysyanskaya, 1998), ren-

dering them unpractical.

In his invited paper to Scientiﬁc American (Chaum,

1992), D. Chaum eloquently argues the importance of

untraceability, so there is no need to repeat it here. It

is worth noting, however, that while coins are truly

untraceable in practice, paper-cash with its unique se-

rial numbers is not. Yet, it does not seem to ham-

per its wide acceptance, because the anonymity of the

transactions provides for sufﬁcient privacy. The im-

portance of the other four characteristics lies in the

economics behind cash:

Irreversibility removes an important transaction

cost, namely that of potential reversal. An insur-

ance against reversal has to be built into the price of

A. Nagy D. (2005).

ON DIGITAL CASH-LIKE PAYMENT SYSTEMS.

In Proceedings of the Second International Conference on e-Business and Telecommunication Networks, pages 66-73

DOI: 10.5220/0001412100660073

 SciTePress

services offered in exchange for reversible payment.

Anonymity is a necessary, but not sufﬁcient compo-

nent of irreversibility. The payment system proposed

in (D. Chaum, 1988) sacriﬁces irreversibility in order

to allow for off-line transactions, assuming that com-

munication with the issuing authority is more expen-

sive than communication between the transacting par-

ties or complex computations. At the time of writing,

this might have been the case, but today, when the in-

frastructure for low-bandwidth communication (such

as short text messages, http queries, etc.) is ubiqui-

tous, the beneﬁts of off-line transactions are clearly

inferior to those of irreversible transactions.

The peer-to-peer nature of a payment system also

removes a signiﬁcant cost; if a contract with a third

party is necessary to receive payments, it is very likely

that this third party will charge for its service. This

raises the entry barrier for sellers and thus narrows

the assortment of goods and services available in ex-

change for the payment that is not peer-to-peer, re-

ducing its liquidity. In addition to this, merchant con-

tracts unnecessarily expose sellers to the provider of

the payment service; their income becomes known. It

is important to emphasize that by peer-to-peer pay-

ment I do not imply that there are no servers or other

centralized entities involved; it merely means that

there is no distinction between sellers and buyers,

merchants and customers. Anyone can pay anyone.

ıve transactions help reducing the costs of dis-

tributing the tools (hardware and software) used

for transactions. Contrarily to the assumptions of

(D. Chaum, 1988), computation is far less ubiquitous

than communication. While everyone with a cellu-

lar or a touch-tone telephone, a web-browser or email

client in its readily available, out-of-box conﬁguration

is able to transmit short messages (up to a few hun-

dred bits), performing complex calculations involving

strong asymmetric cryptography requires additional

tools which not everyone possesses or can afford to

run. The fact that it is impossible to transact without

performing complex calculations in real time is a far

more serious obstacle than the need to contact the is-

suer for each transaction. It also undermines the trust

in the system, as the the failure of the equipment used

for storing and transacting with such “cash” (a very

serious problem with (Brands, 1993b)) can cause un-

limited damage, that cannot be mitigated. The fact

that low-tech, na

ıve transactions are possible (and, in

fact, quite common) with cash, greatly contributes to

its acceptance and popularity. It is important to stress

that no-one is forced to transact na

ıvely, and always

has a choice of performing extra veriﬁcation and dis-

cover attempts at cheating. Just as one always has the

option of verifying one or more security features of a

banknote before accepting it.

The transparent governance of the issuer is perhaps

the most important reason to trust it. If the issuer is

able to issue digital money without anybody noticing,

its creditworthiness cannot be established and the in-

centive to hyper-inﬂate (overborrowing by irrespon-

sible emission) is enormous. While the information

about the distribution and the holders of cash is pri-

vate, its total amount should be public and veriﬁable.

The lack of transparency of emission, in the author’s

opinion, is among the primary reasons for the failure

of digital cash-like payment systems in the market.

In the rest of the paper, we develop a set of pro-

tocols that provide for all of the above characteris-

tics of a digital payment system under certain model

assumptions. The proposed system resembles the

one proposed by Jakobbson (Jakobsson, 1999) in that

it can be regarded as one with disposable anony-

mous accounts. Such disposable anonymous ac-

count based systems have achieved greater accep-

tance in the market (most notably WebMoney at

http://wmtransfer.com) than those based on

untraceable transfers between accounts tied to iden-

tity, but the current implementations either do not pro-

vide sufﬁcient security for high-value transactions or

impose too high overhead costs on low-value ones.

The system outlined in this paper permits the users

to choose the appropriate security measures that they

deem appropriate for the given transaction. This is

our principal contribution.

2 PRELIMINARIES

In the proposed system, the issuer I maintains a pub-

lic record of transactions, consisting of a chronologi-

cally ordered sequence of digitally signed statements

, where i = 1, 2, 3, . . . is called the serial number

of the statement. The serial number can be unambigu-

ously inferred from S

. Digitally signed means that

anybody can verify using only publicly available in-

formation in a computationally inexpensive way that

originates form I. Public-key signature schemes

such as those described in (R. L. Rivest, 1978; Elga-

mal, 1985; NIST, 1991) can provide for such func-

tionality in practice, together with some public key

distribution protocol. These implementation details

lie outside of the scope of this paper.

After some S

has been published, it can be veri-

ﬁed by anyone that for all i ∈ N

such that i < n,

has also been (previously) published and that dif-

ferent statements do not share the same serial number.

The structure of the statements is the following: S

(i, I, V

, C

, N

, Σ

) where Σ

= σ

(i, I, V

, C

, N

)

is the digital signature unique to the rest of S

and I.

Each statement implies the promise of issuer I to pay

units of value to anyone who ﬁrst responds to cryp-

tographic challenge C

(which requires the possession

of some secret D

). N

is the request message result-

ON DIGITAL CASH-LIKE PAYMENT SYSTEMS

ing in issuing S

that may be the response to some

earlier C

(where j < i). Note that in a practical im-

plementation the promise can be explicitly stated as

an additional piece of information within S

, signed

together with the rest.

The request message N

can be one of the follow-

ing ﬁve kinds:

1. E: emission request. In this case N

(E, C

, V

, Ω

) where C

is a new challenge, V

is the value of newly issued currency and Ω

(E, C

, V

) is the digital signature unique to the

rest of N

and J – an authorized individual. After

receiving N

, the issuer veriﬁes Ω

and the fact that

has never been used before. If the request is ac-

cepted, a new statement S

= (i, I, V

, C

, N

, Σ

)

is issued where i is just the next available serial

number at the time of receiving the request.

2. X : exchange request. In this case N

(X , j, C

, R

) where j < i, C

is a new challenge

and R

is the additional information making N

valid response to C

– an older challenge. After

receiving N

, the issuer veriﬁes whether or not it

constitutes the ﬁrst valid response to C

, and if it

does and C

has never been used before, the new

statement S

= (i, I, V

, C

, N

, Σ

) is issued. The

fact of issuing S

“invalidates” S

in that future re-

sponses to C

can be rejected by pointing to N

inside S

; a previous response.

3. M: merge request. In this case N

(M, j, k, R

) where j, k < i,R

is the additional

information making N

a valid response to C

–

an older challenge. After receiving N

, the issuer

veriﬁes whether or not it constitutes the ﬁrst valid

response to C

, and if it does and S

is a pending

promise in that it has not been fulﬁlled or super-

seded answering an earlier request, the new state-

ment S

= (i, I, V

, C

, N

, Σ

) is issued. The

fact of issuing S

fulﬁlls the promise of S

and su-

persedes the promise of S

thus “invalidating” both

of those.

4. S: split request. In this case N

(S, j, C

, V

, C

i+1

, R

) where j < i, C

and C

i+1

are new challenges, V

< V

and R

is the ad-

ditional information making N

a valid response

to C

– an older challenge. After receiving N

the issuer veriﬁes whether or not it constitutes

the ﬁrst valid response to C

, and if it does and

and C

i+1

have never been used before and

< V

then two new statements are issued:

= (i, I, V

, C

, N

, Σ

) and S

i+1

(i + 1, I, V

−

, C

i+1

, N

, Σ

i+1

). The fact of issuing S

or S

i+1

“invalidates” S

by fulﬁlling its promise. Note that

and S

i+1

can be reconstructed from one another

by I, thus the issuing of the two can be regarded as

an atomic operation.

5. I: invalidation request. In this case N

(I, j, Ω

′

, R

) where j < i and R

is the additional

information making N

a valid response to C

–

an older challenge and Ω

′

= σ

(I, j) is the digi-

tal signature of J – an authorized individual. After

receiving N

, the issuer veriﬁes Ω

′

and whether or

not N

constitutes the ﬁrst valid response to C

, and

if it does, the new statement S

(i, I, 0, C

, N

, Σ

)

is issued effectively invalidating S

and removing

the amount V

from circulation. N

constitutes a

proof that the promise of S

has been fulﬁlled (out-

side the payment system).

Since all S

statements are public, anyone can verify

that they follow the above speciﬁcation. Most impor-

tantly that the ones with X , M and S requests make

and fulﬁll promises of equal values. The amount of

issued currency can be calculated as follows:

V =

i:N

∈E

−

i:N

∈I

j(N

)

that is the summary value of emission requests minus

the summary value of invalidation requests. The abil-

ity of the issuer to live up to its outstanding promises

can be veriﬁed through traditional auditing.

3 TRANSACTION PROTOCOLS

A party in possession of D

is said to be the holder

of the (public) promise embodied in S

, unless that

promise has already been fulﬁlled or superseded.

Thus, it is the set of D

secrets that constitute the title

to certain value. The physical means of storing these

secrets does not really matter as long as it permits the

owner to protect the secrecy and to retrieve when nec-

essary. Because of this, anybody can hold such a cur-

rency who is able to store and retrieve small amounts

of information, allowing for the third property of cash

discussed in section 1. The “act of faith” mentioned

in conjunction with the fourth property of cash is in

this case believing that some D

indeed corresponds

to C

from S

which is indeed a statement issued by

the issuer.

In order to transact securely, the following capabil-

ities can be required:

1. Sending short messages to the issuer in a reliable

fashion and access to the public records with the

issuer’s public statements.

2. Verifying the digital signature of the issuer.

3. Generating random pairs of challenges C and cor-

responding secrets D required for a valid response.

4. Generating R

for a valid response to some C

once

in possession of the corresponding D

5. An established digital identity with the capability

of sending signed messages in a secure fashion.

ICETE 2005 - GLOBAL COMMUNICATION INFORMATION SYSTEMS AND SERVICES

3.1 Fund Transfer Without Receipt

In this scenario Alice (A) wants to transfer some V

amount of funds to Bob (B), but does not need a

proof for some third party that Bob has received the

funds; all she needs is to make sure that nobody else

but Bob receives the payment and she knows that it

has happened. For doing so, Alice only needs to pos-

sess some D

= {D

, D

, . . .} set of secrets so that

j∈k(D

)

≥ V that is she needs to have enough

funds.

1. A assembles a set D

= {D

, D

. . .} of se-

crets such that

j∈{m(D

)}

= V and a set

of corresponding serial numbers. If D

has

a suitable subset, then she can use that. If not,

she selects a subset D

⊂ D

(with a correspond-

ing serial number set J

) and an additional secret

∈ D

\ D

such that

j∈n(D

)

< V

and

j∈n(D

)

+ V

> V . Then she gen-

erates two new challenge-secret pairs (C

, D

)

and (C

, D

), and sends the message N =

(S, x, C

, V −

j∈{n(D

)}

, C

, R

) to I. At

this point, D

:= D

∪ {D

} and J

= J

∪ {i}

where i is the serial number of the statement that I

published in response to N.

2. A sends D

= {D

, D

, . . .} and J

, j

, . . .} to B.

3. B generates a set of new challenge-secret pairs

{(C

, D

), (C

, D

), . . .} with the same cardi-

nality as D

and J

. Then, for each D

∈

he sends the following message to I: N

(X , j

, C

, R

) where R

is calculated from D

and the rest of N

. His set D

= {D

, D

, . . .}

becomes a value worth V at this point. Using fur-

ther S and M messages, he can rearrange it in any

way he wants.

4. A can verify that the transaction has been com-

pleted by verifying that all the promises embodied

in {S

: j ∈ J

} have been fulﬁlled. If she is

convinced that the message to B has not been in-

tercepted, she can be also convinced that B took

possession of the transfered funds. However, she

has no means of proving this to a third party.

The above described transaction is in direct analogy

with cash transfers: ﬁrst A selected an appropriate

amount of cash from her wallet (possibly splitting a

large denomination at the bank to make sure she has

exact change), then handed it over to B, who ex-

changed all the received cash with the bank (so that

A doesn’t know the serial numbers of his banknotes).

This protocol is perfectly suitable for low-value

purchases (e.g. micropayment), as the computational

and communicational requirements on A’s part are

minimal. For example, if A has to pay for viewing

a webpage, and she has “exact change”, that is she

possesses some D

, such that the corresponding S

is a valid promise of the required value, all she has

to do is to enter D

(and x, if it cannot be retrieved)

when the website asks for payment.

Note, furthermore, that the transaction is initiated

by the sender, thus anybody can be paid in this fash-

ion; the na

ıve recipient can make an “act of faith” (be-

lieving that the honest sender “forgot” the secrets that

have been transfered) and use the received secrets as

payment without exchanging them with the issuer.

3.2 Fund Transfer With Receipt

For high-value transactions, the protocol described in

3.1 is unsuitable, because the recipient can deny the

receiving of funds without legal or reputational con-

sequences, as the sender has no means to prove it to a

third party. In the scenario described in this section,

Alice (A) wants to buy something expensive (worth

V ) from Bob (B).

1. B generates a challenge-secret pair (C, D) and

sends the signed invoice Y = (V, C, X, Θ) to A,

where X is the identiﬁer of the service that A wants

to buy from B and Θ = σ

(V, C, X) is the dig-

ital signature of the invoice by B. Y constitutes

a promise by B that upon receiving V amount of

funds in a way accessible to the holder of the secret

corresponding to C he will perform X.

2. A veriﬁes Θ and if it is correct, she assembles D

as in 3.1 and sends a sequence of messages to I.

The ﬁrst message is N

= (X , j

, C, R

)

where R

is calculated from D

and the rest

of N

. Let i

denote the serial number of

the statement published by I in response to N

is followed by a sequence of N

(M, j

, i

m(k−1)

, R

) for k = 2, 3, . . ..

3. At this point A is in possession of a conclusive

proof that she has fulﬁlled her side of the con-

tract: the pair P

= (Y, i

). The private in-

voice Y is signed by B certifying his offer, while

the public statement S

signed by I certiﬁes that

the corresponding payment has been made. The

two are linked by the equalities of V

= V and

= C. A sends P

to B.

4. B extracts V , C and Θ from the received P

, ver-

iﬁes Θ, downloads S

from the public records,

veriﬁes Σ

and checks whether V

= V and

= C. If everything matches, he performs X.

In case of dispute, A can show P

to the judge at

which point it is up to B to prove that X has been

performed.

ON DIGITAL CASH-LIKE PAYMENT SYSTEMS

4 ATTACKS AND

VULNERABILITIES

The security of the proposed payment system depends

on the nature of the used cryptographic challenges;

the actual objects behind C

, D

and R

and the way

the various messages are transfered between the var-

ious participants. Even without deﬁning these, it is

clear that the untraceability hinges on the fact that the

users of the payment system are not identiﬁed when

sending the messages (those denoted by N

) to the

issuer. This is weak anonymity and in this respect

the proposed system is inferior to the ones based on

blind signatures. However, it is not inferior to paper-

based cash and prevents the issuer from knowing the

turnover of the individual users, which the system de-

scribed in (D. Chaum, 1988) does not.

It is also very important to emphasize that the costs

of protecting oneself against fraud should not exceed

the transaction value. Since on-line payment systems

are often used for micropayment, it is important that

it can be performed with minimum effort and tools,

even at the cost of exposing oneself to fraud by a

highly sophisticated attacker. As long as the attack

costs signiﬁcantly more than the transaction value, the

payment system can be considered secure enough.

In this section, some attack and fraud scenarios are

investigated.

4.1 Theft

Successful theft is deﬁned as follows: attacker (T )

manages to make I issue a public statement S

so that

> 0 and D

corresponding to C

in known to T ,

even though T has not previously owned any secret

corresponding to the challenges on the already pub-

lished statements.

By deﬁnition, I issues public statements with V

0 only upon accepting E, X , M and S messages.

Thus, T needs to forge one of these.

The acceptance of E messages depends on the va-

lidity of Ω

. If the signature function σ is secure, then

forging the signature for an E message with a newly

generated C

is infeasible. Previous valid E messages

cannot be reused, because C

has to be new. Inter-

cepting and modifying a valid E message is similarly

computationally infeasible, if σ is secure.

X , M and S messages are accepted if they con-

stitute a valid response to some earlier challenge C

One way of forging such a message is by guessing

the secret that corresponds to one of the valid chal-

lenges. Let us assume that there is some maximal

reasonable complexity for the challenge and the prob-

ability of ﬁnding a corresponding secret by random

guess to such a challenge is p. Note that the secret is

not assumed to be unique to the challenge. If there are

n valid challenges, the probability of guessing one is

1 − (1 − p)

which if p ≪ n

−1

is approximately pn.

If T has the resources for trying m secrets, the prob-

ability of one of them corresponding to a valid chal-

lenge equals 1 − (1 − p)

which if p ≪ m

−1

is approximately pnm. If this number is comfort-

ably low, the system is secure against brute-force at-

tacks. However, since it is the users who generate the

challenge-secret pairs, I cannot protect them against

poorly chosen (low-entropy) secrets; having a weak

random source leaves one vulnerable to theft.

Another way of forging X , M or S messages is by

extracting a suitable secret from public information or

intercepted communication. In the public records, T

can ﬁnd a large number of challenge-response pairs

and this number is growing as the system is being

used. Thus, it is instrumental for the security of

the system that challenges and responses are uncor-

related.

Secrets are being communicated directly in the pro-

tocol described in 3.1. Hence, if T is able to intercept

and decode the messages that payers send to recip-

ients in this protocol, he is able to use them before

the recipient. Therefore, it is important that the se-

crecy of the communication between the users is well

protected in this protocol. Otherwise the payer is vul-

nerable to theft during the period of time when A has

already sent the message to B but B hasn’t yet sent

the messages to I. Na

ıve recipients who do not ex-

change the received secrets immediately are vulnera-

ble not only to fraud by the payer but also to theft if

the communication has been intercepted. Na

ıve pay-

ers using open channels of communication are vul-

nerable to theft for a short period of time, which for

micropayments can be a manageable risk worth tak-

ing, if using a secure channel is overly expensive.

In both protocols described in 3.1 and 3.2, one of

the parties sends messages to I. If such a message

) can be intercepted and decoded by T before it

reaches I, much depends on the nature of the crypto-

graphic challenge. In general, R

is the function of

some D

and the rest of N

. If it is feasible to com-

pute (or guess with a high probability) D

from N

or some R

′

so that substituting C

with C

′

(generated

by T ) and R

with R

′

results in a valid response to

before the message reaches I, then the parties are

vulnerable to theft. If it is not feasible to forge R

without knowing D

or to alter the message so that

′

remains a valid response to C

then the parties are

not vulnerable to theft in this way, even if the com-

munication with I can be intercepted, decoded and

tampered with.

4.2 User Fraud

User fraud is intentional deception of a user of the

payment system by another user assuming that the

ICETE 2005 - GLOBAL COMMUNICATION INFORMATION SYSTEMS AND SERVICES

issuer issues public statements only as described in

2. There are two meaningful deceptions within a

payment system: the paying party (A) fraudulently

claims that a payment has been made or the receiving

party (B) fraudulently claims that a payment has not

been received.

There are two distinct issues with fraud: whether

or not the other party can detect it and whether or not

it can be proven to a third party. Na

ıve users can be

defrauded in many ways. The present analysis is re-

stricted to participants that perform all the necessary

veriﬁcations in order to avoid being deceived.

In case of receiptless fund transfer as described

in 3.1, fraudulent claims (of both kinds) cannot be

proven to a third party, as none of the messages used

in the transaction can be linked to the involved parties.

However, A and B know exactly what has happened.

Thus, this protocol is suitable only for transactions

where one can afford the loss of one payment to es-

tablish the dishonesty of the other party.

The protocol described in 3.2 offers much better

protection against fraud for both users. In order to

claim a payment, A must produce P

. A valid P

where i(P

) and Y (P

) are such that C(S

) =

C(Y ), cannot be produced without actually transfer-

ring the right amount of funds into B’s exclusive pos-

session, assuming that Y (which is signed by B) can-

not be forged and some other Y

′

does not offer the

same service X. It is instrumental that X is unique to

each transaction. In order for A to be able to verify

the uniqueness of X, X may incorporate a signed or-

der of the service from A. P

is a conclusive proof

of the payment, disproving the fraudulent claim of B

that the payment has not been made. The proof of

rendering service X depends on the service and is not

part of the payment system.

The vulnerability of users to fraud by one another

does not depend on how the cryptographic challenges

are implemented, as long as it is computationally in-

feasible to respond to the challenge without knowing

the corresponding secret.

4.3 Issuer Fraud

By issuing digital currency, I is essentially borrow-

ing from all holders. In this framework, fraud can be

interpreted as misrepresenting one’s creditworthiness.

The public sequence S

, S

, . . . , S

is essentially I’s

credit history. There are two kinds of meaningful de-

ceptions when it comes to credit: borrowing more or

defaulting on (parts of) existing debt without leaving

a trace in the credit history. Since in the proposed

system the act of borrowing (issuing) is the same as

the act of publishing it (Grigg, 2004), the ﬁrst kind of

fraud is impossible by deﬁnition.

Thus, we can deﬁne successful issuer fraud as fail-

ure to respond to user messages as deﬁned in 2. It

is important to emphasize that the defrauded party is

not the one who has sent the message that has not

been appropriately processed but all the holders of I’s

“currency”. Before going into more detailed analysis,

it is worth noting that the messages do not contain

information regarding their origin, thus if I attempts

fraud, it can never be sure that it is not a spot-check

by an auditor or the law enforcement. Thus, there are

strong incentives not to commit fraud when dealing

with anonymous customers.

The ﬁrst important observation is that I can ignore

the received messages; pretend as if they have not

been received. It is the information carrier service

that can provide various facilities to prevent this from

happening without a trace, but most carriers do not

provide them.

Secondly, the issuer can obviously do anything to a

message that an attacker described in section 4.1 can.

Thus, all the vulnerabilities mentioned there apply;

theft can be perpetrated by I under the same condi-

tions. The only difference is that I can operate with I

requests as well.

If the cryptographic challenge is implemented in

such a way that a valid response does not divulge the

secret or allow for altered valid responses (see also

4.1), the customer (A) can accuse I by publishing the

message (N) that has been supposedly ignored by I.

Of course, it has no immediate consequences for I, as

A could not have transfered the message previously,

but after N has been published, I can disprove the

accusation of fraud by processing N.

5 SUITABLE CRYPTOGRAPHIC

CHALLENGES

In this section, some cryptographic challenge imple-

mentation are proposed and their advantages and dis-

advantages explained. Since it is the legitimate holder

of the value who picks the corresponding challenge,

it is possible to implement more challenges and let

the users decide which ones they deem appropriate

for protecting their wealth and privacy.

This list is by no means comprehensive. New kinds

of challenge-response pairs are being developed, ful-

ﬁlling various requirements resulting from different

assumptions about the capabilities of the paying and

the receiving party.

5.1 Message Digest (Hash) Function

Challenge: C = h(D), an element from the range of

the hash function

Secret: D, a random element from the domain of the

hash function

ON DIGITAL CASH-LIKE PAYMENT SYSTEMS

Response: R = D same as the secret. Valid if

h(R) = C.

In this case, the challenge is the cryptographic hash

(e. g. the SHA1

(NIST, 1995)) of the secret, which

is chosen randomly from a large enough pool, so that

the probability of guessing it is sufﬁciently low. The

valid response to the challenge is simply a message

including the secret itself.

The advantages of this implementation are the fol-

lowing: It is very simple and computationally un-

demanding, offering good protection with relatively

short secrets (e.g. 200 bits), that can be transfered

using very narrow channels (e.g. speech, barcodes,

typing, etc.). It is easy to compute the challenge cor-

responding to the secret, which in turn can be used as

the key of the public statement database. Hence, it is

not necessary to store the index of the corresponding

statement together with the secret.

The disadvantage is that the response reveals the se-

cret, thus leaving the payer vulnerable to theft, when

communicating with the issuer over an insecure chan-

nel.

5.2 Public Key Signature

Challenge: C = K, a public signature key

Secret: D = K

′

, the private pair of K

Response: R = σ

′

), the digital signature of the

message.

In this case, the challenge is a public signature key

(e.g. an RSA or a DSA public key (NIST, 1991;

R. L. Rivest, 1978)) and the secret is its private pair.

The two are selected randomly by the customer from a

large enough pool, so that the probability of guessing

is sufﬁciently low. The valid response is a message

with a valid digital signature.

The advantages are the following: The secret is not

revealed by the response, thus the ownership can be

proved without disclosure. It is secure against theft

even if the communication channel is insecure. It is

secure against theft by the issuer.

Disadvantages: The secret is too long to be trans-

fered though low-capacity channels or to be recorded

quickly using low-tech means (e.g. scribbled down on

At the time of writing, the collision attack against

SHA1 by Wang et al. was not known. However, even a

successful collision attack against the hash function used in

this implementation (and the ones below) does not allow,

to the author’s best knowledge, for attacks against the pro-

posed payment system, as long as ﬁnding pre-images for

a given hash value is infeasible, so even in the light of re-

cent developments, it is safe to use SHA1 for this purpose.

Nevertheless, it may be wise to consider alternatives. Colli-

sion attacks against the hash function used as part of the σ

function (from Section 2) can be more worrisome.

a piece of paper). The transactions are computation-

ally costly. In particular, generating a secure random

key-pair takes minutes even on a modern computer.

Elliptic Curve Cryptography (ECC) promises to al-

leviate these problems to some extent by providing

equivalent security with shorter keys.

Note that it is possible to use a blinding scheme

compatible with this type of challenge to break trace-

ablity. The real difﬁculty in this case is preserving

the accountability of the issuer. A scheme similar to

the one proposed in (M. Stadler, 1995) could be uti-

lized as a disincentive for the issuer to issue unbacked

“coins”.

5.3 Public-Key Signature and

Message Digest

Challenge: C = h(K), the one-way hash of the pub-

lic signature key

Secret: D = (K, K

′

), a public/private key pair

Response: R = (σ

′

), K), a digital signature

and the corresponding public key

This modiﬁcation of the previous scheme allows for

seamless integration with the scheme described in

5.1, as the challenge has the same format. Thus, the

same system can easily provide for both kinds of chal-

lenges. The advantages and the disadvantages are the

same as those in 5.2.

An additional advantage is that the public key is

not available for cryptanalysis by an attacker until too

late. Since the key has to be used only once for gen-

erating exactly one signature, it can be substantially

weaker than the one required for the previous case,

allowing for a decrease in the required computational

power on the user side even with traditional asymmet-

ric cryptography.

5.4 Public-Key Signature and

Symmetric-Key Block Cipher

Challenge: C = (K, ρ

′

)), a public signature

key and the encrypted version of its private pair

Secret: D, a randomly chosen symmetric key for the

block cipher ρ.

Response: R = σ

′

), the digital signature of the

message

In this case, the challenge consists of a public signa-

ture key and its private counterpart encrypted using a

symmetric-key block cipher ρ (e.g. ). The secret D is

the symmetric key needed to decrypt the private key

′

. The valid response is the same as in 5.2.

The advantage of this challenge over the one de-

scribed in 5.2 is that the secret is short and thus can

ICETE 2005 - GLOBAL COMMUNICATION INFORMATION SYSTEMS AND SERVICES

be transfered and stored easily using low-tech means,

similarly to 5.1. However, the challenge cannot be

deduced from the secret, thus one needs to record the

index of the corresponding public statement as well.

5.5 Message Digest, Public-Key

Signature and Block Cipher

Challenge: C = (h(D), K, ρ

′

)), a hash of the

secret, a public key and the encrypted version of its

private pair

Secret: D, a randomly chosen symmetric key for the

block cipher ρ.

Response: R = σ

′

) or R = D, the digital sig-

nature of the message or the secret itself

In this case, the challenges described in sections 5.1

and 5.4 are used in conjunction, so that a valid re-

sponse to either one is accepted. The corresponding

secret is the same.

The advantages of this approach include all the ad-

vantages of the two methods, with the exception of

computational simplicity offered by 5.1; generating a

random challenge is still difﬁcult.

It is up to the individual customers to chose which

part of the challenge they use, depending on the avail-

able facilities and security requirements.

6 CONCLUSIONS

The proposed digital payment system is more sim-

ilar to cash than the existing digital payment solu-

tions. It offers reasonable measures to protect the pri-

vacy of the users and to guarantee the transparency

of the issuer’s operations. With an appropriate busi-

ness model, where the provider of the technical part

of the issuing service is independent of the ﬁnancial

providers and serves more than one of the latter, the

issuer has sufﬁcient incentives not to exploit the vul-

nerability described in 4.3, even if the implementation

of the cryptographic challenge allowed for it. This

parallels the case of the issuing bank and the printing

service responsible for printing the banknotes.

The author believes that an implementation of such

a system would stand a better chance on the market

than the existing alternatives, none of which has lived

up to the expectations, precisely because it matches

paper-based cash more closely in its most important

properties.

Open-source implementations of the necessary

software are being actively developed as parts of the

ePoint project. For details, please see

http://sf.net/projects/epoint

REFERENCES

A. Lysyanskaya, Z. R. (1998). Group blind digital signa-

tures: A scalable solution to electronic cash. In Pro-

ceedings of Financial Cryptography: Second Interna-

tional Conference (FC’98), page 184.

Brands, S. (1993a). An efﬁcient off-line electronic cash sys-

tem based on the representation problem. Technical

Report CS-R9323, CWI.

Brands, S. (1993b). Untraceable on-line electronic cash in

wallets with observers. In Advances in Cryptology,

CRYPTO ’92, pages 302–318. Springer-Verlag.

Chaum, D. (1992). Achieving electronic privacy. Scientiﬁc

American, pages 96–101.

D. Chaum, A. Fiat, M. N. (1988). Untraceable electronic

cash. In Advances in Cryptology, CRYPTO ’88, pages

319–327. Springer-Verlag.

Elgamal, T. (1985). A public-key cryptosystem and a sig-

nature scheme based on discrete logarithms. IEEE

Transactions on Information Theory, IT-31:469–472.

Grigg, I. (2004). The ricardian contract. In Proceedings

of IEEE Workshop on Electronic Contracting July 6,

pages 25–31.

Jakobsson, M. (1999). Mini-cash: A minimalistic approach

to e-commerce. In Proceedings of the Second Inter-

national Workshop on Practice and Theory in Public

Key Cryptography, pages 122–135.

M. Stadler, J.-M. Piveteau, J. C. (1995). Fair blind signa-

tures. In Advances in Cryptology, EUROCRYPT ’95,

volume 921, pages 209–210. Springer-Verlag.

NIST (1991). Proposed federal information processing

standard for digital signature standard (dss). Federal

NIST (1995). Secure hash standard. FIPS 180-1.

R. L. Rivest, A. Shamir, L. A. (1978). A method for ob-

taining digital signatures and public-key cryptosys-

tem. Communications of the ACM, 21:120–126.

ON DIGITAL CASH-LIKE PAYMENT SYSTEMS