1 O - Line Cash Transfer by Smart Cards Stefan

An oo-line electronic cash system is presented that ooers appreciably greater security and better privacy than currently considered electronic cash systems with similar functionality. A tamper-resistant smart card, issued by the bank, controls a counter that represents the amount of electronic cash carried by the user. The use of a counter ensures that the computation and communication complexity for paying an amount are independent of the speciic amount due, and that conversions between multiple currencies can be made at payment time. Smart cards can transfer electronic cash to POS terminals that need not be physically secured by the bank, without needing on-line veriication. To ensure privacy of payments, the user can insert his smart card into a user-controlled computer, such as a palm top computer or a personal computer, which acts as an intermediary between the smart card and the other party involved in the transaction. Cryptographic software in the user-controlled computer ensures that payments are information-theoretically untraceable and unlinkable. To pay any speciied amount, only 125.5 bytes of data must be transferred, and no on-line computation is required. The dynamic storage requirements per payment can be compressed to a mere 26.5 bytes for the user-controlled computer, and virtually none for the smart card. The smart card can be a smart card capable of performing the well-known Schnorr signature scheme; minor additions to the smart-card code suuce to suit the cash system requirements. Moreover, a simple optimization allows eecient implementation even when widely available smart cards with ordinary 8-bit microprocessors are used. Assuming that the tamper-resistance of the smart cards cannot be broken, the system is provably as hard to break as the Schnorr signature scheme. A build-in mechanism for traceability of double-spent transaction data, which is as hard to break as the blinded Schnorr signature scheme, ensures that the cost of breaking a smart card in practice will signiicantly exceed the expected nancial proot that the attacker can make from this.