Fair Oo-line E-cash Made Easy

The major considerations in designing a secure system are (1) simplicity of the algorithms involved, (2) eeciency of the implementation, and (3) provable security; these attributes contribute to the \elegance" of a system, easing its implementation (and limiting the possibility of errors) and the burden on system resources. Anonymous oo-line electronic cash (e-cash) systems provide transactions that retain the anonymity of the payer, similar to physical cash exchanges, without requiring the issuing bank to be on-line at payment. Fair oo-line e-cash extend this capability to allow a qualiied third party (a \trustee") to revoke this anonymity under a warrant or other speciied \suspicious" activity. In fair oo-line e-cash, simplicity and eeciency are of high importance, as the systems are inherently complex and prone to design and implementation errors. Security must also be guaranteed yet, to date, there have been no systems that ooer provable security. In this work we make a step towards \elegant" fair oo-line e-cash by proposing a system which is provably anonymous (i.e., secure for legitimate users) while its design is simple and its eeciency is similar to the most eecient systems to date. Security for the bank and shops is unchanged from the security of non-traceable e-cash. We also present ways to adapt the functionality of \fairness" into existing (legacy) e-cash systems in a modular way, thus easing advancement and maintaining version compatibility ; these extensions are also provably anonymous. We prove anonymity based on the decision Diie-Hellman assumption. This assumption has been used recently for other purposes, such as implementations of unconditionally-hiding hash functions.