Recent Advances in Electronic Cash Design

Electronic cash (or e-cash) is an electronic payment solution that is usually viewed as an attempt to emulate electronically the main characteristics of regular cash. In particular, e-cash and other payment solutions should protect the privacy of users during a purchase. The main distinction of e-cash with respect to other electronic payment systems is that electronic coins are stored on a device controlled by the user, e.g. a smart card or a personal computer hard disk. Since the introduction by Chaum [10,11] of unconditionally untraceable electronic money, ecash systems have been extensively studied. Recent work has mainly focused on the efficiency of the protocols with respect to several notions of anonymity. In this talk, we will review the main recent results and also discuss the possibility to transfer a coin without involving the bank which is considered as an important characteristic of regular cash. 1 Overview of e-Cash Schemes E-cash systems usually assume that the same bank is responsible for giving out electronic coins and for later accepting them for deposit. Users can download a number of electronic coins from the bank using a withdrawal protocol, and next pay one or more merchants with them in a spending protocol. Merchants can later exchange electronic coins for regular cash on their bank account using a deposit protocol. As it is easy to duplicate electronic data, an e-cash system requires a mechanism that prevents a user from spending the same coin twice without being identified, and it must also prevent a merchant from depositing the same coin twice. E-cash systems allow merchants to check the validity of coins, whereas the detection of double spending is performed by the bank. Indeed, double-spending cannot be checked by the merchant during a payment protocol, as the coins delivered by the bank can be spent at several merchants. E-cash systems can be categorized into two groups according to whether the bank is on-line or not in the spending protocol. In on-line e-cash, a merchant only accepts a coin if the bank confirms that the coin has not been previously spent, and the deposit protocol must be performed immediately after the spending protocol. This scenario is often considered as being very restrictive in practice, especially for low-value payments. In off-line e-cash, the merchant does not need to interact with the bank before accepting a coin from the user. Indeed, during G. Grimaud and F.-X. Standaert (Eds.): CARDIS 2008, LNCS 5189, pp. 290–293, 2008. c © IFIP International Federation for Information Processing 2008 Recent Advances in Electronic Cash Design 291 the spending of a coin, the merchant only checks the validity of the coin. Nevertheless, the merchant is guaranteed that the bank will accept the coin or the bank will be able to identify and punish the cheater. E-cash should provide user anonymity against both the bank and the merchant during a purchase in order to emulate the perceived anonymity of regular cash transaction. When a double-spending is detected, the identity of the cheater must be retrieved. Off-line e-cash schemes can also be categorized into two groups according to whether the revocation of the cheater identity is either done by a trusted party, e.g. a judge, (in this case the revocation of the spender identity is always “technically feasible” by the trusted party), or technically possible only in case of a double-spending. The main security properties usually considered in e-cash schemes are the unforgeability of coins, the anonymity of users, the unlinkability of spends, the identification of double-spenders and the impossibility for the bank to falsely accuse (with a proof) honest users. Many e-cash schemes have been proposed in the literature, which fulfill some of the security properties previously mentioned, in the on-line or off-line setting, involving a judge or not. Only few of them consider the possibility to transfer a coin from a user to another user without involving the bank. 2 Towards a Practical e-Cash Scheme Most recent work has focused on the efficiency of protocols, i.e. the efficiency of the algorithms executed during a protocol and the compactness of the data exchanged between all actors. A major challenge in e-cash is to provide an efficient solution to spend several coins at the same time, i.e., more efficiently than iterating the spending protocol over each coin”. The main significant improvement has been done by Camenisch et al. [4] by introducing the compact e-cash scheme that allows a user to withdraw efficiently a wallet containing 2 coins such that the space required to store these coins and the complexity of the withdrawal protocol are proportional to (L+k) rather than (k · 2), where L is a fixed parameter of the system and k is a security parameter. This scheme fulfills the anonymity and unlinkability properties usually required for electronic cash systems. The main drawback of the compact e-cash system is that it does not address the possibility for spending several coins at the same time without iterating the execution of the spending protocol. We will review recent improvements and variants of the compact e-cash scheme that have been proposed [19,7,3,1]. Divisible e-cash schemes attempt to address the problem of the divisibility of a coin by allowing a user to withdraw a coin of monetary value 2 and then to spend this coin in several times by dividing the value of the coin. The aim is to allow a user to spend a coin of monetary value 2 more efficiently than repeating 2 times a spending protocol. Many off-line divisible e-cash systems have been proposed in the literature (e.g. [17,13,14,16,9,15,5,2]). We will review the main advantages and drawbacks of theses schemes.