CS 161 Computer Security
Fall 2005 Joseph/Tygar/Vazirani/Wagner Notes 20
In this lecture we will explore some issues in implementing a digital form of cash - ecash. We normally
think of cash as paper money or coins issued by the treasury or a central bank. Can the assurances normally
assumed for cash be made to carry over to the digital domain in the form of a sequence of bits? To explore
some of the issues that arise in this context, let us consider a protocol involving three players: the customer,
the merchant and the bank. The outline of the protocol we would like to implement is as follows:
The customer, Alice, interacts with the bank to withdraw some cash. She then interacts with the merchant,
exchanging the cash for some goods. The merchant, Bob, then interacts with the bank to deposit the cash in
his account.
A first attempt at implementing this protocol might look like this:
1. The bank sends Alice a digital $1 bill. This might be a message signed with the bank’s RSA private key
saying ”serial number x. This is a $1 bill.”
2. Alice sends the cash to Bob in exchange for goods.
3. Bob later deposits the cash into his account at the bank.
There are several problems with this protocol.
• It is not anonymous. The bank gets to keep a record of all of Alice’s spending.
• Double spending. Since the cash is digital in nature, Alice can easily duplicate it and spend the same
$1 bill again with another merchant, Carol.
Blind Signatures:
One of the key building blocks to achieve anonymity is a blind signature. Recall that RSA signatures require
the signer to compute mdmod N, where (d,N)is the private key and (e,N)is the public key.
A blind RSA signature is carried out as follows:
• Alice sends Bob s= (rem)mod Nwhere ris a random number mod N.
• Bob computes t=sdmod Nand sends the result to Alice.
• Alice computes t/rmod N=mdmod N.
The point is that t=sd= (rem)d=rmdmod N. A blind signature allows Alice to obtain Bob’s signature on
a message of her choice, without Bob having any idea what the message being signed is.
Proposal 1:
Alice and the bank will use blind signatures to collectively create a $1 bill signed by the bank, but one which
the bank will not recognize as coming from Alice.
In this scheme, a valid $1 bill is a pair (x,y)where y=f(x)dmod N. Here f() is a one-way function (ideally
a one-way hash function). (e,N)is the bank’s public key and (d,N)is the private key.
CS 161, Fall 2005, Notes 20 1
