Trustee Tokens

Embed Size (px)


Trustee Tokens. Simple and Practical Anonymous Digital Coin Tracing. Ari Juels RSA Laboratories. Quick Review of Chaumian E-cash (DigiCash TM ). Signs. BANK. Alice. PK. SK. Alice -$1. Anonymous digital $1 coin. r 3 f(x). 3. Signs. BANK. rf 1/3 (x). = (x, Sig(x)) =. r 3 f(x). - PowerPoint PPT Presentation

Text of Trustee Tokens

  • Trustee TokensSimple and Practical Anonymous Digital Coin TracingAri Juels RSA Laboratories

  • SKPKAlice -$1Anonymous digital $1 coin

  • r, x SKPKmod n

  • An Application for Anonymous E-Cash An Application for Anonymous E-Cash

  • Improved Computer VirusEdgar

  • Improved Computer Virus

  • Hard Disk

  • FilesPK

  • Ransom Note

  • Oh, my files!Alice -$1


  • Anonymous coinEdgar

  • How can we prevent this?

  • The Idea: Trustee TracingAnonymous coin

  • Tracing: Basic IdeaAnonymous coinJudge

  • Coin is anonymous unlesstrustee traces it

  • Many Trustee-based Tracing SchemesBrickell et al. ( 95)Stadler et al. (95)Jakobsson and Yung (96, 97)Camenisch et al., Frankel et al. (96)Davida et al. (97)

  • Trend in schemesSecurityFeaturesSimplicityTrusteeFlexibilityComputationalEfficiency

  • How our scheme works

  • Two stages1.Token withdrawal2.Coin withdrawal

  • Token withdrawalChecks thatcoin contains[Alice]PK

  • Trustee TokenChecks thatx contains[Alice]PK

  • SKCoin withdrawalConditionally anonymous digital coin

  • Observe: No change in coinstructure or underlying withdrawal protocol

  • TracingTrustee Token scheme guarantees that coins contain creator identity

  • Blackmail scenarioEdgar registers his coin and gets caught orAlice cant make the withdrawal for Edgar

  • Enhancements

  • No coin storageAlice can pseudo-randomly generate coins and blinding factors -- no coin storage

  • Bulk token withdrawalAlice can withdraw many tokens at once and store prior to coin withdrawals

  • One token - multiple coins

  • Result of EnhancementsLittle interaction with Trustee

  • Pros and Cons

  • Advantages over other schemesVery simpleProvably secureNo change in coin structure, underlying protocolSeamless incorporation with DigiCashTM

  • DisadvantagesTrustee interaction neededSecurity with multiple trustees needs trusted dealer Seamless incorporation with DigiCashTM - but no DigiCashTM

  • But...Can be used for general blind RSA E.g., X-cashMethod can perhaps be extended to other e-cash systems (?)

  • Questions?