Digital Cash

• What I really like about encryption is the fact that clever uses of encryption can make seemingly impossible forms of communication feasible.

• One potentially nasty feature of using credit cards rather than cash is that the credit card company can keep a record of everything you buy using your card.

• As catalogs go on-line, it seems likely that more and more purchases will be paid for using electronic devices and credit-card like systems.

• The interesting question is whether there is anyway to produce the equivalent of digital cash. That is, provide a way that you can go to your "bank", withdraw money from your account, and in return receive a message which you can spend without identifying yourself but which you can only spend once.

• The key to solving this problem is to think of the fact that current paper currency carries both a serial number and a denomination. We will devise a scheme by which a bank can give you a digital message with both a serial number and a denomination. Things just need to be arranged so that the bank knows who you are when it gives you the denomination, but does not know your identity when giving you the serial number.

• Part of the secret to the solution is to have the bank use several keys. One key will be used to sign serial numbers. In addition, the bank will have a series of other key pairs used to sign "bills" of different denominations.

• The final secret is to assume the encryption and decryption processes are communative, even when using several distinct keys. That is, if you and I both encrypt a message, we can apply our decryption algoritms in either order to get the plaintext back.

• The steps are roughly:

  • Have the bank provide a server that will respond to anonymous requests for signed serial numbers.

  • Have the bank also provide a withdrawal server. To make a withdrawal a customer must:

    • Identify him/herself.

    • Specify the amound to withdraw (in one of a relatively small number of provided denominations).

    • Present a signed serial number encrypted with a key unknown to the bank.
    The bank must:

    • Verify that you have the money,

    • Sign the encrypted certificate with the key for the denomination requested.
    The customer must then decrypt the message so that it is now simply double signed by the bank.

    Anyone you try to pay with this money can:

    • Use the banks public keys to determine the denomiations.

    • Ask the bank if it is still valid by sending the bank the serial number.

    • Deposit it in their own account by sending the message to the bank and identifying themselves. (At this point, the bank will mark the serial number as "spend/invalid").