Sebery J.Cryptography.An introduction to computer security.1989

There is a problem, however, when both Alice and Bob conspire and Bob uses the same challenge string e for two di erent transactions or, equivalently, Bob tries to deposit the same coin twice. Another face of this problem is the case when Alice spends the same coin twice with di erent sellers who agreed to use the same challenge string e. A simple solution would be to divide the challenge string e into two parts: xed and random. Each seller would have di erent xed part (imposed by the bank). This would exclude the collusion among buyers and sellers.

15.2.2 Divisible Electronic Cash

This protocol was invented by Okamoto and Ohta [391]. The bank applies a collection of RSA schemes determined by triples (ej; dj; Nj) for j = 0; : : :, where ej ; dj are the encryption and decryption keys, respectively, and Ni is an RSA modulus. The RSA system (e0; d0; N0) is used to generate electronic licences for Bank clients. The other RSA systems are used to generate electronic banknotes (coins) of speci c values. For example, the RSA system (e1; d1; N1) is used to generate electronic coins each of value $100, the RSA system (e2; d2; N2) to issue $50 bills and so on. Needless to say, the bank announces public parameters (ej; Nj) of the RSA schemes. Also, there is a public knowledge about which RSA scheme is to be used to produce coins of given value.

A buyer Alice has an account uA with the bank and generates her RSA scheme (eA; dA; NA). The pair (eA; NA) is public.

An important ingredient of the payment system is a tree structure of coins (bills). Before we show how to design such a tree, we need to introduce some Number Theory facts. Let z 2 ZN be an arbitrary integer and the modulus N = pq such that p 3 mod 8 and q 7 (mod 8). Such N is called a Williams integer. Then it is relatively easy to show that among the elements of the set

fz; z; 2z; 2zg

512 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

00 = h 01=2iQ. The right child 01 = h 0 01=2iQ, where 0 is an integer generated by a suitable hash function f . Now, children become parents and generate their own pairs of children in the same way. The process continues until the necessary depth of the tree is achieved. Note that all nodes in the tree are quadratic residues (belong to ZNQ+).

Registration (Alice $ Bank).

This stage of the protocol is executed once only when Alice wishes to open her account with the bank. The bank issues a license B.

1. Alice picks up at random (ai; i) for i = 1; : : : ; n where n is the security parameter, i is an RSA modulus (i.e. i = pi qi is a Williams integer or pi 3 mod 8 and qi 7 mod 8).

2. Alicewhere! Bank : fwi; i = 1; : : : ; ng,

s2i1 mod i.

3.Bank chooses at random n=2 indices. Let the collection of indices be R and Bank ! Alice: R.

4.Alice displays all the parameters used to generate wi for which i 2 R. In other words, Alice shows ai; pi; qi; g(uAkai)dA ; ri for all i 2 R.

5.Bank veri es the correctness of all wi for i 2 R. If they are not valid, Bank aborts the protocol. Otherwise, the protocol is continued.

6.Bank ! Alice: Qi2R= wid0 mod N0.

7.Alice extracts her licence by using inverses ri 1 so

B = Y g( ik i)d0 mod N0:

i2R=

We simplify our notation by assuming that B = Qn=i=12 g( ik i)d0 mod N0.

Issuing a coin (Alice $ Bank).

Assume that Alice wishes Bank to issue a bill of value $x. Bank nds the RSA scheme associated with this value, let it be determined by the triple (ex; dx; Nx).

1.Alice selects two random integers b and r and Alice ! Bank : Z rex g(Bkb) mod Nx.

2.Bank ! Alice: Zdx mod Nx

and charges Alice's account x dollars.

3.Alice extracts the coin

C = r 1Zdx g(Bkb)dx (mod Nx):

Payment (Alice $ Bob). Parties use three public collision-resistant hash functions: f , f and f .

1. Alice computes top nodes (at the level 0) of her coin treesi;0 = hf (C k 0 k i)iQ mod i

for i = 1; : : : ; n=2. Next she computes two children of i;0. The left child is

1

i;00 h i;20iQ mod i

and the right child is

1

i;01 h i;0 i;20iQ mod i

where i;0 = hf (C k 0 k i)i+. The process continues in the same way. The node i;00 has two children i;000 and i;001 and i;01 has its children i;010 and i;011. For the sake of clarity, the rest of the protocol is described for a case when Alice wants to pay $75 using a $100 coin C. Instead of nding the whole coin trees, Alice needs to nd two nodes (in independent tree paths) whose sum is equal to $75. Let those nodes be:

1

i;00 h i;201iQ mod i worth $50i;010 h i;201iQ mod i worth $25

Next she computes their square roots whose Jacobi symbols are equal to 1 thus:

Xi;010 = h i;2010i h i;20 i;80i mod i

2. Alice ! Bob: (B; C; f( i; i; Xi;00; Xi;010); i = 1; : : : ; n=2g)

514 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

3.Bob veri es the licence B and the coin C. Further Bob checks whether for all i = 1; : : : ; n=2, the following conditions hold:

If any of the checks fails, Bob aborts the protocol. Otherwise, Bob continues.

4.Bob ! Alice: f(Ei;00; Ei;010); i = 1; : : : ; n=2g where Ei;00; Ei;010 2R f0;1g for all i.

5.Alice calculates

If the checks hold Bob accepts the payment of $75.

Deposit (Bob $ Bank).

1.To deposit $75, Bob sends a transcript of interactions with Alice. The transcript (history) is veri ed by Bank and if the checks hold, then Bank credits $75 to Bob's account. If the payment is invalid, Bank reveals Alice's secret information si.

The major problem of the payment scheme is its low eÆciency. The payment involves transmission of a large volume of data. Okomoto [390] suggested a modi cation that is more eÆcient. In this protocol, however, Alice can cheat at the registration stage [80].

15.2.3 Brands Electronic Cash Protocol

Brands [57] used the intractibility of Discrete Logarithm to design an electronic cash system. The protocol handles coins of the same value, say $1. All computations are done in the group Zq ; q is a large enough prime. Bank sets up the protocol. It picks up at random three generators (g; g1; g2) of Zq and selects a secret x 2R Zq 1 together with two collision-resistant hash functions H and H0. Bank publishes (g; g1; g2), q and the descriptions of the hash functions. The integer x is kept secret but its exponent h = gx is a public key of the bank.

Registration (Alice $ Bank).

1.Alice identi es herself to Bank.

2.She generates her secret integer u1 2R Zq 1 and computes her account number

I = g1u1

If Ig2 6= 1, Alice gives I to Bank while keeping u1 secret. 3. Bank ! Alice: z = (Ig2)x.

Issuing a Coin (Alice $ Bank).

1.Alice identi es herself to Bank.

2.Bank ! Alice: (a = gw; b = (Ig2)w) for w 2R Zq 1.

3.Alice chooses at random (s; x1; x2) and computes

A = (Ig2)s; B = g1x1 g2x2 and z0 = zs:

Next, Alice selects two integers u; v and computes a0 = augv and b0 = bsuAv:

Then she nds out c0 = H(A; B; z0; a0; b0).

4.Alice ! Bank: c = cu0 ,

where u is a blinding integer.

5.Bank ! Alice: r = cx + w

and withdraws $1 from Alice account.

r1 r2 ? d

g1 g2 = A B:

Bob saves (C; r1; r2; date/time).

Deposit (Bob $ Bank).

1.Bob ! Bank: (C; r1; r2;date/time).

2.Bank recalculates d from the information given by Bob and veri es whether

b)Otherwise, the coin has been deposited already. In this case Bank takes

the current transcript (C; r1; r2; date,time) and the previous (C; r10 ; r20 ; date0; time0) recomputes d and d0, creates a system of four equations in four unknows in GF(q):

The above protocol can be modi ed for electronic wallets with observers [57]. An electronic wallet is a collection of a user-controlled computer with a tamperproof unit (such as a smart card) also called an observer [91]. It can be argued that the collection is more secure than the computer or observer individually. It is assumed that an organization communicates with the computer and accepts only those messages that have been approved by the observer. Observer cannot directly talk to the organization. The concept of electronic wallets can be used to design cryptographic protocols that are secure against:

1.In ow { if the computer follows the protocol, the organization cannot send any extra information to the observer no matter how the organization and the observer deviate from the protocol.

2.Out ow { if the computer follows the protocol, the observer cannot send any extra information to the organization no matter how the organization and the observer deviate from the protocol.

15.2.4 Other E-Cash Protocols

The Brands e-cash drops the cut and choose method to formulate coins. This obviously is re ected in increased eÆciency. Similar system of e-cash was also designed by Ferguson [177].

Anonimity of e-cash discussed so far is tied up with prevention against multiple spending. It can be argued that in some circumstances anonimity can be a problem, especially when criminals try to exploit it to their advantage. von

518 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

Solm and Naccache [515] discussed such scenarios, including perfect blackmailing and money laundering. To relax anonimity of e-cash, Brickell, Gemmell, and Kravitz [62] introduced a trusted party who collaborates during the generation of coins. The party together with Bank can later cooperate to trace the origin of coins. This is e-cash with escrowing. Jakobsson and Yung [259] showed how an Ombudsman may be involved in the e-cash protocol to ensure tracability. M'Raihi [359] presented an eÆcient e-cash with a blinding oÆce that plays the role of independent (from Bank) party who on a valid court order can together with Bank suppress anonymity of coins.

15.2.5 Micropayments

E-cash requires a substantial computational overhead that is an over-kill for payments of small charges, say cents per transaction. An example of such transactions includes reading a WWW site, sending a short e-mail, or using white or yellow pages on the Internet. To support micropayment, the cash generation, withdrawal, and deposit must be signi cantly simpli ed so the computational overhead is not expensive. Typically, generation of a one-cent coin should not cost more than several percent of its nominal value. The most expensive operations are digital signatures so micropayment protocols substitute digital signatures by a much cheaper hashing whenever it is possible.

Parties involved in a micropayment protocol are clients, vendors, and a bank. Vendors provide services for which clients pay small fees. The bank registers clients and vendors, maintains their accounts and debits/credits their accounts. Consider a micropayment protocol, called PayWord, introduced by Rivest and Shamir in [427]. Clients, vendors and Bank have their secret and public keys used for digital signatures. H is a collision-resistant hash function. The PayWord protocol involves a client (Alice) a vendor (Bob) and Bank.

Registration (Alice $ Bank).

1.Alice identi es herself to Bank, opens her account and applies for a PayWord certi cate.

2.Bank ! Alice: CR = (m; SGB(m))

where m = (Bank-ID, Alice-ID, KA, expiry date), SGB(m) is a signature generated by Bank for the message m and KA is the public key of Alice.

Payment (Alice $ Bob).

1.Alice creates a chain of paywords (each payword is worth 1 cent) w1; w2; : : : ; wn where

wi = H(wi+1)

and wn is a random payword. The element w0 = H(w1) is a commitment or root of the chain.

2.Alice ! Bob: (w0; SGA(Alice-ID, Bob-ID,w0, time))

where SGA(Alice-ID, Bob-ID,w0, time) is a signature for the root generated by Alice.

3.Bob veri es the signature and stores the root.

4.Alice ! Bob: (wi; i),

where i is initially set to 1 and incremented each time. Alice pays by revealing the next paywords in the chain.

5.Bob veri es consecutive paywords by checking whether wi 1 = H(wi).

Deposit (Bob $ Bank).

1.Bob ! Bank: (w`; `); (w0; SGA(Alice-ID, Bob-ID,w0, time) where w` is the last payword obtained from Alice.

2.Bank veri es the correctness of the last payword. If the chain of paywords generate the root and the signature is correct, then Bank charges Alice's account ` cents and deposit this amount to Bob's account.

The security of the protocol depends on the strength of the digital signature and the collision resistance of the hash algorithm. Payments in the PayWord protocol are very eÆcient. Time-consuming digital signatures are only applied at the begining of a payment session. Partial payments by paywords do not need digital signatures. Instead they employ much faster hashing algorithms such as MD5 or HAVAL. The second protocol MicroMint considered in [427] completely relies on hashing. Some other micropayment protocols can be found in [8, 360].

520 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

15.3 Payment Protocols

We are going to review some implementations of e-cash. For more details, we refer the reader to the book by Furche and Wrightson [191] or, alternatively, to the Web sites of the campanies that o er the payment system.

CAFE. CAFE stands for Conditional Access for Europe and it is a project within the European Community's ESPRIT program [47]. CAFE uses smart cards and electronic devices called wallets. The wallet is a portable computer with its own power supply, keyboard, and display. The wallet can house a tamper-proof smart card (observer) but can be used with or without it. Stores have their points-of-sale (POS) terminals. The communication between wallets and terminals is done using infrared light. Smart cards may also be inserted directly into terminals. CAFE is an o -line e-cash protocol based on blind signatures to ensure anonymity. To protect against multiple spending of e-cash, an observer (smart card) is included in the wallet. When the observer is not present or is disabled, the identity of the client is incorporated into e-cash. If the wallet is lost or stolen, the owner can get a refund by revealing some information about their identity but only after the e-cash has expired. eCashT M . Digicash commercialized Chaums's anonymous electronic cash and called it eCash. eCash is a protocol that enables a user to withdraw e-cash and to store it on his local computer. The user can spend his e-cash at any shop that accepts eCash money. The shop can later deposit the money to its account. The following banks o er eCash: Mark Twain Bank of St. Louis (US), Deutsche Bank (Germany), St. George (Australia), Den norske Bank (Norway), and Bank Austria.

Mondex. Mondex implements e-cash using smart cards (http://www.mondex.com). E-cash is stored on a smart card. Transfer of cash is possible from one card to another. The devices used in the protocol are a smart card, a balance reader,

a wallet, and a phone set with a reader for the card. The wallet supports card- to-card money transfer. The phone set enables money ow between the card and the bank or can be used to make payments. Payments can be done in exact amounts. For security reasons, the card can be locked using a password-like code. The protocol does not use cryptographic techniques.

NetCash. The protocol was developed by the Information Science Institute at the University of Southern California and is documented at http://niiserver.isi.edu:80/info/netcash. The protocol uses e-mail as the communication