A Research Of Off-line Electronic Cash Systems With Revocable Anonymity

Electronic cash systems, compared to the other two mediums of payment over a network, electronic credit card systems and electronic check systems, have several advantages to conduct electronic commerce with, one obvious of which is that they provide anonymity for customers so that the shopping privacy of customers can be protected during and after the shopping activity. Although anonymity is a desirable property by customers, one absolute or unconditional can be abused by crafty criminals to commit blackmail and in money-laundering. In light of this a good electronic cash system needs as well to be able to disclose the identity of customers when needed.There have been many electronic cash systems designed in the literature and not fewer put into practical use. Among them some cannot revoke the anonymity of unlawful customers; others operate with a limited efficiency. In this paper, we seek to develop a scheme for building off-line electronic cash systems with revocable anonymity, by realizing the idea that if during the withdrawal of electronic coins the bank commits to the electronic coins by signing on them blindly and the verification of the signatures thus derived involves employing secrets which are bound each to a single customer's identity and known exclusively to the customer and a trusted third party (TTP for short), then the anonymity of the customer when he or she uses the electronic coins lawfully can be guaranteed provided the TTP acts honestly, while with an unlawful customer, cooperation with the TTP could uncover the identity of the customer, on the account that on the one hand the TTP has the secrets for verifying validity of the electronic coins, and that on the other hand the TTP can be made to keep a mapping between the secrets and customers' identities, that therefore by such arrangement the TTP is endowed with the ability to identify original owners of questionable electronic coins.The Abe-Camenisch partially blind signature scheme based on the Schnorr digital signature system can be easily adapted to accomplish the aforesaid purpose. We innovated the scheme to make the verification of the resulted Schnorr signature need to compute an intermediate value from a quantity k first, without which the verification would be impossible. The quantity k is a random number generated by the customer and put under the custody of the TTP as a secret. It forms a bijection with...