Digital Coins: Fairness Implemented by Observer

For real-world applications digital coin systems, i.e., off-line payment systems offering not only the unforgeability of conventional coins but also the anonymity of customers making purchases, need to have some additional features. One of these additional features is the hardware protection of the system, provided by dedicated tamper-resistant devices called observers which are used to physically prevent illegitimate copying of coins. Another essential feature for practical applications is anonymity-revocation mechanisms. Basically, digital coin systems guarantee perfect anonymity, i.e., the bank cannot link views of the withdrawal and payments in order to determine whether or not a customer spent her money at a certain shop. The customer’s privacy protection is the main difference between coin systems and those based on credit card or cheque based systems. While privacy protection is a desirable property of cash systems, perfect anonymity is not. Perfect anonymity makes possible perfect blackmailing or money laundering. To prevent such “perfect crime” it must be possible to revoke the anonymity of customers in case of need. Anonymity revocation is done by a trusted third party. Cash systems that allow anonymity revocation are called fair. We present a coin system featuring both observer and fairness, showing that both concepts do not interfere with each other and can be implemented simultaneously without loss of security. We prove this claim not only by presenting a fair variant of the Brands’ coin system but additionally by outlining a generic framework for fair wallets in which essentially any blind signature scheme can be used. Unlike other fair off-line coin systems, fairness is implemented with the help of the observer, thereby reducing the computational effort during the withdrawal.