Cryptographic Protocols - A Classical Introduction to Cryptography: Applications for Communications Security - page 286

Blind signature. This signature enables someone to ask a signer to sign the message
so that the signer has no means to know what he signed. He only gets insurance that
he signed one document, and only one document. One may wonder what kind of
applications can have blind signatures. The most important one is digital cash. Privacy
in digital cash requires untraceability of the money. Here digital coins are signed by a
bank, one by one, in a blind way because customers do not want to have coins which
can be traced.

Invisible signature with designated confirmer. We have seen the notion of invisible
signatures with undeniable signatures. This was in order to protect the privacy of the
signer. One problem remains: the signer can be asked to confirm or deny under threats.
In order to have even stronger protection for the signer, another kind of signature
prevents him from being able to confirm or deny, but he can designate a third party
(e.g. a lawyer) who will be able to do both. Of course, this third party should not be
able to forge signatures.

Fail-stop signature. In classical digital signatures, the signer is protected by complexity
theory arguments that nobody can forge a signature. Fail-stop signatures are signatures
with a stronger protection level: here the signer is protected by information theory
arguments. Indeed, even if forging a signature is hard, if it happens to occur, the signer
will be able to demonstrate that it is a forgery by solving a problem that he would not
have been able to solve in other circumstances.

11.4 Other Protocols

Cryptography contains some other beautiful dedicated protocols. We give a few exam-
ples here.

Escrowed digital cash. We have seen that we can make untraceable digital cash (for more
privacy) with blind signatures. The main drawback is indeed the lack of traceability.
In order to protect against criminal organizations and prevent money laundering, law
enforcement requires having some kind of hidden traceability based on legal request.
This makes practical digital cash systems quite complicated.

Electronic votes. Voting schemes are fundamental for democracy. In order to be im-
plemented in an electronic way, we must protect privacy, and prevent the temptation of
being corrupted. For this we must both authenticate the voter (in order to avoid double
votes) and treat his ballot in an anonymous way. The tricky part is that anonymity must
be enforced against a third party, but also against the voter himself: the voter must not
be able to prove that he has voted for someone. Interestingly, the protection must remain
valid even in the case of a revolution when a dictator could get access to all master
secret keys, etc. Adversaries are indeed quite hard to formalize in voting schemes!

Mental Poker. When trying to play a card game (e.g. poker) remotely, there is a big
security problem related to card shuffling and distribution: one should make sure that no