Cryptography Reference
In-Depth Information
2. Bob prepares 100 moneyorders for $100 each:
100
k
=1
)(1
M
j
= ($100
,m
j
,
{
L
j
k
,R
j
k
}
≤
j
≤
100)
,
where
m
j
is a randomlygenerated number (byBob's computer) that is
an ECash coin's identification number with
m
j
=
i
. Bob
executes a blinding protocol for each of the moneyorders byselecting a
random
z
j
(mod
n
) for 1
=
m
i
for
j
≤
j
≤
100 and sends the 100 blinded money
k
=1
) to the bank.
3. Using a cut-and-choose protocol, the bank opens 99 of the moneyorders
and checks that the amounts are all the same, $100, that
m
j
orders ($100
,z
j
m
j
,
{
L
j
k
,R
j
k
}
100
=
m
i
for
j
R
j
k
is a valid identitystring. If the bank sees
no evidence of fraud, it (blindly) signs the remaining money order,
M
100
,
say, and sends the validated money order,
=
i
, and that each
L
j
k
⊕
($100
,z
100
m
100
,
(
z
100
m
100
)
d
,
100
{
L
100
k
,R
100
k
}
k
=1
)
,
to Bob, withdrawing $100 from his account. Otherwise, the bank does
not, and discloses the problem, and the transaction is terminated.
4. Bob unblinds to get the ECash coin (
m
100
,m
100
), which he can now spend
using the moneyorder
M
100
.
ECashSpending Details
1. The vendor verifies the bank's signature bycomputing (
m
100
)
e
=
m
100
.
2. The vendor gives Bob a random 100-bit binarystring (
b
1
b
2
...b
100
), and
requests that Bob reveal
L
100
k
if
b
k
= 1, and
R
100
k
if
b
k
= 0 for each of
k
=1
,
2
,...,
100, which Bob does. The vendor sends the moneyorder to
the bank for verification from its database.
3. The bank checks its used coin database to ensure that
m
100
is not there. If it
is not, then the bank deposits $100 into the vendor's account, and records
m
100
in its used coin database along with the identitystring selected by
Bob via the binarystring in step 1. The vendor then sends the goods to
Bob along with a receipt, and the transaction is completed.
4. If
m
100
is in the used coin database, the bank rejects the moneyorder.
Then it compares the identitystring on the bogus moneyorder with the
stored identitystring attached to
m
100
. If theyare the same, then the
bank knows the vendor duplicated the moneyorder. If theydiffer, then
the bank knows that the entitywho gave it to the vendor must have copied
it. Given that the coin (
m
100
,m
100
) was spent with another vendor, then
that vendor gave Bob a different binarystring. The bank compares the
differing strings until it finds a position where the bits differ, saythe
i
th
position. This is where one vendor asked Bob to open
L
i
and the other
asked Bob to open
R
i
. Thus, then bank forms
L
i
⊕
R
i
, revealing Bob's
identity, which can be reported to the authorities.
Search WWH ::
Custom Search