Easy come — Easy go divisible cash

Abstract

Recently, there has been an interest in making electronic cash protocols more practical for electronic commerce by developing e-cash which is divisible (e.g., a coin which can be spent incrementally but total purchases are limited to the monetary value of the coin) [DC94, E094, 0 0 9 2 , Pai93, Oka951. In Crypto'95, T. Okamoto presented the first practical divisible, untraceable, off-line e-cash scheme, which requires only O(logh/) computations for each of the withdrawal, payment and deposit procedures, where h/ =(total coin value)/(smallest divisible unit). However, Okamoto's set-up procedure is quite inefficient (on the order of 4000 "multi-exponentiations" and depending on the size of the RSA modulus).We formalize the notion of "range-bounded commitment," originally used in Okamoto's account establishment protocol, and present a very efficient instantiation which allows us to construct the first truly efficient divisible e-cash system. Our scheme only requires the equivalent of one (1) exponentiation for set-up, less than two (2) exponentiations for withdrawal and around 20 for payment, while the size of our coin remains about 300 Bytes. Hence, our withdrawal protocol is 3 orders of magnitude faster than Okamoto's, while the rest of our system remains equally efficient, allowing for implementation in smart-cards. Similar to Okamoto's, our scheme is based on proofs whose cryptographic security assumptions are theoretically clarified.

An Accumulator Based on Bilinear Maps and Efficient Revocation for Anonymous Credentials

“…These technologies include anonymous credential systems [1,2,3], pseudonym systems [4,5,6,7], anonymous e-cash [8,9,10], or direct anonymous attestation [11]. Almost all of these schemes exhibit a common architecture with certificate issuers, users (certificate recipients) and certificate verifiers: Users obtain a signature from an issuing authority on a number of attributes and, at later time, can convince verifiers that they indeed possess a signature on those attributes [12].…”

Efficient Proofs that a Committed Number Lies in an Interval

“…Such kind of proofs are intensively used in several schemes: electronic cash systems [7], group signatures [11], publicly verifiable secret sharing schemes [17,4], and other zero-knowledge protocols (e.g. [13,10]).…”

Efficient E-Cash in Practice: NFC-Based Payments for Public Transportation Systems

“…Following Chaum's paradigm many schemes were proposed [11,16,7,12,14]. The one due to Brands [11] is known for its efficiency during spending, however, a formal proof of security has never been given for it and it has been recently shown that it cannot be proven secure in the Random Oracle model using currently known techniques [5].…”