Provably Secure Electronic Cash Based on Blind Multisignature Schemes

Security of Offline Anonymous Electronic Cash Systems against Insider Attacks by Untrusted Authorities Revisited

“…One of the elegant solutions to insider attacks by malicious banks was proposed by Hanatani et al [7], [8]. Hanatani et al use a blind multisignature scheme based on [35] instead of a threshold signature scheme.…”

“…Following the classification of Miyazaki and Sakurai, we investigate some of the recently proposed electronic cash systems such as [7], [8], [10]- [13].…”

Provably Secure Untraceable Electronic Cash against Insider Attacks

“…We introduced the formal security model of the untraceable e-cash schemes with the blind multisignature scheme and proposed a provably secure scheme whose size of e-cash is independent of the number of banks, which overcomes the problems discussed in the above related works; however, the security of this scheme is considered only for a restricted attack model, and its security is questionable for a non-restricted attack model. In the scheme of [1], the only issuing bank uses the tag key that enables banks to trace dishonest users and the other guaranteeing banks do not, and so the security cannot be proven against the non-restricted attack model where the attacker can fully corrupt † the issuing bank. Moreover, [1] insists that if the scheme is modified by making the guaranteeing bank use its own tag key, and therefore, the security of the modified scheme can be proven even if the issuing bank is corrupted † † .…”

“…In the scheme of [1], the only issuing bank uses the tag key that enables banks to trace dishonest users and the other guaranteeing banks do not, and so the security cannot be proven against the non-restricted attack model where the attacker can fully corrupt † the issuing bank. Moreover, [1] insists that if the scheme is modified by making the guaranteeing bank use its own tag key, and therefore, the security of the modified scheme can be proven even if the issuing bank is corrupted † † . However, the theorem 5 of [1] is not concerned about the model where the shops are corrupted in the forgery game of [1]; namely, the security is not ensured when the shops are dishonest.…”

“…

Although a great deal of research has been done on electronic cash schemes with blind multisignatures to prevent an insider attack, there is no discussion of a formal security model in the literature. Firstly we discussed the security model of e-cash schemes based on the blind multisignature scheme against a (restricted) attack model and proposed a concrete scheme proven to be secure in the model [1]; however, this attack model disallows an attacker from corrupting an issuing bank and shops in the forgery game. In this paper, first, we reconsider the security model to remove the restriction of the attack model.

…”