S Brands, Electronic cash systems based on the representation problem in groups of prime order, Advances in Cryptology-CRYPTO'93, pp 1-15, Berlin: Springer, 1993.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....as well. As here double usage can only be detected but not prevented, a mechanism for identifying double users is required. This could for instance be achieved using revocation as described in the previous section, or using similar techniques that are used in for anonymous o# line e cash (e.g. [Bra93]) We now describe how the latter can be done such that using a one show credential twice would expose the user s secret keys connected with the corresponding pseudonym. Together with (any kind of) non transferability this would be quite a strong incentive for the users not to use one show ....

Stefan Brands. Electronic cash systems based on the representation problem in groups of prime order. In Preproceedings of Advances in Cryptology --- CRYPTO '93, pages 26.1--26.15, 1993.

....However, the use of the error and erasure correcting code prohibitively enlarges the number of bits that need to be embedded. Recently, Pfitzmann and Sadeghi [11] presented an e#cient replacement for the first part of this construction. It is derived from the anonymous e cash scheme by Brands [4]. More precisely, it uses its property that coins are anonymous when spent once but reveal a user s identity when spent twice. However, the resulting scheme has the drawback that a buyer must register once for each purchase and that the merchant has to contact the registration center to retrieve ....

.... zero knowledge proof techniques, which are rather ine#cient and thus the resulting anonymous fingerprinting scheme is considered an existence result [13] Pfitzmann and Sadeghi [11] replace this general construction by an explicit and e#cient one derived from the digital payment system by Brands [4]. Coins in that payment system are anonymous, but contain some identifying information that can be extracted as soon as a user spends a coin more than once (and only then) This information will then allow the bank to obtain the doublespender s identity. Pfitzmann and Sadeghi exploit this ....

S. Brands. Electronic cash systems based on the representation problem in groups of prime order. In Preproceedings of Advances in Cryptology --- CRYPTO '93, pp.

....holds for all other protocols described in this section (when not mentioned otherwise) Adopting the notation in [7] we denote this protocol by PKf( y = g g, where PK stands for proof of knowledge . Proving the knowledge of a representation of the element y to the bases g 1 ; g l [4, 10], i.e. proving the knowledge of integers x 1 ; x l such that y = x i i . This protocol is an extension of the previous one to multiple bases. The prover chooses random r 1 ; r l 2R Z Q , computes t : i=1 g r i i , and sends t to the verifier. The verifier picks a random ....

S. Brands. Electronic cash systems based on the representation problem in groups of prime order. In Preproceedings of Advances in Cryptology --- CRYPTO '93, pages 26.1--26.15, 1993.

....the original signatures is easy [Cha90] During payment (of possibly several coins) the user has to perform about 30 modular multiplications plus two multiplications per coin being payed. The withdrawal protocol constructs the coins directly without resorting to cut and choose methods. In [Bra93, Bra94] Stefan Brands recently showed a di#erent construction for an e#cient electronic coin scheme based on discrete logarithms. His construction does not use a cut and choose protocol or multiple challenge terms either. I would like to thank David Chaum for all his support, and for helping to clean up ....

Stefan Brands. Electronic cash systems based on the representation problem in groups of prime order. In Proceedings of CRYPTO '93, 1994. To appear.

....for which are studied theoretically but are still not surfacing in the marketplace, is a global secure payment system. The spectrum of technical possibilities is wide, ranging from secure privacy enhanced funds transfer systems to fully anonymous on line or off line digital cash (e.g. see [14]) Which types of system will prevail will depend more on the market forces than on technical issues. In fact, perhaps the greatest commercial failure of cryptographic solutions can be found in the payment arena: Digicash went bankrupt despite its technically innovative products. It is difficult ....

S. Brands, Electronic cash systems based on the representation problem in groups of prime order, Advances in Cryptology -- CRYPTO '93, Lecture Notes in Computer Science, vol. 773, pp. 302--318, Springer-Verlag, 1994.

....as well. As here double usage can only be detected but not prevented, a mechanism for identifying double users is required. This could for instance be achieved using revocation as described in the previous section, or using similar techniques that are used in for anonymous o line e cash (e.g. [Bra93]) We now describe how the latter can be done such that using a one show credential twice would expose the user s secret keys connected with the corresponding pseudonym. Together with (any kind of) non transferability this would be quite a strong incentive for the users not to use one show ....

Stefan Brands. Electronic cash systems based on the representation problem in groups of prime order. In Preproceedings of Advances in Cryptology | CRYPTO '93, pages 26.1-26.15, 1993. 25

....[11] However, the use of the error and erasure correcting code prohibitively enlarges the number of bits that need to be embedded. Recently, P tzmann and Sadeghi [11] presented an ecient replacement for the rst part of this construction. It is derived from the anonymous e cash scheme by Brands [4]. More precisely, it uses its property that coins are anonymous when spent once but reveal a user s identity when spent twice. However, the resulting scheme has the drawback that a buyer must register once for each purchase and that the merchant has to contact the registration center to retrieve ....

.... zero knowledge proof techniques, which are rather inecient and thus the resulting anonymous ngerprinting scheme is considered an existence result [13] P tzmann and Sadeghi [11] replace this general construction by an explicit and ecient one derived from the digital payment system by Brands [4]. Coins in that payment system are anonymous, but contain some identifying information that can be extracted as soon as a user spends a coin more than once (and only then) This information will then allow the bank to obtain the doublespender s identity. P tzmann and Sadeghi exploit this property ....

S. Brands. Electronic cash systems based on the representation problem in groups of prime order. In Preproceedings of Advances in Cryptology | CRYPTO '93, pp.

....of relying on heuristics. The approach is efficient, although the cut and choose approach leads to coins of large size. Other off line coin schemes use blind signature schemes derived from Chaum and Pedersen [6] or methods developed subsequent to our work, and in some cases independently of it [3, 10, 14, 29, 31]. It is also possible to implement blind signatures using general secure 2 party computation protocols [36] as shown by Pfitzmann and Waidner [30] building on work of Damgard [7] A circuit to compute signatures is jointly computed by the bank and the customer, with the bank contributing one ....

.... a large prime both hides the coefficients (unless discrete logs can be easily computed) and enables anyone to easily verify the incidence of points on lines (thanks to the laws of exponents) Subsequent to our work, other off line coin schemes have also used line based embedding schemes [14] [3]. Theorem 2 Under the Discrete Log Assumption, there exists a secure Embedding scheme Proof : Let p be a large prime such that p Gamma 1 has one large factor q, and let g 2 Z p . Let H be a hard bit for the discrete log. Define e(s; r) to be [g a 1 mod p; g b 1 mod p; Delta Delta Delta ; ....

S. Brands, "Electronic cash systems based on the representation problem in groups of prime order," in Advances in Cryptology---CRYPTO '93 Proceedings (Lecture Notes in Computer Science), ed. D. Stinson, Springer-Verlag, New York (to appear).

.... a large prime both hides the coefficients (unless discrete logs can be easily computed) and enables anyone to easily verify the incidence of points on lines (thanks to the laws of exponents) Subsequent to our work, other off line coin schemes have also used line based embedding schemes [71] [32]. Theorem 6.2 Under the Discrete Log Assumption, there exists a secure Embedding scheme Proof : Let p be a large prime such that p Gamma 1 has one large factor q, and let g 2 Z p . Let H be a hard bit for the discrete log. Define e(s; r) to be [g a 1 mod p; g b 1 mod p; Delta Delta Delta ....

S. Brands, "Electronic cash systems based on the representation problem in groups of prime order," in Advances in Cryptology---CRYPTO '93 Proceedings (Lecture Notes in Computer Science) , ed. D. Stinson, Springer-Verlag, New York (to appear).

....user s privacy relies exclusively on administrative and legal measures. Using cryptographic tools such as blind signatures [7] it is possible to design electronic payment systems that allow participants to remain anonymous during a transaction, without affecting the security of the system (e.g. [2, 5, 8, 9]) Such systems offer an unconditional privacy protection, but they can be misused by criminals for perfect blackmailing [17] or for money laundering. The concept of a fair payment system, independently proposed in [3] and [16] offers a compromise between the legitimate need of privacy protection ....

....assured that the bank will accept to credit its account with the received amount. Finally, the customer wants to be sure that money he 1 has withdrawn will be accepted for a payment. Furthermore, the customer may require that his privacy be protected. Anonymous electronic payment systems (e.g. [2, 5, 8, 9]) prevent anybody, including the bank, from violating the customer s privacy. Payments are anonymous and different payments of the same customer are unlinkable. This is achieved using cryptographic mechanisms such as blind signature schemes [4, 7] 1 In this paper the customer is male whereas ....

[Article contains additional citation context not shown here]

S. Brands. Electronic cash systems based on the representation problem in groups of prime order. In Advances in Cryptology - CRYPTO '93, volume 773 of Lecture Notes in Computer Science, pages 302--318. Springer Verlag, 1994.

....of crime that unrestricted remotely withdrawable and spendable electronic cash could facilitate. We introduce the first electronic cash systems which incorporate trustee based tracing but otherwise provably protect user anonymity. We expand on the provably anonymous electronic cash systems of [B93] and [FY92] Our systems maintain the previous papers complete provable user anonymity except that, only with the cooperation of several publicly appointed trustees (key escrow agents) the government can trace a user s spending with certainty, determining to whom the user gave his her money and ....

....privacy properties of our protocol are based on the algebraic properties of a large subgroup of prime order q embedded in the multiplicative group Z p , where p is a large prime. ffl The systems are secure against counterfeiting and other fraud. We present one version of the system based on [B93], where the security is based on the existence of a collision free hash function and the difficulty of finding discrete logarithms, and one version based on [FY92] where the security is based on the existence of a collision free hash function and the difficulty of factoring as well as the ....

[Article contains additional citation context not shown here]

S. Brands. Electronic Cash Systems Based on the Representation Problem in Groups of Prime Order. Preproceedings of CRYPTO 93.

No context found.

S Brands, Electronic cash systems based on the representation problem in groups of prime order, Advances in Cryptology-CRYPTO'93, pp 1-15, Berlin: Springer, 1993.

No context found.

S Brands, Electronic cash systems based on the representation problem in groups of prime order, Advances in Cryptology-CRYPTO'93, pp 1-15, Berlin: Springer, 1993.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC