Secure Digital Cash with Identity Lists
Scribed by Saundarya Keshari
Lecture 11, 29th January
1 Introduction
In developing a digital currency, our objective is to replicate the key properties of physical
cash. These include:
1. Universal Acceptance: The medium is widely recognized as valuable.
2. Ease of Transfer: It allows seamless transactions between parties.
3. Anonymity: The identity of the user is kept confidential.
4. Copy Protection: The design inherently prevents unauthorized duplication or forgery.
5. Portability: It is lightweight and convenient for everyday use.
Previous methods have struggled to fulfill all these criteria simultaneously. Here, we
introduce the Identity Lists approach—a robust solution that not only secures anonymity
but also makes the system copy-resistant.
2 Digital Currency via Identity Lists
2.1 Structure of the Digital Note
A digital note is represented by a string s comprising:
• A unique serial number.
• A declaration (for instance, “This note is worth Rs. 100”).
• A masked identity x that conceals the true identity of the owner.
2.2 Generating the Masked Identity
Let the user’s unique identifier be a k-bit string A. To hide A, the following process is
employed:
(a) Generate M random k-bit strings:
A10 , A20 , . . . , AM
0 .
1
(b) For each index i (with 1 ≤ i ≤ M ), compute:
Ai1 = Ai0 ⊕ A,
where ⊕ denotes the bitwise XOR operation.
The masked identity x is then constructed by concatenating the hash values of these
strings:
x = H(A10 ) ∥ H(A11 ) ∥ H(A20 ) ∥ H(A21 ) ∥ · · · ∥ H(AM M
0 ) ∥ H(A1 ),
with H(·) representing a cryptographic hash function and ∥ denoting concatenation.
2.3 Revealing the True Identity
The actual identifier A can be recovered if any corresponding pair (Ai0 , Ai1 ) is disclosed
because:
A = Ai0 ⊕ Ai1 .
Until such a pair is revealed, the true identity remains hidden, thereby preserving the user’s
anonymity.
2.4 Transaction Protocol
When a merchant receives a digital note, the following protocol is executed:
1. The merchant generates an M -bit challenge.
2. For each challenge bit:
• If the i-th bit is 0, the customer sends Ai0 .
• If the i-th bit is 1, the customer sends Ai1 .
3. The merchant hashes the received response and verifies that it matches the correspond-
ing segment in the masked identity x printed on the note.
This procedure confirms that the note is genuine and was indeed issued to the presenting
customer.
2.5 Prevention of Double Spending and Copying
The system is designed to be copy-proof. If a user attempts to spend the same note more
than once, the following occurs:
• Different merchants will issue distinct M -bit challenges.
• With overwhelming probability (approximately 1 − 21n for sufficiently large n), there
will be at least one index i for which the responses across different transactions provide
both Ai0 and Ai1 .
2
• Once both values are obtained, anyone can compute:
A = Ai0 ⊕ Ai1 ,
thereby unmasking the true identity of the fraudulent user.
Additionally, the likelihood of a merchant inadvertently reusing the same challenge is negligi-
ble (around 21n ), reinforcing the note’s resistance to copying. This ensures that any attempt
to duplicate or forge a digital note is both detectable and traceable.
3 Conclusion
The Identity Lists approach successfully integrates the core attributes of physical cash into
a digital format:
• Anonymity: Genuine transactions keep the user’s identity concealed.
• Security: The cryptographic design prevents duplication and forgery.
• Traceability: Fraudulent activities, such as double spending, trigger the revelation of
the user’s true identity.
• Convenience: The digital note is easily transferable, portable, and widely accepted
as valuable.
In essence, this scheme not only safeguards user privacy during normal operations but also
provides a robust, copy-proof mechanism to deter and detect fraudulent activities, making
it a promising framework for secure digital cash systems.