I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that fairCash is such a system.

I've added security as a third requirement, since an insecure system seems useless to me. When evaluating a system, I assume that the mint/bank can be trusted, but that the persons who transfer the money don't trust each other, and have all hardware that's in their possession completely under control.

Looking at these three properties, it seems impossible to fulfill them all at the same time. In particular I don't see how you could prevent double spending.

The best offline system I can think of, allows the bank to see the amount of cash flowing from/to a particular person, but only reveals the actual transaction if he double-spends, and then hopes that the double spent money can be recovered out of protocol(for example in court). But I feel like the reduced anonymity and security are worse than requiring online transactions. Edit: It seems like eCash falls in this category.

  • $\begingroup$ Are we ruling out schemes (such as MintChip) based on secure hardware tokens? $\endgroup$ Commented Apr 21, 2012 at 1:05
  • $\begingroup$ "have all hardware that's in their possession completely under control" i.e. if the users have the MintChip, I assume that they can extract any secret keys embedded by the bank. $\endgroup$ Commented Apr 21, 2012 at 7:54

1 Answer 1


Depends on what you mean by secure. If you merely want the ability to detect and then presumably punish double spending, you can do that in a way that is secure and anonymous: double spending reveals enough information to provably identify the user. Since honest users don't double spend, they are still anonymous. This is used in Camenisch et al.'s Compact E-cash paper

These systems use techniques related to blind signatures and and similar to anonymous credentials ---e.g. signatures over committed values and zero knowledge proofs about those signatures --- which make it impossible to link the issue of a unit of currency to its spending or the spending of another unit of currency unless it is double spent. As a result, unlike bitcoin, they really are completely anonymous if the cryptographic assumptions hold.

If you mean prevent double spending. No, it's impossible without trusted hardware*. You run up against, among other things, the cap theorem. What stops me from making a clone of my data and executing the same protocol on other ends of the world ( or the galaxy)?

* As others have pointed out, it might be possible in the quantum setting. Certainly you can make non-cloneable quantum "objects", but its unclear how you would transfer them. (update) in fact you can potentially do it with quantum knots3

  • $\begingroup$ One problem with the first kind of scheme is that it sacrifices a lot anonymity even for honest users. The accounts are not anonymous, the amount of cash flowing in/out of an account can be observed by the bank. I was considering some escrow based systems, but couldn't make it work. Escrow can punish double-spend, but it's not enough once the multi-spend factor is large enough. $\endgroup$ Commented Apr 21, 2012 at 8:01
  • $\begingroup$ "What stops me from making a clone of my data and ..." en.wikipedia.org/wiki/No_cloning_theorem $\endgroup$
    – user991
    Commented Apr 21, 2012 at 20:34
  • $\begingroup$ @RickyDemer OK, yes you can use quantum physics. I should have said specialized hardware instead of trusted. $\endgroup$ Commented Apr 22, 2012 at 6:13
  • $\begingroup$ @CodeInChaos No, these really are actually anonymous as in spending is unlinkable to issue . There isn't an account you keep with the mint/bank, they just issue you a bunch of crypto tokens that you store yourself. Once issued they are completely untraceable unless double spent. $\endgroup$ Commented Apr 22, 2012 at 6:19
  • $\begingroup$ 1) I'm not interested in quantum schemes 2) I understand that payments are untraceable in the ideal case, thanks to blind signatures. But in order to get the name embedded into the tokens, I need to register each payment I send/receive with my bank in my name, even if the bank doesn't learn who was the partner in the transaction. 3) An honest mistake can also easily lead to deanomymization via double-spend. For example you restore from backup, or your application crashes at an unfortunate time. 3) It also leads to unbounded financial risk for the victim if somebody steals the tokens $\endgroup$ Commented Apr 22, 2012 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.