# How to anonymously transfer ownership where sender cannot resend

I'm new to cyptography, so I apologize if this is a dumb/impossible goal or has already been answered (I was not able to find it by searching).

I wish to devise an anonymous protocol for transferring digital goods, where the message contents are publicly viewable, but neither sender nor recipient can be determined from the message contents alone.

Additionally, once the sender has transferred the goods to the recipient, he should not have the ability to resend the same goods again to another recipient. Only the initial recipient should have that ability (i.e. a recipient should obtain sole ownership of the goods once transferred).

The goods may change hands many times, and ownership should be publicly provable at the time of a transfer without revealing the identity of the sender or recipient.

My initial design is for all users in the system to generate their own public/ private keys and a transport (for Diffie-Hellman exchanges). A user's public identity would consist of their public key and transport.

When a sender wants to transfer goods, he first generates new random public/ private keys and transport (not his publicly known values, in order to obscure the fact that he is the sender). He uses these in a Diffie-Hellman exchange with the recipient's publicly known values to generate a shared secret. This shared secret is used as a salt to generate a specific public/private key pair. The sender also generates a completely random public/private key pair.

The sender uses the specific public key to encrypt the random private key. This encrypted value is included in the message contents, along with both public keys and the generated transport. The message contents also contain a random number, and that number encrypted with the specific public key.

The sender also adds the hash of a previous message which was used to transfer ownership of the goods to him originally. The sender then signs the message using the private key that was encrypted in that previous message.

Users in the network listen to messages, and attempt to recreate the shared secret from the public key and transport included in each message, using it as a salt to recreate the specific public/private key pairs. If the specific private key decrypts the correct random number, then a user comes to know that he is the intended recipient. He can then use the specific private key to decrypt the random private key, which he can now use to prove he has ownership of the goods.

The problem with this strategy of course, is that both the sender and recipient have access to the key used to prove ownership, and this would allow the sender to transfer the goods to additional recipients (i.e. the original recipient does not have sole ownership of the goods). Are there some additional cryptographic measures that could be added to this process to prevent the original sender from re-sending the goods? Or am I heading down a dead-end path and need a better strategy?

• once the sender has transferred the goods to the recipient, he should not have the ability to resend the same goods again to another recipient - this is the double spending problem that is addressed by bitcoin/blockchain technology. – Ella Rose Jan 24 '18 at 0:27
• But with bitcoin, the recipient of a transaction is publicly known, and therefore ownership is easy to verify. How might blockchain technology be used to address the "double spending problem" in a protocol where both sender and recipient should not be publicly known? – Paul Lamb Jan 24 '18 at 3:33
• I don't know - I provided the link to the double spending problem not as an answer, but as a comment on something that you can search on. – Ella Rose Jan 24 '18 at 4:05
• Thanks, Ella, that has let me to secret sharing which may be the key. If the system can bring in one or more third parties besides the sender and receiver, then shares of the secret could be available to the receiver which the sender is not aware of. – Paul Lamb Jan 24 '18 at 11:42