Fwd: *AVAILABLE: HIGHLY EFFICIENT ELECTRONIC CASH SYSTEMS*

[Matthew J Ghio <mg5n+@andrew.cmu.edu>]

---------- Forwarded message begins here ----------

Received: via nntpserv with nntp; Thu, 17 Mar 1994 17:00:49 -0500 (EST)
Newsgroups: alt.2600,alt.cyberpunk.tech,talk.politics.crypto
Path:
andrew.cmu.edu!bb3.andrew.cmu.edu!news.sei.cmu.edu!cis.ohio-state.edu!magn
us.acs.ohio-state.edu!usenet.ins.cwru.edu!howland.reston.ans.net!EU.net!s
un4nl!cwi.nl!brands
From: brands@cwi.nl (Stefan Brands)
Subject: *AVAILABLE: HIGHLY EFFICIENT ELECTRONIC CASH SYSTEMS*
Message-ID: <CMttnF.Btu@cwi.nl>
Sender: news@cwi.nl (The Daily Dross)
Nntp-Posting-Host: aasgier.cwi.nl
Organization: CWI, Amsterdam
Date: Thu, 17 Mar 1994 20:45:15 GMT
Lines: 188
Xref: bb3.andrew.cmu.edu alt.2600:2751 alt.cyberpunk.tech:2971
talk.politics.crypto:3810

Subject: 
-------
   seeking interested parties for implementing, and sharing the 
   rights to, my technologies for privacy-protected electronic transfer 
   of certified information.


                              ****


I am a PhD student at the Cryptography Department at the Center for
Mathematics and Computer Science (CWI) in Amsterdam. In the past two
years, I have developed a compact set of new techniques that enable
the construction of highly efficient and secure electronic systems for
off-line transfer of certified information, such that privacy is fully
guaranteed. The resulting systems offers a great many advantages over
any other privacy-protected systems you will find. In particular,
using a subset of these techniques I have contructed off-line
electronic cash systems in which the privacy of the account holders is
fully guaranteed. An independent authority in the field of cryptology
has recently confirmed that these systems seem to be the most
practical such systems to date.

I am posting this letter because I am very interested in pursuing the
implementation of my systems *jointly*, in a fair business
relationship, with a company capable of and interested in
standardizing these systems. My technologies / ystenms are ideally
suitable for smart cards, hand held computers, interactive TV,
etcetera. All the rights to the technology have been transferred to me
by CWI, and so part of such a cooperation would be *joint ownership of
all rights*. 

The reason for posting this letter in a news group is that I see *no*
other way to get in touch with interested parties. Before I go deeper
into this, I would like to give you some more information about my
technologies, and explain their many features.  If you are not
interested, but think you can help me by suggesting names etc.\, I
would appreciate your suggestions.

          Privacy-protected transfer of electronic information.
          -----------------------------------------------------

Much work has been done to construct privacy-protected off-line cash
systems previously, notably by David Chaum (formerly affiliated with CWI).
This early work has resulted in two key concepts that can be used to attain
the same level of security against double-spending as can trivially be
attained in off-line cash systems with full traceability of payments.
However, the many practical *realizations* of these concepts that have been
proposed are far from satisfactory with respect to efficiency, provability
of security (relative to certain well-known problems that are
widely believed to be intractable), and extensibility in functionality.

The new techniques I developed for my PhD thesis overcome *all* of these
problems. They enable the construction of privacy-protected off-line cash
systems that are almost as efficient as off-line cash systems that do *not*
offer privacy. Succesful attacks against such a system provably imply that
one can break a certain well-known signature scheme that is widely believed
to be secure (such as the Schnorr scheme, the Guillou/Quisquater scheme, the
schemes presented by Okamoto at CRYPTO 92, the Fiat/Shamir scheme etc.). The
techniques in fact allow the construction of a highly efficient off-line
cash system whose security (and that of all the extensions in functionality!)
is based on the security of any one signature scheme of the
so-called Fiat/Shamir type.

Among the extensions in functionality are: prior restraint of
double-spending, electronic cheques, protection against framing,
currency exchange, anonymous accounts, and multi-spendable coins. All these
extensions can be realized very easily without any need for additional data
stuctures or basic algorithms (that is, *no* ad hoc constructions). In
particular, prior restraint of double-spending can be achieved by using a
tamper-resistant computing device that is capable of merely performing a
signature scheme of the Fiat/Shamir type (of one's own choice), such as the
Schnorr signature scheme.

A highly preliminary report about a small subset of these techniques,
based on the Discrete Logarithm problem, has been published by me
about a year ago as a technical report at CWI. (A PostScript version
of this report can be retrieved by ftp from ftp.cwi.nl, as
pub/brands/CS-R9323.ps.). 

In August 1993 I presented these preliminary results at the CRYPTO
1993 conference in Santa Barbara.  The final version of this abstract
can also be retrieved by ftp from ftp.cwi.nl, as
pub/brands/crypto93.ps. It's succesful acceptance can be measured by
the fact that the results in the report are currently being used as
the basis for a cash system by the European CAFE project, a project
with 13 European partners from industry and science. I understand that
some other implementations based on my report are under way as well.

                       New developments.
                       -----------------

In the mean time, however, I have significantly improved and *greatly*
extended the techniques described in the preliminary report.
Furthermore, I came up with a fully RSA-based variant that offers
various advantages over the Discrete Log based variant.

Contrary to the description in the preliminary report, the improved
techniques allow the construction of withdrawal protocols for which it
can rigorously be proven that the aforementioned attack to the
withdrawal protocol is as hard as breaking a well-known signature
scheme, and the efficiency of the system increases by a factor of two
(a factor not to be neglected, especially not in case such a system is
implemented using smart card technology!).

As an interesting side note, the improved techniques do *not* use the blind
signature technique as developed and patented by David Chaum.

The full set of techniques can be used to construct highly efficient
privacy-protected off-line mechanisms for transferring certified
information, the security of which again can be *proven* assuming only
the security of a certain well-known signature scheme of the
Fiat/Shamir type of one's own choice. The off-line cash systems are in
fact just one very particular instance of the general applicability of
the complete set of techniques; it is a system in which credentials
that may be shown only once can be transferred between any
``organizations'' while privacy is guaranteed.  As an example of the
usefulness of the new techniques, highly efficient and secure off-line
cash systems can be constructed in which payments are made under
pseudonym: in order to pay with a coin, an accountholder need do no
more than send 35 bytes to an ``organization'' at which he has a
pseudonym.

For those who want to know in detail about the *many* features of the
new techniques, as well as the performance of several preferred
embodiments of systems that can be contructed from them, I have
prepared a document that can be retrieve by ftp from ftp.cwi.nl, again
in the directory pub/brands. There is a PostScript version called
features.ps, as well as a plain text version called features.plain.

                   Why am I posting this letter?
                   -----------------------------

As I already mentioned at the start of this letter, I am very
interested in pursuing the implementation of my systems *jointly*, in
a fair business relationship, with a company capable of and interested
in standardizing these systems. I am in the process of finishing my
PhD thesis, which deals exclusively with these technologies. If you
have read the detailed description of the features in my ``features''
document, then I have no doubt that you will agree with me that these
systems offer a *great* many advantages over any other
privacy-protected system for off-line transfer of digital information.
In general, if you want to implement electronic systems for secure
transfer of certified information, whether it be cash or other types
of credentials, such that privacy can be guaranteed, then you will
find out that this is *the* way to go.

I am *not* involved with any project or company whatsoever. In
particular, I want like to point out that I am *not* involved in the
CAFE project, and I also do *not* have business relations with the
company (DigiCash) of David Chaum, although I greatly respect his
innovative work on privacy-protected transfer of electronic
information. In fact, *all* rights on my technologies have been
transferred to me by my employee, CWI.

Due to the fact that my research was done independently of any project or
company, it is extremely hard for me to get in touch with the appropriate
persons at companies that are really interested in this technology *and*
that have the capability of implementing it. Since projects and
companies that I am not part of obviously do not provide me with such
information, I see no better way to bring my technologies under the
attention than by publishing this letter on the news net. 

If you are interested in my technologies, and want to pursue
implementation together with me in the *near* future, I invite you to
contact me. We can then discuss things further. Part of such a
cooperation would be that *sharing* with me the rights to my
technologies.

My fax number is

                        (31) 30 - 546 468

This is also my telephone number; however, I would prefer if you send
fax or e-mail. My e-mail address at CWI is brands@cwi.nl.

In case you are interested in having my work reviewed beforehand by
some cryptography authority, to make sure I am not talking nonsense, I
am happy to send to you a detailed description of my work. I guarantee
you that he or she will *not* be able to break it, and will confirm
the many statements I make about the benefits of my technologies. In
addition, or alternatively, depending on the circumstances, I am happy
to come over and explain my technologies in person with you.

Alternatively, if you or your company is not interested in my
technologies, but you think you can help me with pointers to persons
at companies that might be interested in this technology, I would very
much appreciate any such suggestions.