Buying Digital Postage Stamps Anonymously

[tcmay@got.net (Timothy C. May)]

This came up in today's Bay Area Cypherpunks meeting (a very good meeting,
by the way). It also has come up in a couple of the messages here, with
mention made that the stamp seller may know who is using his remailer
because he has records of who he sold the stamps (= numbers) to.

There are several standard solutions:

1. Two-way anonymous communication, and two-way anonymous e-cash.
("Wrappers" and all that stuff, stuff I don't here us talking about much
lately...)

2. "Stamp mixes," wherein users exchange stamps bought earlier. (This still
depends on trust that the seller will not have kept copies of the stamps
for his own use, thus wiping out the value of one's new stamps, or that he
won't keep records. Anonymity techniques in the mix could help with some of
these problems.)

3. Cash purchase with message pool posting.

This last one I'll spend a moment describing, as it is very easy to
understand, and is robust against a lot of attacks.

Alice wishes to buy 100 remailer stamps, each worth 20 cents. She places a
$20 U.S. banknote and a diskette containing a public key in an ordinary
paper envelope and mails it from a random mailbox to Bob. She also includes
a simple phrase to make it easier for her to later find the stamps, such as
"Rosebud." Bob creates the digital stamps, encrypts the list of them with
the public key provided, puts the name "Rosebud" on the file, and places it
on his Web page which is visited by many people daily, or, for more
security, posts it to a Usenet group devoted to such things (such as
alt.anonymous.messages).

Alice retrieves the digital stamps by either visiting Bob's Web site, with
some small amount of identity leakage possible, or reads the messages in
alt.anonymous.messages (with even less chance of leakage). Or, Alice could
use a Web proxy to more securely visit the site.

The net result is that Alice has $20 worth of digital stamps, Bob has a $20
bill and will honor the stamps he issued, and Bob doesn't know who he sold
them to.

This is how easily it could be done. Digital cash is not needed, at this
granularity ($20 bills sent through the mail), and simple trust works. (We
talk a lot about "reputations," and this is a concrete example. Protocols
that "force" Bob to honor a digital stamp, instead of relying on his
willingness to honor his promises, are vastly harder to design and use than
are such simple, micro-trust transactions.)

Different remailers would have different stamps, different rates, etc., and
a remailer script (for a "premail"-like app?) could take the remailer hops
planned, pull a stamp off the list of unused stamps, and put the number in
a remailer-like header field, such as:

::
Digital-Stamp: 5he20o#xL3p01SA29s

The receiving remailer would decrypt the message with its private key,
check the digital stamp field (as above, or in a real header format,
whatever), and see if the stamp is in its list of "issued, but unused"
stamps. And so on, in the obvious way.

Seems straightforward to do.

--Tim May

We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^756839 - 1  | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."