Cash, cheaters, and anonymity

[tcmay@localhost.netcom.com (Timothy C. May)]

Here's a long response. But it's my only post of today, as the list was
going on and on about atom bombs, uranium sabots, and alpha particles, and
with debate about why some of us are ignoring these posts and the posts of
ranters and baiters.

This topic is more in line with my reasons for being on this list. Sorry
for  the length.

Hal Finney writes:

>One question is the ease of theft in a digital cash environment, and
>the consequences of claiming that secrets have been stolen.  This
>problem was recognized very early on in discussions of digital
>signatures.  The whole point of a signature is so that someone can be
>held to a commitment.  But an easy "out" would be to "accidentally on
>purpose" let the secret keys be stolen, then to claim that the
>signature was actually forged.  Contrariwise, a business might
>be vicitimized by actually having its secrets stolen and a forged
>signature created that committed it to an unfavorable action.

Hal is right the problem of *repudiation* or *disavowal* was recognized
early on. Alice is confronted with a digital signature, or whatever. She
says; "But I didn't sign that" or "Oh, that's my old key--it's obsolete" or
"My sysadmin must have snooped through my files," or "I guess those key
escrow guys are at it again."


APPROACHES TO REPUDIATION

**The purist approach: you *are* your key. If another biological unit
obtains your key, he or she is effectively you. Guard your key carefully.

**The modern American "excuse" approach: Hey, if you want to disavow a
contract, like, just claim your key was stolen or, like, you lost it.

I understand the reasoning behind adopting a more intermediate stance, but
I think that only the purist stance will hold water in the long run.(A hint
of this: untraceable cash means, for most transactions of interest with
digital cash, that once the crypto stuff has been handled, whether the sig
was stolen or not is moot, because the money is gone...no court can rule
that the sig was invalid and then retrieve the cash!)

[It is true that Chaum went to great lengths to develop system which
preserve anonymity for single-spending instances, but which break anonymity
and thus reveal identity for double-spending instances. I'm not sure what
market forces caused him to think about this as being so important, but it
creates many headaches. Besides being clumsy, it require physical ID, it
invokes a legal system to try to collect from "double spenders," and it
admits the extremely serious breach of privacy by enabling stings. For
example, Alice pays Bob a unit of money, then quickly Alice spends that
money before Bob can...Bob is then revealed as a "double spender," and his
identity revealed to whomver wanted it...Alice, IRS, Gestapo, etc. A very
broken idea. Acceptable mainly for small transactions. More on this later.]


NEGOTIATED PROTOCOLS TO REDUCE RISKS

However, just as most folks make arrangements with their bank/ATM machines
(semantic meaning #2 of "ATM") to limit cash withdrawals to, say, $200 a
day (it varies), so too can digital cash arrangements make similar
contractual deals to limit losses. Some possible plans:

* Plan A: The protocol insists on retinal scan or other biometric
authentication between the "smartcard" used as the cryptographic keying
device and the putative owner. The "Thunderball" plan. (issues: preserving
anonymity with biometric authentication, spoofing of the channel between
card and physical apparatus, theft of smartcard, etc.)

* Plan B: The protocol only allows, say, $1000 per transaction. And no more
than 3 transactions per day. Each transaction that is cleared sends a demon
message to the account owner through a separate communications channel.

(This sounds complex...the idea is to provide a signal that an account is
being accessed, allowing the account owner to put a hold on the account.
Even if he can't stop the transactions underway, or recently completed,
because of the lags that may exist in this feedback, he can limit losses.
Kind of a mix between off-line and on-line transactions....such mixes are
to be expected, with the choice up to parties, depending on costs, risks,
speed of communications, etc.)

* Plan C: Use off-line cash only for "small" transactions, such as those
now handled with physical coins and small bills. Use on-line clearing for
larger amounts, with various forms of biometric security.

This echoes how things are done today: off-line cash is what you can carry,
in bill, coin specie, etc. Larger amounts (hundreds of dollars and up) is
almost always handled on-line, via either credit cards (on-line clearing,
albeit not anonymous/untraceable) or checks, cashier's checks, etc.

(Coins and cash bills are really "on-line clearing" though, in that their
existential properties make them acceptable immediately; they are not
replicable, at least not easily, and hence can be conserved in transations.
All the usual stuff about the nature of cash money.)

Which will be used? (and there are many variants...) As usual, markets will
allow choice. Many people will choose to limit exposure with Plan B-type
transactions. Others will contract with insurance agents who cover risks by
insisting on their own protocols for added security. (I don't mean
conventional insurance agents, naturally.)


MISCELLANEOUS STUFF

>On the other hand, I would hope that people actually can learn to use
>care in safeguarding their secrets.  The pass words and PINs we use
>today may be complemented by physical checks for voice patterns, thumb
>prints, perhaps (ironically) handwriting.  Another approach would be

Most smartcards in use today support some form of local PIN entering, some
way to provide a truly memorizable extra piece of identiy. Other biometric
measures remain a hot area of research. Stroke recognition, thumbprints,
etc. In about 5 years, when I think digital cash will be ready for prime
time (pun intended), these additional mechanisms should be deployable, for
a price. (Market-driven again: those who want to pay less in insurance will
take better steps. Companies may adopt standards. Banks may enforce them.)

...
>suggestions (one here a couple of days ago) to use various kinds of
>information exchange between the authenticating device and the human
>user in order to prove authorization in such a way that even a thief
>who has snooped on past exchanges will not be able to use the device.
>This approach is sometimes called the use of "pass algorithms".

"Zero knowledge interactive proof systems" have been used for password
systems; no amount of past snooping or eavesdropping helps. (Of course, the
user still has to have physical security over his local computer, or PDA,
dongle, or secret decoder ring.) This seems like a readily-solvable problem
(and one we already accept with existing ATM machines).



THE INCREDIBLE IMPORTANCE AND ELEGANCE OF ON-LINE CLEARING

...
>Applying this to the double-spending case, I suspect that Bob Hettinga
>is more on the right track in seeing the solution in the legal system
>rather than a simple "shucks, you caught me" forfeiting of a bond
>worth triple damages.  There really should be no excuse for double

*On-line clearing* for larger amounts is, in my opinion, the Right Thing.
Networks are getting deployed widely and are speedy. ATM, SONET, ISDN, and
all the rest.

I want to elaborate on this, even though I think most of Hal's points are
made with off-line clearing in mind. I want to make the case for why
on-line clearing is the One True Digital Cash.

Conceptually, the guiding principle idea is simple: he who gets to the
train locker where the cash is stored *first* gets the cash. There can
never be "double spending," only people who get to the locker and find no
cash inside. Chaumian blinding allows the "train locker" (e.g., Credit
Suisse) to give the money to the entity making the claim without knowing
how the number correlates to previous numbers they "sold" to other
entities. Anonymity is preserved, absolutely. (Ignoring for this discussion
issues of cameras watching the cash pickup, if it ever actually gets picked
up.)

Once the "handshaking" of on-line clearing is accepted, based on the "first
to the money gets it" principle, then networks of such clearinghouses can
thrive, as each is confident about clearing. (There are some important
things needed to provide what I'll dub "closure" to the circuit. People
need to ping the system, depositing and withdrawing, to establish both
confidence and cover. A lot like remailer networks. In fact, very much like
them.)

In on-line clearing, only a number is needed to make a transfer.
Conceptually, that is. Just a number. It is up to the holder of the number
to protect it carefully, which is as it should be (for reasons of locality,
for self-responsibility, and because any other option introduces
repudiation, disavowall, and the "Twinkies made me do it" sorts of
nonsense). Once the number is transferred and reblinded, the old number no
longer has a claim on the money stored at Credit Suisse, for example. That
money is now out of the train locker and into a new one. (People always
ask, "But where is the money, really?" I see digital cash as *claims* on
accounts in existing money-holding places, typically banks. There are all
kinds of "claims"--Eric Hughes has regaled us with tales of his
explorations of the world of commericial paper. My use of the term "claim"
here is of the "You present the right number, you get access" kind. Like
the combination to a safe. The train locker idea makes this clearer, and
gets around the confusion about "digimarks" of "e$" actually _being_ any
kind of money it and of itself.)

Off-line systems may be useful for paying for movies, toll roads, etc., but
there the protocols can be set up to limit exposure to fraud. (Ontological
constraints, such as number of movie theater attendees, etc., will limit
the losses. Scams will likely still exist, but the problem seems manageable
with some work.)

And as networks get much faster, expect even off-line cash to fade. Depends
on costs, insurance rates, benefits, and of course on regulations.


>spending, even of a penny, and the penalties could be made strong
>enough to deter most people.  If a bank does not think they will be
>able to find and prosecute a person who is withdrawing off-line
>digital cash, they will probably not give any to him.  Then if the

The "first to the locker" approach causes the bank not to particularly care
about this, just as a Swiss bank will allow access to a numbered account
(or used to...please let's not have a dozen posts arguing about this, as is
so often the case on this list!) by presentation of the number, and perhaps
a key. Identity proof *may* be needed, depending on the "protocol" they and
the customer established, but it need not be. And the last thing the bank
is worried about is being able to "find and prosecute" anyone, as there is
no way they can be liable for a double spending incident.

The beauties of local clearing! (Which is what gold coins do, and paper
money if we really think we can pass it on to others.)


IS PROOF OF PHYSICAL IDENTITY NEEDED?

...
>money is double-spent, the person who withdrew it would be prima facie
>responsible, with a reasonable presumption that they did it unless
>there is significant evidence otherwise.  I don't know that this is
>how it will work out but it is one possibility (unless the uncertainty
>just scares everybody away - but I think the digital signature
>experience will get people used to the concepts and problems).

I recall some analyses of these situations a while back. I looked in my
"Crypto" Proceedings but didn't find it.

The danger of making the "person who withdrew it" a culprit if the money
has already been "spent" is clear: he is just as likely to be an innocent
victim of a setup as the guilty party. With off-line clearing, and not the
"handshaked" beauty of immediate clearing, one has to rely on
"trust"--tough with an anonymous person.

On-line clearing has the possible danger implicit in all trades that Alice
will hand over the money, Bob will verify that it has cleared into his
account (in older terms, Bob would await word that his Swiss bank account
has just been credited), and then Bob will fail to complete his end of the
bargain. If the transaction is truly anonymous, over computer lines, then
of course Bob just hangs up his modem and the connection is broken. This
situation is as old as time, and has always involved protcols in which
trust, repeat business, etc., are factors. Or escrow agents.


REAL ESCROW AND TRUE NYMS


Long before the "key escrow" of Clipper, true escrow was planned. Escrow as
in escrow agents. Or bonding agents.

Alice and Bob want to conduct a transaction. Neither trusts the other;
indeed, they are unknown to each other. In steps "Esther's Escrow Service."
She is _also utraceable_, but has established a digitally-signed presence
and a good reputation for fairness. Her business is in being an escrow
agent, like a bonding agency, not in "burning" either party. (The math of
this is interesting: as long as the profits to be gained from any small set
of transactions is less than her "reputation capital," it is in her
interest to forego the profits from burning and be honest. It is also
possible to arrange that Esther cannot profit from burning either Alice or
Bob or both of them, e.g., by suitably encrypting the escrowed stuff.)

Alice can put her part of the transaction into escrow with Esther, Bob can
do the same, and then Esther can release the items to the parties when
conditions are met, when both parties agree, when adjudication of some sort
occurs, etc. (There a dozen issues here, of course, about how disputes are
settled, about how parties satisfy themselves that Esther has the items she
says she has, etc.)


UNTRACEABLE MARKETS FOR ASSASSINATIONS

To make this brutally concrete, here's how escrow makes murder contracts
much safer than they are today to negotiate. Instead of one party being
caught in an FBI sting, as is so often the case when amateurs try to
arrange hits, they can use an escrow service to insulate themselves from:

1. From being traced, because the exchanges are handled via pseudonyms

2. From the killer taking the money and then not performing the hit,
because the escrow agent holds the money until the murder is verified
(according to some prototocol, such a newspaper report...again, an area for
more work, thankfully).

3. From being arrested when the money is picked up, as this is all done via
digital cash.

There are some ways to reduce the popularity of this Murder, Incorporated
system. (Things I've been thinking about for about 6 years, and which we
discussed on the list and on the Extropians list. I'll save this for
another time.)

My point here is to show how on-line clearing works in conjunction with an
escrow agent function.(Esther clears the cash, and can issue new cash to
Bob, who "trusts" her that if he does the job, the cash will clear, as
she's the escrow agent he's dealt with many times before.)


THE DANGER OF EVER USING PHYSICAL IDENITY VERIFICATION

>The other point I wanted to discuss was this issue of the bank
>authenticating the people who receive the cash.  This does raise the
>spectre of a big brother system where there is some way to identify
>people with 100% certainty.  Obviously this could be abused.

Danger! Danger! Danger! Any such system, that relies on physical IDs is
substantially less private that banks today in many countries, and is not
at all what I would call "digital cash."

On-line clearing makes this unnecessary.

>Without the authentication, you're not going to have off-line cash,
>IMO.  You will be stuck with on-line systems in which everyone has to
>verify everything before accepting it.  This means you pay a cost in
>communications overhead and possibly other foregone opportunities.

Agreed. But acceptable with a two-tiered system:

- off-line cash for small transactions, with smartcards, "observer"
protocols, and with built-in limits

- on-line , immediately-cleared cash for larger transactions, also with
various agreed-upon limits or requirements


RISKS


Is there a danger that people will lose the numbers that they need to
redeem money? That someone could steal the number and thus steal their
money?

Sure. There's the danger that I'll lose my bearer bonds, or forget my Swiss
bank account number, or lose my treasure map to where I buried my money (as
Alan Turing supposedly did in WW II).

People can take steps to limit risk. More secure computers. Dongles worn
around their necks. Protocols that involve biometric authentication to
their local computer or key storage PDA, etc. Limits on withdrawals per
day, etc. People can store key numbers with people they trust, perhaps
encrypted with other keys, can leave them with their lawyers, etc. All
sorts of arrangements can be made.

Where I'm not sure I agree with what Hal is saying is that _personal
identification_ is but one of these arrangements. Often used, but not
essential to the underlyng protocol. Again, the Swiss banks (maybe now the
Liechtenstein anstalts are a better example) don't require physical ID for
all accounts. (More generally, if Charles wants to create a bank in which
deposits are made and then given out to the first person who sings the
right tune, why should we care? This extreme example is useful in pointing
out that _contractual arrangements_ need not involve governmental or
societal norms about what constitutes proof of identity.)


PAPIEREN, BITTE

Hal goes on to talk about blinded credentials. A very important idea in our
permission slip-happy society, and an idea that is not getting nearly
enough attention. (Chaum's seminal "Transaction Systems to Make Big Brother
Obsolete," from Oct or Nov of 1985, in "Communications of the ACM," remains
required reading here.)

But I also take a more radical view. Ask yourself why credentials are
_ever_ needed. Maybe for driving a car, and the like, but in those cases
anonymity is not needed, as the person is in the car, etc.

Credentials for drinking age? Why? Let the parents enforce this, as the
argument goes about watching sex and violence on t.v. (If one accepts the
logic of requiring bars to enforce children's behavior, then one is on a
slippery slope toward requiring television set makers to check smartcards
of viewers, or of requiring a license to access the Internet, etc.)

In almost no cases do I see the need to carry "papers" with me. Maybe a
driver's license, like I said. In other areas, why?

This gets to a core issue: the incredible benefits of locally clearing a
transaction. Caveat emptor, buyer beware, etc. Cash on the barrelhead.

In transactions where "future performance" is needed, as in a contract to
have a house built, or to do some similar job, then of course the idea of
on-line or immediate clearing is bogus...like paying a stranger a sum of
money on his promise that he'll be back the next day to start building you
a house.

Parties to such long-term, non-locally-cleared cases may contract with an
escrow agent, as I described above. This is like the "privately-produced
law" we've discussed so many times. The essence: voluntary arrangements.

Maybe proofs of identity will be needed, or asked for, maybe not. But these
are not the essence of the deal. An interesting area.

I apologize if this essay, while long, is not quite long enough to capture
the ideas I wanted to express. To me, these are core ideas. Maybe not as
core to those of you who favor talking about depleted uranium sabots (but
what about Chobham armor and explosive armor?) or about "PGP rulz, d00d!,"
but core isseus to me.

Your smileage may vary.

--Tim May


..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets,
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."