cut & choose

[Alex Strasheim <alex@omaha.com>]

-----BEGIN PGP SIGNED MESSAGE-----

In Applied Cryptography, Schneier describes digital cash protocols that
depend on the cut and choose method:  Alice prepares 100 anonymous money
orders for $100, sends them all to the bank, which opens all the envelopes
except one picked at random.  If the 99 envelopes checked have money
orders for $100, then the bank is confident that the one they sign blindly
will be for $100 as well. 

Chaum's system uses different keys for different denominations.  Alice 
only sends one envelope, and the bank uses its $100 key to sign it.

I don't understand why anyone would use the cut and choose protocol over 
denominated keys.  Chaum's method seems a lot cleaner to me and more 
secure.  It obviously uses less bandwidth.  What am I missing here?

==
Alex Strasheim | finger astrashe@nyx.cs.du.edu
alex@omaha.com | for my PGP 2.6.1. public key

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBLudoHxEpP7+baaPtAQFIiwQAsCc/TYI/cgJyGf6AtykBGgu+qJJ+peM6
/IYXnUzrIeFLx54nRjsUOUFYJs6Uu3vu6s2BRbd2/YIJVaY6/kP4HO0zuMhqFn2z
4eddRverUeH59IZgZ+4Va4/rgfn5hRdNSOgNinIyk0aRsa8ulR+cmJdUYqggHgd5
w2dxkAtDSGM=
=fzJT
-----END PGP SIGNATURE-----