anonymous cash without blinding

[Wei Dai <weidai@eskimo.com>]

With all this talk about Chuam patents, I would like to remind people 
that blind signatures are not absolutely essential to an anonymous 
digital cash system.  You can combine a traceable cash system with an 
anonymous communication system in a fairly obvious way to get a 
fully (both payer and payee) anonymous cash system.

Suppose a bank is running a digital cash system that works like this: it 
maintains a database of valid coins, and whenever someone presents it 
with a valid coin (string of bytes) it erases that coin from its 
database, and then either gives the person an equivelent amount of paper 
cash or a newly created coin(s) of the same value.

Now if the bank allows this exchange of old coins for new coins to be 
done over an anonymous network (e.g., a remailer-net), then the system is 
anonymous as long as you don't move physical money in or out of the system.
Maintaining anonymity when moving physical money in and out of the system is 
what blinding helps you to do, but this will be less useful in a fully 
digital economy where such movement will be infrequent.

Wei Dai