Re: How can e-cash, even on-line cleared, protect payee identity?

[Hal <hfinney@shell.portal.com>]

tomw@orac.engr.sgi.com (Tom Weinstein) writes:

>Perhaps the problem is that Bob insists that Alice's coin was not signed
>by the bank.  In that case, how about this modification?  Alice should
>first show Bob the doubly blinded coin she gave to the bank and the
>signed doubly blinded coin she received back.  Bob can verify the
>signature and then Alice can give him the blinding factor so he can
>unblind it himself.  Bob also needs to sign the singly blinded coin that
>he gives to Alice so that Alice can later show that she gave him the
>correct blinding factor if Bob tries to claim that she didn't.

The problem with this is that Bob and the bank can now collude to trace
Alice, since he sees what she sent to the bank.  This is not as bad as in
the forward traceability case of regular ecash, because it happens after
Alice has completed her bank transaction, rather than before, but it
would be better to be untraceable since that is the whole point of this
variation.

Hal