No Subject

It is interesting that the situation is so symmetrical.  Given
collusion with the bank by the other party, with regular ecash we
protect Alice's but not Bob's anonymity.  With this "reverse ecash" we
protect Bob but not Alice.  (Alice is the payor, Bob the payee.)

If people were allowed to exchange coins anonymously, either system
will provide anonymity for both parties.  (In the reverse ecash system
Alice hands the the blinded proto-coins along with some regular coins
to the bank and receives blinded new coins.)

Earlier there was discussion of an ecash coin-exchanging service
("Charlie") designed to provide payee anonymity in the regular ecash
system.  Bob would send his newly-received coins to Charlie along with
blinded proto-coins.  Charlie would then exchange them at the bank and
send the new (blinded) coins back to Bob.  Charlie and Bob can be
anonymous to each other, but Bob has to trust Charlie with his coins.

A similar service would work for the reverse ecash system to protect
Alice's anonymity.  Bob blinds some proto-coins and sends them to
Alice, who further blinds them and sends them to Charlie along with
some regular coins of the same values.  Charlie exchanges the regular
coins for new coins using the doubly blinded proto-coins.  He gives the
blinded coins back to Alice, who unblinds them and gives them to Bob,
who removes the last blinding to reveal the valid coins.  It is Alice
in this protocol who has to trust Charlie with her coins.

Hal