non-transferable & designated verifier signatures

[Anonymous <nobody@REPLAY.COM>]

Adam Back:

> The application you describe could be catered for very well by a third
> type of signature called a designated verifier signature.

AKA patent number 5373558 : Desinated-confirmer signature systems 
INVENTORS: Chaum; David, Sherman Oaks, CA 91403

> Non-transferable signatures on the other hand work by being made
> forgeable by the recipient.  That way it is essentially the recipients
> word against the senders.  However there is some transferable proof
> there: there is proof that _one_ of you wrote it.

Not clear how much privacy this buys you.  If one party sues the other,
it's some protection.  But if both parties are hauled into court and
accused of some crime, it's going to be clear enough which party sent
the mail.  Yes, technically it could have been forged by the other party,
but people have been convicted on evidence a lot shakier than this.

> Also you could clearly cope with the arbitrator situation without
> resorting to DV signatures; non-transferable signatures would be
> enough, if you sent a signed message to Alice, and a detached
> signature to your abitrator.  If you want to later use the abitrator,
> you send the body of the message to the arbitrator.  He calculates the
> hash of the message, and is then able to use the detatched
> non-transferable signature to verify your claim.  But he can't
> demonstrate this to other people.  One disadvantage is that the
> arbitrator could team up with you and make that two peoples words
> against one.  You might see that as an advantage, but Alice won't.  An
> arbitrator which indulged in this kind of behaviour may lose
> reputation.

Sounds complicated.  It will be years before the legal system is able
to handle these subtleties.  Ordinary digital signatures are challenging
enough.

> One way to do this for some kinds of situations is for each party to
> setup a atomic transfer where they give each other the ability to
> cause a penalty to be extracted from both of them.

Torn ecash?

> Say they are engaging in some business worth $100.  Alice is
> performing some programming task for Bob.

> If Bob is satisfied with the software he gives Alice the $100.  If he
> is not he incurs a $50 loss himself which goes to charity, and Alice
> does also.  In doing this he doesn't get the software.  But Alice is
> penalised, and it is better than losing $100.

With torn ecash, Bob withdraws $100 from his account, but in such a way
that Alice has some crucial information needed to unblind it.  If they
can't come to a meeting of the minds, Bob is out the $100 and Alice is
out the time she spent on the project.  This removes much of the incentive
each has to cheat the other, and gives them an incentive to cooperate.