Anonymity Control in E-Cash Systems



	George Davida (University of Wisconsin-Milwaukee)
        Yair Frankel (CERTCO, NY, NY. Research performed while at
	Sandia National Labs)
        Yiannis Tsiounis (GTE Labs, Waltham MA. Research performed
	while at Northeastern University, Boston, MA)
             	Moti Yung (CERTCO, NY, NY)


			Abstract

Electronic cash, and other cryptographic payment systems, offer some
level of user anonymity during a purchase, in order to emulate
electronically the properties of physical cash exchange.

However, it was noted that there are crime-prevention situations where
anonymity of notes is undesirable, and in addition there may be
regulatory and legal constraints limiting anonymous transfer of funds.
Thus, pure anonymity to users may be, in certain settings,
unacceptable and thus a hurdle to the progress of electronic commerce.

The conceptual contribution of this work is based on the claim that
given the legal, social, technical and efficiency constraints that are
imposed, anonymity should be treated as a {\em Control Parameter\/}
facilitating flexibility of the level of privacy of note holders
(determined by the dynamic conditions and constraints).
We review ``anonymity control'' which provides the balance between
strong anonymity for the user and anonymity revocation for
crime prevention and legal compliance.

In light of this parameterization, we review recently developed
technical tools for tracing and anonymity revocation (e.g., owner
tracing and coin tracing).  We elaborate on the differences in the
various technologies with respect to security assumptions, and we
discuss practical considerations of computational, bandwidth and
storage efficiency requirements for user, shop, bank and trustees as
well as whether the trustees must be on-line or off-line.

We also claim that while anonymity revocation can potentially reduce
crime, it can also produce instances where the severity of the crime
is increased as criminals try to social engineer around tracing
revocation and suggest a solution. To prevent this we suggest the
notion of ``distress cash,'' a way to activate law enforcement tracing
in an un-noticeable fashion.

On the technical side, we provide efficiency improvements to a protocol
for coin tracing and point at a technical solution for distress cash.