\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%               ordinal number of the lecure
%               date of the lecure
%               lecturer
%               scribe---that is you
%
\lecture{22}{November 21, 1996}{Ron Rivest}{David Shapiro}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem}
% \begin{definition} ... \end{definition}
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following:
% 1) Prepare your figures using your favourite graphic editor
%       for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
%       notes-nn-fig-mm.ps where nn is the number of the lecture you
%       are scribing and mm is the sequential number of the picture in the
%       notes
% 3) Insert the following block in your LaTeX code in the place you
%       want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
%       at the beginning of the line) since it will not work on athena:
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
%       of course the picture will not show up when you compile and
%       print your notes, but don't worry the TA will take care of it.
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%       files for the figures as well
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Handouts}
One Handout
\begin{itemize}
\item Handout 33: Readings for Lecture 22
\end{itemize}

\section{Anonymous Digital Cash}

Today's lecture is based on the reading {\em Untraceable Off-line Cash in 
Wallets with Observers}, by Stefan Brands.  In this system, spenders are 
anonymous, but the banks can catch double-spenders.

\section{Background Math}

Define $q$ to be prime, such that we can also define $p$ to be prime and
\[
        p = 2q + 1\footnote{All math from here on out will be mod p.}
\]

For example, $q = 5$ and $p = 11$.  Continuing with this example, we
also have
\[
        Z^*_{p} = \{2,4,8,5,10,9,7,3,6,1\}
\]
From here, we can easily find a sub-group of size $q$ by choosing any
element from $Z^*_{p}$ (with the exception of 1) and using it as a
generator.  So, now we have
\[
        G_q = \{4,5,9,3,1\} = \{g^x: 0 \leq x \leq q-1\}
\]
where $g$ is an element of $G_q$, such as 4.

The set $G_q$ is closed under multiplication.  All members (except 1) are of 
order $q$.

Finally, note that solving $y= g^x$ for $x$ given $g$ and $y$ is a Discrete Log
Problem (DLP), which is a hard problem.

\section{Coins}

Let $g_1$, $g_2$, and $g$ be generators of $G_q$.  All three are publicly 
known.  The primes $p$ and $q$ are also public.

Alice is said to know a representation of $y$ if she knows any $x_1$, $x_2$ 
such that 
\[
        y = g_1^{x_1} g_2^{x_2}
\]
There are multiple possible representations of $y$.

Since solving the Discrete Log Problem is hard, finding two representations
for a given $y$ is also hard.  ($g_1$ and $g_2$ must be randomly chosen.  That 
is, there is no known relationship between them.)

A coin is a pair (A,B) such that Alice knows the representations of both A 
and B.  A and B are two numbers of the form shown as $y$ above.

\section{The Bank}
The bank has a secret $x$.  The bank's public key is $h=g^x$.

Alice has a secret $u_1$, which she created.  The bank knows $g_1^{u_1}=I$.  
I is her Identifier.  It is used by the bank to detect double-spending.
Alice computes
\[
        Z = (Ig_2)^x = g_1^{u_{1}x} g_2^x
\]
This means that Alice knows a representation of I$g_2$

\section{Withdrawal Protocol -- Omitting Blinded Signatures}

We need to have a coin that is anonymous, and yet if the user double-spends 
we want to be able to compute I and catch him or her.  The protocol 
works as follows.

First, Alice picks $s$, $x_1$, and $x_2$ from $Z_q$ at random.  She then 
computes
\[
        A = g_1^{u_1 s} g_2^s = (Ig_2)^s
\]
\[
        B = g_1^{x_1} g_2^{x_2}
\]
In other words, Alice knows a representation for A and B.  Finally,
the coin is constructed by forming the triplet $(A,B,sig_{bank})$.  The 
signature of the bank is a blind signature, and is detailed below.  For now, 
it is sufficient to say that the bank has signed A,B but has not seen them.  
Furthermore, the bank is satisfied that they were constructed in the format 
as shown above.

\section{Payment Protocol}

The payment protocol is basically a challenge-response system.
\begin{eqnarray}
Alice & \stackrel{A,B,sig}{\rightarrow}                 & Vendor \nonumber \\
Alice & \stackrel{d}{\leftarrow}               & Vendor \nonumber \\
Alice & \stackrel{\stackrel{r_1 = du_{1}s + x_1(mod q)}{r_2 = ds +
x_2(mod q)}}{\rightarrow}   & Vendor \nonumber
\end{eqnarray}
where
\[
   d = Hash (A, B, VendorID, date/time)
\]

A hash function is used here instead of just a random value so that Alice and 
a corrupt vendor cannot collude to cheat the bank.  In order for the bank to 
be able to catch double-spenders, it must have unique challenge-response 
transcripts for each transaction.  If a vendor (or a group of vendors) 
continuously pick the same random value, the bank gets no information that 
will help it prevent double-spenders.  Since a hash is used, each transaction 
will have a different $d$.

At this point, the vendor checks to make sure that
\[
        g_1^{r_1} g_2^{r_2} = A^d B(mod p)
\]

This is basically asking Alice to show the vendor a representation of A and B.


\section{Deposit Protocol}
If Alice's response passed the challenge, then the Vendor completes the 
transaction by sending the information on to the bank.
\[
        Vendor \stackrel{(A,B,sig),d,r_1,r_2}{\rightarrow} Bank
\]

\section{Catching Double Spending}

Suppose Alice double-spends.  The bank will see two coins with the same A,B.

The bank has
\begin{eqnarray}
(A, B, sig_{bank}), d, (r_1, r_2), VendorID \nonumber \\
(A, B, sig_{bank}), d', (r_1', r_2'), VendorID' \nonumber
\end{eqnarray}

The bank can then compute the two subtractions (assuming $d$ and $d'$ are 
different, so that $d-d'\not=0$)
\[
\begin{array}{lrrrclrrr}
  & r_1 & = & d(u_1 s) + x_1  & \hspace{.75in} &  & r_2 & = & ds + x_2 \\
- & r_1' & = & d'(u_1 s) + x_1  & & - & r_2' & = & d' s  + x_2 \\
\cline{2-4} \cline{7-9}
  & r_1 - r_1' & = & u_1 s (d - d')(mod q) & & & r_2 - r_2' & = & s 
(d - d')(mod q)
\end{array}
\]

Dividing the result on the left by the one on the right, it gets
\[
\frac{r_1 - r_1'}{r_2 - r_2'} = u_1
\]

In this manner, the bank has just computed Alice's secret key.  In order to 
figure out whose key it is, the bank must compute 
\[
I = g^{u_1} = account\ number
\]

The computed value of I will indicate that Alice was the double-spender.

Under this system, the bank has to keep track of every coin that comes in.  
For each coin (A,B), it must be checked against all previously seen coins to 
detect double-spending.

This system is not information-theoretically secure, it is only 
computationally secure.  It relies on the fact that the Discrete Log Problem 
is difficult.  If you could find multiple representations for a (A,B) then 
you could cheat this system.

\section{Schnorr Signatures}

The signature mechanism used by this system is Schnorr Signatures.  A generic 
Schnorr signature system works as follows.

Each user has a secret key, $x$, and a public key $h=g^x$.
For a message $m$, the signature is 
\[
Sig = (a,b)
\]
such that 
\[
g^b = h^c a
\]
where $c$ is hash($m$,$a$).

To generate a signature calculate
\[
a = g^w
\]
where $w$ is a random number mod $q$.
To compute $b$
\[
        g^b = h^c a
\]
\[        
	g^b = g^{cx} g^w
\]
\[
	b = cx + w(mod q)
\]

\section{Blinding a Schnorr Signature}
In this system, the bank makes a blinded signature to preserve the anonymity 
of the user.

First, 
\[
User \stackrel{a=g^w}{\leftarrow} Bank
\]
The user then picks at random $\alpha_1$, $\alpha_2$ from $Z_q$.
\[
a' = a^{\alpha_1} \cdot g^{\alpha_2}
\]
\[
c' = hash(m, a')
\]
\[
c = c' + \alpha_2
\]
\[
User \stackrel{c}{\rightarrow} Bank
\]
The bank can compute
\[
b = cx + w
\]
\[
User \stackrel{b}{\leftarrow} Bank
\]
The user can compute 
\[
g^b = h^c a 
\]
to check that the signature is valid.

For
\[
b' = b + \alpha_1
\]
(a',b') is also a signature, because 
\[
g^{b'} = h^{c'}a'
\]

In this manner the bank has blindly signed a message for the user.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
