密码算法与协议8_盲签名协议分析.ppt

Chapter 8.Blind Signatures and E-Payment 邱卫东 qiuwd@sjtu.edu.cn Introduction A digital signature scheme provides the basic functionality of authentication of messages, allowing the holder of a private key to produce signatures on arbitrary messages. In many applications, however, there is a need for cryptographic schemes which are similar to digital signatures but not quite the same. The group signatures of Section 5.5.3 are an example. In this chapter, we will consider blind signature schemes as another variation. Electronic payment system Suppose we like to build an electronic payment scheme in which a bank issues electronic money to users who may then spend it at various shops. In such a scheme the bank issues electronic money by sending the users signed messages saying “This is a banknote worth $10. Serial number: P01144099135.” To spend the electronic money at a shop, the user will include such an electronic banknote in a payment to the shop. Since these banknotes are trivial to duplicate, however, the shop needs to deposit any received banknotes immediately at the bank to make sure that these banknotes have not been spent already at some other shop. Electronic payment system The bank keeps a database containing all spent banknotes, and each banknote can be used for payment only once. If a payment to a shop contains a banknote that was already spent before, the payment is rejected. Now, a basic property of any such payment scheme is that the bank is able to track exactly at which places a user spends its money. This is due to the fact that in a digital signature scheme the signer gets to see all the messages it signs, and obviously, the signer knows all the signatures it produces for these messages. Anonymity of electronic payment system To achieve the level of anonymity as provided by cash payments using (metal) coins, where payment transactions need not leave any trace about the identity of the payers, one may use blind signatures instead of