Electronic Cash with Blind Deposits: How to Have No Spare Change

Abstract

Electronic cash schemes in which the bank authenticates many coins at once suffer from the problem that coins that are authenticated together can be linked to one another. Unfortunately, unless a user spends coins in a closely prescribed manner, different batches of coins ("wallets") will be linked together in these schemes. This is illustrated by the problem of what a customer does with the "spare change" - an unusable small amount of money left in a wallet. We propose a new protocol to be used in e-cash schemes: blind deposits. In a blind deposit, a customer returns a coin to the bank without revealing the coin. We present a secure and efficient e-cash scheme with this added feature based on that of Liskov-Micali [LM01].