Traceable Decentralized Anonymous E-Cash System Against Active Attackers

Decentralized e-cash schemes such as Bitcoin have seen widespread adoption due to the elimination of dependence on trusted authorities. However, the decentralization property also brings difficulties on privacy preserving and auditing. Although several approaches have been suggested to support anonymity, none of them has a reliable anonymity revocation mechanism. We fill this gap by presenting a novel e-cash scheme called traceable decentralized anonymous e-cash (TDAE). In TDAE, the transactions can be publicly verified, and the identities of the payers and payees are hidden from everyone except a designated authority. Moreover, we consider active attackers who can corrupt selected authorities along with many users within the e-cash system. We present rigorous security definitions for a TDAE scheme, ensuring that even an active attacker cannot spend more money than he owns, neither can he frame any user that is not corrupted. We also provide a secure generic construction of a TDAE scheme. This construction is built upon several basic cryptographic tools, and thus it enables one to obtain a TDAE with better security and efficiency when advantageous tools are available.