Recoverable and untraceable E-cash

Recoverability and untraceability are two obviously conflicting properties. Most previous E-cash work do not include recoverability. Although the E-cash system in Schoenmakers (1997) contains recovery, it is an on-line E-cash system. We introduce a new E-cash protocol which possesses these two properties simultaneously. At the same time, it still remains off-line. Certain tradeoffs are discussed also. Our protocol is motivated by the single-term off-line untraceable E-cash systems in Ferguson (1994), and Brands (1993).