Introduction to Digital Cash

Cash provides many advantages. It allows anonymous transactions, you can hoard it secretly, you don’t need to use a central clearing system to pass it on to others, and some of it even looks good. In comparison, transactions using credit cards and checks are all logged, can take days or weeks to complete, and typically require you to keep your ‘money’ in a bank account.

Next time you find your mailbox filled with junk mail, or you receive an unsolicited marketing call, there’s a good chance that it happened because someone matched your recorded spending patterns with the profile of their customers. Worse still, given the propensity of twentieth century governments to ban possession of an incredible variety of objects (even data), the police could use your perfectly legal spending patterns today to justify an armed dawn raid in the future because you match their profiles of criminals.

Recently we have heard much discussion of how the ‘Information Superhighway’ will radically change the economy of the world as more and more transactions take place on the Net. However, many of the payment systems suggested for these transactions have more in common with checks and credit cards than cash. While this is good for marketers and governments, it’s bad for those of us who prefer to avoid junk mail and maintain our privacy. What we really need is digital cash.

Digital Cash

Hal Finney has already covered the technical details of digital cash in Extropy, so I will only give a brief explanation here. In essence, physical cash (e.g., dollar bills) is an object of a specific form that is difficult to forge, typically with a unique serial number. Similarly, digital cash is a number of a specific form containing an embedded serial number. The numbers are chosen in such a fashion that the bank can easily create the numbers, and the recipient will find it easy to verify that the numbers are valid, but a forger will find it very difficult to create numbers from scratch without knowing the secret parameters of the formula that the bank uses to create them.

There are two ways in which this basic digital payment system differs from

physical cash, the first is the ability to double spend, and the second is the lack of anonymity. Double spending is very difficult, if not impossible, with physical cash because few people can copy a bank note or coin. Unfortunately, since digital cash is just a number, while it is very difficult for a forger to create new valid cash, it is extremely easy for someone to keep a copy of the cash they used to pay for goods and then to spend it again buying something else.

To prevent double spending the majority of proposed digital cash systems require that after each transaction the cash is returned to the bank to verify that no one has spent it before. This requirement creates the anonymity problem. Physical cash transactions are anonymous because it would be very time-consuming for a bank to record the serial numbers of all cash issued and deposited in order to link buyer and seller. In any case the cash will probably have changed hands several times before it returns for deposit. With our simple payment system, however, it is trivial for the issuing computer to store the serial numbers. If the cash must be returned to the bank after a single transaction, the bank can easily use the serial numbers to link buyers and sellers.

True digital cash therefore must explicitly provide anonymity. The most widely known anonymous implementation is ‘Chaumian’ digital cash, invented by David Chaum of DigiCash BV in the Netherlands. Chaum’s system allows the person (or computer) withdrawing the cash to choose a random serial number; the size of this number can be set large enough to make the probability of two people picking the same number as close to zero as desired. They then pick a second random number, and multiply the two together before sending the result to the bank. The bank ‘signs’ this product to create valid digital cash, and then returns it to the customer, who by using some clever mathematics can then ‘divide out’

the random multiplier. As such, when the cash returns to the bank it will be impossible to link the serial number to the original withdrawal.

Current Implementations

Currently there is no true anonymous digital cash implementation that can be used to buy and sell goods on the Net. There are however two experimental implementations of Chaum’s system. The

first is Ecash, a full implementation with GUI, from DigiCash BV, and the second is ‘Magic Money’, free code written by the pseudonymous ‘Product Cypher’.

Ecash is currently in beta-test, and provides a GUI allowing the user to withdraw cash from their bank account.

When they attempt to buy information that requires payment the seller’s machine will automatically connect to the Ecash client, which will request payment from the user. If they agree to pay, then the cash is removed from their local storage and passed on to the seller, who verifies with the bank that it is valid.

Magic Money comes as C source, and wrappers allow a ‘bank’ server to be set up on an Internet-connected machine so that it can automatically deal with encrypted client messages as they arrive. Apart from the lack of a full interface, the current software differs from Ecash in that it relies on the users storing their cash locally rather than in a centralised account on the server. This is perfectly safe as long as the cash is encrypted with a secure algorithm.

There are other electronic payment systems available on the Net that can be used for real transactions, such as NetCash and First Virtual, however at this time they do not provide full anonymity in transactions. The Mondex system currently being tested in the UK (a joint venture between British Telecom, National Westminster Bank, and Midland Bank) reportedly provides anonymous transactions. However it appears to rely for security on the use of tamper-resistant smartcards, which could allow significant potential for fraud if the hardware is reverse-engineered.

EXTROPY #15 (7:2) 2nd-3rd Quarter 1995

14

The Future

Unfortunately neither anonymous digital cash implementation is currently backed with anything (though there was an attempt at one stage to create a Magic Money server whose cash was backed with a cache of Diet Coke). Hence today you cannot go out and buy goods on the Net with digital cash.

In my opinion, there are two main reasons for this. The first is due to banking regulations that make it difficult to set up digital cash systems backed with physical cash. The second is technical, in terms of ease-of-use (which the Ecash software is addressing), security (the algorithms are secure in theory, but if there are errors in the theory then early adopters could lose much money), and the complexity of a large-scale clearing system.

It seems likely that many governments will be reluctant to relax their banking regulations to allow the use of anonymous digital cash rather than credit cards and checks or fully tracked electronic payment systems. The primary reason for this is the supposed value of digital cash to the “Four Horsemen Of The Infocalypse”: drug dealers, terrorists, money launderers and child pornographers. While it is true that there is some value to them, will banning the use of digital cash harm them more than legitimate users?

It seems clear that the answer is no. As with other failed attempts to enforce laws against victimless crimes (e.g., gun ownership, self-medication), any attempt to prevent criminals from acquiring and using the technology will merely ensure that only the criminals will have access to it. Just as the personal computer and laser printer have made it possible for anyone to become a publisher, digital cash makes it possible for anyone to become a bank, whether they are a major corporation or a street-corner drug dealer with a laptop and cellular telephone. The only requirement is that they have a good Net link and will pay up when requested. Indeed, as national debts continue to increase, many people might see an advantage in using cash backed with, say, cocaine instead of cash backed solely by a government’s ability to collect taxes.

The next question is: will digital cash make life easier for criminals? Some people have predicted that with a combination of anonymous digital cash, anonymous remailers, and pseudonyms, we will see the appearance of assassination markets, untraceable kidnappings, and worse.

In practice, while digital cash will

not make life harder for the professional criminal, there are many pitfalls that will still trip up the unwary amateur. For example, one of the limitations of Chaum’s Ecash system is that it only protects the identity of the buyer, not the seller. While the bank and seller cannot collude together to identify the buyer, the buyer and bank can (though slight modifications to the protocol can prevent this).

As a result, anyone who naively threatened to blow up the World Trade Center and demanded a million dollar digital cash ransom would have the cops breaking down their door within hours of depositing it. They would also have to demonstrate an ability to carry out their threat, which would allow the use of traditional

extremely useful, and that its potential for criminal misuse is overrated. Given that governments are still not likely to relax their regulations without a very good reason, the final question is how would we expect digital cash to appear?

One possible avenue would be offshore banks in countries with fewer regulations than the US or most of Europe. They could potentially link into one of the credit card networks to allow users to withdraw physical cash from standard ATM machines, and they would deposit or withdraw digital cash over the Net. It would be possible for governments to restrict dealings with offshore banks, but that would create significant economic effects as multinationals and foreign in-

Some form of digital payment system is essential if the Net is to achieve its potential as a global marketplace.

investigative methods to trace them. Similarly, kidnappers would have to kidnap someone, and assassins would have to assassinate someone. The use of remailers and pseudonyms would also make entrapment much easier for the police: They could pseudonymously put up a contract, accept offers from potential assassins, then wait for the assassins to show up to do the job.

A further problem that would reduce any advantage of digital cash for criminals would be the potential for fraud. This would also be a potential problem for legitimate users, but someone who is buying supposed stealth bomber plans from a pseudonym through remailers would find it difficult to seek recompense if the seller merely took the money and ran.

There are a number of ways to reduce this risk, the most likely being a combination of reputation and the use of escrow agents. For example, sellers can request satisfied customers send them a signed document stating that they received what they paid for, or automated servers could be set up to accept positive or negative votes on a seller’s reliability. Customers can then use this reputation to decide with whom they wish to do business. Escrow agents would accept a payment from the buyer, and wait until they had received the goods from the seller before passing on the money.

So, it seems clear that digital cash is

vestors took their money out of the country.

At the other end of the scale, small groups might decide to set up local digital cash systems (e.g., using Magic Money), backed with something other than physical cash. For example, a BBS might allow users to buy access time with digital cash denominated in “access hours”, users would then be free to pay each other with this for, say, writing software. Other possibilities might include the increasingly common barter or labor-trading schemes around the world, which could create their own digital currencies. Once these came into existence it would seem almost inevitable that soon a system would be set up to allow exchange of currencies.

Some form of digital payment system is essential if the Net is to meet its potential as a global marketplace. It seems likely that there will be numerous specialised systems and a few widely accepted systems, and the provision, or lack, of anonymity will have significant economic effects. Fortunately we will fulfil the Net’s full potential only with an anonymous system such as digital cash. However governments who benefit from tracking transactions may feel that the law enforcement benefits are worth the economic loss, and so may restrain the growth of digital cash systems.

[See bottom of next page for Notes]

15

EXTROPY #15 (7:2) 2nd-3rd Quarter 1995