<p>There has been a lot of work done in this area. A good survey is the first chapter of "Handbook of Financial Cryptography and Security" (for the crypto) and the seventh chapter (for a survey of technologies). </p>

<p>The first scheme to prevent double spending and not require a public global transcript is, to my knowledge, by Chaum, Fiat and Naor [Crypto 88]. In their model, users obtain digital cash that is unlinkable to their identity but if they double spend the coin, then with high probability it will reveal their identity when the coins are eventually returned to the bank. CFN is very inefficient and there has been much work on improving it.</p>

CC BY-SA 3.0
2011-07-07T01:23:51.407Z
thanks for the reference! I looked through chapter 1, and it seems like all the systems surveyed require a central issuing authority (they also assume that this authority can be trusted). One of the fun features of bitcoins is that the system has no mint or bank (or alternatively the network of all the users is the mint). Do you know any results that don't rely on a trusted mint? Or does this not generate much interest in the e-cash community?
Artem Kaznatcheev
CC BY-SA 3.0
2011-07-11T13:32:18.853Z
Oh I see, you are looking for a decentralized mint/bank without a public transcript? I am not aware of such a scheme (nor a compelling reason why it would be impossible). There are schemes with one of the two properties obviously (bitcoin and its predecessors, and CFN and it successors respectively). It seems difficult to achieve both but its an interesting problem that seems open.
PulpSpy
CC BY-SA 3.0
2011-07-06T14:22:18.450Z
2011-07-06T14:22:18.450Z
PulpSpy
<p>A recent approach to creating a decentralized online currency, called <a href="http://www.bitcoin.org/bitcoin.pdf" rel="noreferrer">Bitcoin</a>, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without double spending or counterfeiting. Their approach is to have all the nodes in the network try to verify a transaction by doing a proof-of-work computation and then the transactions with the most verification are considered official. If an attacker wants to forge the official record (to reverse their first spending and use the coin again), then they must have the majority of the computing power in the network. The biggest downside is that in this scheme, the record of all transactions must be public, which the author assumes is a must:</p>
<blockquote>
<p>The only way to confirm the absence of a transaction is to be aware of all transactions. In the mint based model, the mint was aware of all transactions and decided which arrived first.  To accomplish this without a trusted party, transactions must be publicly announced</p>
</blockquote>
<p>Is it obvious that all transactions must be publicly known in any such scheme? More broadly: is there any cstheory/crypto research on decentralized digital currencies or related ideas?</p>
<h3>Notes</h3>
<p>I <a href="https://crypto.stackexchange.com/q/508/617">cross-posted to crypto.SE</a> after a <a href="https://cstheory.meta.stackexchange.com/q/1293/1037">meta discussion</a>.</p>

CC BY-SA 3.0
2011-06-28T15:24:47.260Z
The 2nd chapter of the thesis "Formal and computational cryptography : protocols, hashes and commitments" (http://dare.ubn.kun.nl/dspace/handle/2066/40158) can be of interest.
Oleksandr Bondarenko
CC BY-SA 3.0
2013-11-07T00:55:38.877Z
This post is being discussed [on this reddit thread](http://www.reddit.com/r/compsci/comments/1q1bgk/to_preventing_double_spending_in_decentralized/).
Neal Young
<reference-request><cr.crypto-security>
Bitcoin and preventing double spending in decentralized digital currencies
Artem Kaznatcheev
# Bitcoin and preventing double spending in decentralized digital currencies

(Asked by: username_0 on 2011-06-28)

A recent approach to creating a decentralized online currency, called [Bitcoin](http://www.bitcoin.org/bitcoin.pdf), has been generating some interest. The goal is to have a way to transfer currency without a central authority and without double spending or counterfeiting. Their approach is to have all the nodes in the network try to verify a transaction by doing a proof-of-work computation and then the transactions with the most verification are considered official. If an attacker wants to forge the official record (to reverse their first spending and use the coin again), then they must have the majority of the computing power in the network. The biggest downside is that in this scheme, the record of all transactions must be public, which the author assumes is a must:

> The only way to confirm the absence of a transaction is to be aware of all transactions. In the mint based model, the mint was aware of all transactions and decided which arrived first. To accomplish this without a trusted party, transactions must be publicly announced

Is it obvious that all transactions must be publicly known in any such scheme? More broadly: is there any cstheory/crypto research on decentralized digital currencies or related ideas?

### Notes

I [cross-posted to crypto.SE](https://crypto.stackexchange.com/q/508/617) after a [meta discussion](https://cstheory.meta.stackexchange.com/q/1293/1037).

**Tags:** reference-request, cr.crypto-security

> **Comments:**
> **username_1**: The 2nd chapter of the thesis "Formal and computational cryptography : protocols, hashes and commitments" (http://dare.ubn.kun.nl/dspace/handle/2066/40158) can be of interest.  
> **username_2**: This post is being discussed [on this reddit thread](http://www.reddit.com/r/compsci/comments/1q1bgk/to_preventing_double_spending_in_decentralized/).  

---

## 1 answers

### Answer by username_3 on 2011-07-06. Score: 5

There has been a lot of work done in this area. A good survey is the first chapter of "Handbook of Financial Cryptography and Security" (for the crypto) and the seventh chapter (for a survey of technologies).

The first scheme to prevent double spending and not require a public global transcript is, to my knowledge, by Chaum, Fiat and Naor [Crypto 88]. In their model, users obtain digital cash that is unlinkable to their identity but if they double spend the coin, then with high probability it will reveal their identity when the coins are eventually returned to the bank. CFN is very inefficient and there has been much work on improving it.

> **Comments:**
> **username_0**: thanks for the reference! I looked through chapter 1, and it seems like all the systems surveyed require a central issuing authority (they also assume that this authority can be trusted). One of the fun features of bitcoins is that the system has no mint or bank (or alternatively the network of all the users is the mint). Do you know any results that don't rely on a trusted mint? Or does this not generate much interest in the e-cash community?  
> **username_3**: Oh I see, you are looking for a decentralized mint/bank without a public transcript? I am not aware of such a scheme (nor a compelling reason why it would be impossible). There are schemes with one of the two properties obviously (bitcoin and its predecessors, and CFN and it successors respectively). It seems difficult to achieve both but its an interesting problem that seems open.  

---

