<p>Here's the basic idea of blind signing in Chaumian e-cash:</p>

<p>Let's suppose that a central issuer (Chaumian e-cash is centralised) has <strong>an account in my name with a value of 10 dollars</strong>.  In order to "withdraw" this money as 1-dollar "bills" I begin by generating ten random serial numbers, each long enough that I can be reasonably sure no one else will generate the same numbers.</p>

<p>I am going to have the central issuer sign <strong>a message saying these are now worth one dollar each</strong>, only I don't want the issuer to know which bill is which (otherwise they could just match up outgoing and incoming serial numbers to know who I spent it with, since Chaumian e-cash can only be spent once before it has to be re-issued).</p>

<p>So in addition to the serial numbers I also choose secret <strong>'blinding factors'</strong> and combine them with my serial numbers.  I give these blinded serial numbers to the central issuer, and they sign each one with their 1-dollar key (they have different keys for different denominations) and reduce the amount in my account with them accordingly.  They know how many 1-dollar bills they signed, but they don't know what serial numbers were on each bill they signed.</p>

<p>Now, the trick with "blind signing" comes in.  Because of how blind signing works, I can now remove the blinding factor, but I still have a valid signed message which can be verified using the issuer's public key.  This gives me <strong>a signed one dollar bill with its own serial number</strong> that the bank doesn't know (but they do know <em>how many</em> one dollar bills they have signed, because each one can only be un-blinded to a single serial number).</p>

<p>Now, to spend the bills to someone else, I simply show them the <strong>un-blinded, signed serial number</strong>.  They must now immediately "cash in" this token by going to the central issuer and showing them the signed serial number.  The central issuer verifies the signature using their "1 dollar" key, records the serial number, and credits the new person's account.  From their perspective, <strong>this dollar is indistinguishable from any other they have issued in the past</strong>.</p>

<p>However, if someone else shows up and tries to cash in the same dollar again, they will not honour it because they have already recorded the serial number as spent.  You also cannot spend a $1 serial number as a $50 serial number because $50 serial numbers use a different key.</p>

<p><strong>More details about e-cash, including an "offline mode" that relies on trusted hardware, can be found <a href="http://www.cs.bham.ac.uk/~mdr/teaching/modules06/netsec/lectures/DigitalCash.html">here</a></strong>.  They use a different method of ensuring a $1 bill is not spent as a $50 bill--I don't remember which variant is whose but there are several of them which basically accomplish the same thing in slightly different ways.</p>

CC BY-SA 4.0
2022-12-28T20:12:11.557Z
What's the difference between the issuer's public key and their 1 dollar key? 
My understanding: Bank use their 1 dollar private key to encrypt/sign the blinded serial number. I unblind it which gives me a different serial number that is signed/encrypted by the bank. One can use the bank's public key to get the unblinded serial number which confirms it was encrypted using bank's private key which is the same public key banks use to validate and send $. So banks have the blinded number as deposit and unblinded number as withdrawal in their records but don't know they're linked.
tcui222
CC BY-SA 4.0
2022-12-28T20:12:41.183Z
And any number decrypt able by the bank's 1$ public key (thats not used yet), is valid $ according to the bank?
tcui222
CC BY-SA 3.0
2013-05-07T13:53:31.460Z
2013-05-07T13:53:31.460Z
eMansipater
<p>I'm trying to learn how <a href="http://en.wikipedia.org/wiki/Chaum_digital_cash">Chaum-style ecash worked</a> specifically how:</p>

<blockquote>
  <p>"the issuer does a blind signature on a serial number"</p>
</blockquote>

<p>I tried looking up on Wikipedia but the page is pretty light on the details, and all the pages don't work (even the Wayback machine pages are broken)</p>

<alternatives>
How does Chaum style e-cash work? (all the Wiki links are broken)
makerofthings7
# How does Chaum style e-cash work? (all the Wiki links are broken)

(Asked by: username_0 on 2013-04-11)

I'm trying to learn how [Chaum-style ecash worked](http://en.wikipedia.org/wiki/Chaum_digital_cash) specifically how:

> "the issuer does a blind signature on a serial number"

I tried looking up on Wikipedia but the page is pretty light on the details, and all the pages don't work (even the Wayback machine pages are broken)

**Tags:** alternatives


---

## 1 answers

### Answer by username_1 on 2013-05-07. Score: 28 | Accepted answer

Here's the basic idea of blind signing in Chaumian e-cash:

Let's suppose that a central issuer (Chaumian e-cash is centralised) has **an account in my name with a value of 10 dollars**. In order to "withdraw" this money as 1-dollar "bills" I begin by generating ten random serial numbers, each long enough that I can be reasonably sure no one else will generate the same numbers.

I am going to have the central issuer sign **a message saying these are now worth one dollar each**, only I don't want the issuer to know which bill is which (otherwise they could just match up outgoing and incoming serial numbers to know who I spent it with, since Chaumian e-cash can only be spent once before it has to be re-issued).

So in addition to the serial numbers I also choose secret **'blinding factors'** and combine them with my serial numbers. I give these blinded serial numbers to the central issuer, and they sign each one with their 1-dollar key (they have different keys for different denominations) and reduce the amount in my account with them accordingly. They know how many 1-dollar bills they signed, but they don't know what serial numbers were on each bill they signed.

Now, the trick with "blind signing" comes in. Because of how blind signing works, I can now remove the blinding factor, but I still have a valid signed message which can be verified using the issuer's public key. This gives me **a signed one dollar bill with its own serial number** that the bank doesn't know (but they do know *how many* one dollar bills they have signed, because each one can only be un-blinded to a single serial number).

Now, to spend the bills to someone else, I simply show them the **un-blinded, signed serial number**. They must now immediately "cash in" this token by going to the central issuer and showing them the signed serial number. The central issuer verifies the signature using their "1 dollar" key, records the serial number, and credits the new person's account. From their perspective, **this dollar is indistinguishable from any other they have issued in the past**.

However, if someone else shows up and tries to cash in the same dollar again, they will not honour it because they have already recorded the serial number as spent. You also cannot spend a $1 serial number as a $50 serial number because $50 serial numbers use a different key.

**More details about e-cash, including an "offline mode" that relies on trusted hardware, can be found [here](http://www.cs.bham.ac.uk/~mdr/teaching/modules06/netsec/lectures/DigitalCash.html)**. They use a different method of ensuring a $1 bill is not spent as a $50 bill--I don't remember which variant is whose but there are several of them which basically accomplish the same thing in slightly different ways.

> **Comments:**
> **username_2**: What's the difference between the issuer's public key and their 1 dollar key?  My understanding: Bank use their 1 dollar private key to encrypt/sign the blinded serial number. I unblind it which gives me a different serial number that is signed/encrypted by the bank. One can use the bank's public key to get the unblinded serial number which confirms it was encrypted using bank's private key which is the same public key banks use to validate and send $. So banks have the blinded number as deposit and unblinded number as withdrawal in their records but don't know they're linked.  
> **username_2**: And any number decrypt able by the bank's 1$ public key (thats not used yet), is valid $ according to the bank?  

---

