  Humanitarian aid-distribution programs help bring physical goods to people in
need. Traditional paper-based solutions to support aid distribution do not
scale to large populations and are hard to secure. Existing digital solutions
solve these issues, at the cost of collecting large amount of personal
information. This lack of privacy can endanger recipients' safety and harm
their dignity. In collaboration with the International Committee of the Red
Cross, we build a safe digital aid-distribution system. We first systematize
the requirements such a system should satisfy. We then propose a decentralized
solution based on the use of tokens that fulfills the needs of humanitarian
organizations. It provides scalability and strong accountability, and, by
design, guarantees the recipients' privacy. We provide two instantiations of
our design, on a smart card and on a smartphone. We formally prove the security
and privacy properties of these solutions, and empirically show that they can
operate at scale.
