Achieving Electronic Privacy A cryptographic invention known as a blind signature permits numbers to serve as electronic cash or to replace conventional identification. The author hopes it may return control of personal information to the individual by David Chaum very time you make a telephone murderers have tracked down their tar­ cessors capable of carrying out the nec­ call, purchase goods using a cred­ gets by consulting government-main­ essary algorithms have already been it card, subscribe to a magazine tained address records. On another lev­ embedded in pocket computers the size or pay your taxes, that information goes el, the U.S. Internal Revenue Service has and thickness of a credit card. Such sys­ intoE a data base somewhere. Further­ attempted to single out taxpayers for tems have been tested on a small scale more, all these records can be linked audits based on estimates of house­ and could be in widespread use by the so that they constitute in effect a sin­ hold income compiled by mailing-list middle of this decade. gle dossier on your life-not only your companies. medical and financial history but also The growing amounts of information he starting point for this ap­ what you buy, where you travel and that different organizations collect proach is the digital Signature, whom you communicate with. It is al­ about a person can be linked because first proposed in 1976 by Whit­ most impossible to learn the full extent all of them use the same key-in the field Diffie, then at Stanford University. of the files that various organizations U.S. the sodal security number-to iden­ AT digital signature transforms the mes­ keep on you, much less to assure their tify the individual in question. This iden­ sage that is signed so that anyone who accuracy or to control who may gain ac­ tifier-based approach perforce trades reads it can be sure of who sent cess to them. off security against individual liberties. it [see "The Mathematics of Public-Key Organizations link records from dif­ The more information that organiza­ Cryptography," by Martin E. Hellman; ferent sources for their own protec­ tions have (whether the intent is to pro­ SCIENTIFIC AMERICAN, August 1979l. tion. Certainly it is in the interest of tect them from fraud or simply to tar­ These signatures employ a secret key a bank looking at a loan application get marketing efforts), the less privacy used to sign messages and a public one to know that John Doe has defaulted and control people retain. used to verify them. Only a message on four similar loans in the past two Over the past eight years, my col­ signed with the private key can be ver­ years. The bank's possession of that leagues and I at CWI (the Dutch na­ ified by means of the public one. Thus, information also helps its other cus­ tionally funded Center for Mathemat­ if Alice wants to send a signed message tomers, to whom the bank passes on ics and Computer Science in Amster­ to Bob (these two are the cryptographic the cost of bad loans. In addition, these dam) have developed a new approach, community's favorite hypothetical char­ records permit Jane Roe, whose pay­ based on fundamental theoretical and acters), she transforms it using her pri­ ment history is impeccable, to establish practical advances in cryptography, vate key, and he applies her public key a charge account at a shop that has that makes this trade-off unnecessary. to make sure that it was she who sent never seen her before. Transactions employing these tech­ it. The best methods known for produc­ That same information in the wrong niques avoid the possibility of fraud ing forged signatures would require hands, however, provides neither pro­ while maintaining the privacy of those many years, even using computers bil­ tection for businesses nor better service who use them. lions of times faster than those now for consumers. Thieves routinely use a In our system, people would in ef­ available. stolen credit card number to trade on fect give a different (but definitively To see how digital signatures can their victims' good payment records; verifiable) pseudonym to every organi­ provide all manner of unforgeable cre­ zation they do business with and so dentials and other services, consider make dossiers impossible. They could how they might be used to provide an pay for goods in untraceable electronic electronic replacement for cash. The DAVII) CHAUM is head of the Cryptog­ cash or present digital credentials that First Digital Bank would offer electron­ raphy Group at the Center for Mathe­ serve the function of a banking pass­ ic bank notes: messages signed using matics and Computer Science (CWI) in Amsterdam. He is also a founder of Digi­ book, driver's license or voter registra­ a particular private key. All messages Cash, which develops electronic payment tion card without revealing their iden­ bearing one key might be worth a dol­ systems. Chaum received his Ph.D. in tity. At the same time, organizations lar, all those bearing a different key five computer science from the University of would benefit from increased security dollars, and so on for whatever denom­ California, Berkeley, in 1982 and joined and lower record-keeping costs. inations were needed. These electronic CWI in 1984. He helped to found the Recent innovations in microelectron­ bank notes could be authenticated using International Association for Cryptolog­ ics make this vision practical by pro­ the corresponding public key, which the ic Research and remains active on its board; he also consults internationally viding personal "representatives" that bank has made a matter of record. First on cryptology. store and manage their owners' pseud­ Digital would also make public a key onyms, credentials and cash. Micropro- to authenticate electronic documents 96 SCIENTIFIC AMERICAN August 1992 © 1992 SCIENTIFIC AMERICAN, INC sent from the bank to its customers. When Alice wants to pay for a pur­ This system is secure, but it has no . To withdraw a dollar from the bank, chase at Bob's shop, she connects her privacy. If the bank keeps track of note Alice generates a note number (each "smart" card with his card reader and numbers, it can link each shop's de­ note bears a different number, akin to transfers one of the signed note num­ posit to the corresponding withdrawal the serial number on a bill); she choos­ bers the bank has given her. After veri­ and so determine precisely where and es a lOO-digit number at random so fying the bank's digital signature, Bob when Alice (or any other account hold­ that the chance anyone else would gen­ transmits the note to the bank, much as er) spends her money. The resulting erate the same one is negligible. She a merchant verifies a credit card trans­ dossier is far more intrusive than those signs the number with the private key action today. The bank reverifies its now being compiled. Furthermore, rec­ corresponding to her "digital pseud­ signature, checks the note against a list ords based on digital signatures are onym" (the public key that she has pre­ of those already spent and credits Bob's more vulnerable to abuse than conven­ viously established for use with her ac­ account. It then transmits a "deposit tional files. Not only are they self-au­ count). The bank verifies Alice's signa­ slip," once again unforgeably signed thenticating (even if they are copied, ture and removes it from the note with the appropriate key. Bob hands the information they contain can be number, signs the note number with its the merchandise to Alice along with his verified by anyone), but they also per­ worth-one-dollar signature and debits own digitally signed receipt, complet­ mit a person who has a particular kind her account. It then returns the signed ing the transaction. of information to prove its existence note along with a digitally signed with­ This system provides security for all without either giving the information drawal receipt for Alice's records. In three parties. The signatures at each away or revealing its source. For exam­ practice, the creation, signing and trans­ stage prevent any one from cheating ple, someone might be able to prove in­ fer of note numbers would be carried either of the others: the shop cannot controvertibly that Bob had telephoned out by Alice's card computer. The pow­ deny that it received payment, the bank Alice on 12 separate occasions without er of the cryptographic protocols, how­ cannot deny that it issued the notes or having to reveal the time and place of ever, lies in the fact that they are se­ that it accepted them from the shop any of the calls. cure regardless of physical medium: for deposit, and the customer can nei­ I have developed an extension of digi­ the same transactions could be carried ther deny withdrawing the notes from tal signatures, called blind signatures, out using only pencil and paper. her account nor spend them twice. that can restore privacy. Before send- CREDIT MERCH ANT'S ACCOUNT $1; BALANCE $100.001 �613rc0375293 7349432 02693154J MERCHANT'S7 390621 ACCOUNT43616 NO. 040682759 5 �734613rc' 31540375 j3 7 3906219432 436160269 DIGITAL CASH flows tracelessly from bank through con­ signature indicating its value. The bank credits the merchant's sumer and merchant before returning to the bank. Using a account when the note is presented for payment. A technique small computer "representative," a person creates a random known as a blind signature prevents the bank from seeing the number to serve as a bank note.