Recently, a concrete and reasonably efficient construction based on digital coins was proposed. A disadvantage is that the accused buyer has to participate in any trial protocol to deny charges. Trials with direct non-repudiation, i.e., the merchant alone holds enough evidence to convince an arbiter, are more useful in real life. This is similar to the difference between ``normal'' and ``undeniable'' signatures.
In this paper, we present an equally efficient anonymous fingerprinting scheme with direct non-repudiation. The main technique we use, delayed verifiable encryption, is related to coin tracing in escrowed cash systems. However, there are technical differences, mainly to provide an unforgeable link to license conditions.
Category / Keywords: cryptographic protocols / Date: received 26 Jun 2000, revised 26 Jun 2000, revised 26 Jun 2000 Contact author: sadeghi at cs uni-sb de Available format(s): Postscript (PS) | Compressed Postscript (PS.GZ) | BibTeX Citation Version: 20000626:212237 (All versions of this report) Short URL: ia.cr/2000/032 Discussion forum: Show discussion | Start new discussion