Paper 2013/443

Optimally Anonymous and Transferable Conditional E-cash

Jiangxiao Zhang, Hua Guo, Zhoujun Li, and Chang Xu


Transferable conditional electronic-cash (e-cash) allows a payer to spend an e-cash based on the outcome not known in advance. It also allows a payee to spend the e-cash to others, or deposit the e-cash to a bank based on the future outcome. Among security properties, the anonymity of the payer has been widely studied. However, the payer is linkable in the existing conditional e-cash schemes. This paper presents the first optimally anonymous and transferable conditional electronic-cash (e-cash) system based on two recent cryptographic primitives, i.e., the Groth-Sahai(GS) proof system and the commuting signatures, to obtain the user's unlinkability and optimal anonymity. A publisher is introduced to publish the conditions, and is firstly formalized. By dividing the deposit protocol into two parts, the anonymity of the user is obtained in the deposit protocol. Compared with the existing conditional e-cash schemes, this scheme has the constant size for the computation and communication. Finally, we give the security proof in the standard model.

Note: This paper is a extended version. It adds many new properties.

Available format(s)
Cryptographic protocols
Publication info
Published elsewhere. Securecomm2012
conditional e-cash
Contact author(s)
orange_0092008 @ 163 com
2013-07-18: received
Short URL
Creative Commons Attribution


      author = {Jiangxiao Zhang and Hua Guo and Zhoujun Li and Chang Xu},
      title = {Optimally Anonymous and Transferable Conditional E-cash},
      howpublished = {Cryptology ePrint Archive, Paper 2013/443},
      year = {2013},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.