Unlinkable Divisible Digital Cash without Trusted Third Party *

Abstract We present an efficient divisible digital cash scheme which is unlinkable and does not requireTrusted Third Party. The size of the coin is proportional to the size of the primes we use, i.e., hundreds of bytes. The computational and communication complexity of the protocol isproportional to a polynomial of the size of the primes and polylogarithm of the maximum number of pieces to which a coin can be subdivided. Keywords: digital cash, divisibility, unlinkability 1 Introduction Electronic cash has drawn much attention since it was introduced by Chaum [8]. Its basic ideais to provide an electronic payment scheme that ensures that the payer stays anonymous to the merchant during a transaction, yet the payer isn't able to cheat the merchant by spending false(forged) coins. Anonymity should also hold between a user and a bank (even though the bank issues thecoin, it shouldn't be able to determine which user a payment comes from, given the transcript of this payment). Additionally, in order to prevent the merchant from accepting a false coin,the scheme has to force the user to prove in a sound fashion that she uses a valid coin