Since their discovery, e-cash systems have drawn attention of many scientific minds in cryptography. Developments in this branch of cryptography led to most famous cryptocurrency in the world – Bitcoin. Nowadays authors tend to propose transactions based on e-cash system, rather than focusing on check transactions. The following challenges for e-cash systems were pointed out by many authors (Pfitzmann and Köhntopp, 2001; Rosenberg, 2010; Eng and Okamoto, 1994; Chaum et al., 1988; Chaum and Pedersen, 1992; Kreft and Adi, 2006; Muleravičius et al., 2016):

Since e-cash is now considered a digital analogue of regular money, any proposed system of this type should satisfy the following main properties:

One of the crucial drawbacks of an e-cash system is the rapid growth of the data throughout its transfers. The latter point plays a major role in the effectiveness of the e-cash system. However, for a long time it was ignored by many proposed systems. According to Chaum and Pedersen (1992), the amount of data transferred among users through any divisible, offline and anonymous e-cash system is growing in size due to the information needed to store in order to ensure double spending prevention, divisibility and other properties.

Nevertheless, some alternative e-cash systems were proposed that managed to avoid the growth of the e-cash data (D’Amiano and Di Crescenzo, 1994; Okamoto, 1995). However, as mentioned in Chan et al. (1998), Tsiounis (1997), those e-schemes had other issues such as the limit of the total size of payments or lack of efficiency of e-cash protocols. In Fuchsbauer (2009) an attempt was made to construct a transferable e-cash scheme without the aforementioned data growth problem. However, it was later outlined in Waters (2005), Fuchsbauer (2009) that there was still a dramatic increase in the size of the public key.

A new direction in the development of offline e-cash systems without the data growth drawback was established when Brand first presented an e-wallet scheme using observers in Brands (1993). He proposed the idea of bank’s trustee for the purchaser (e.g. a chip implemented in a purchaser’s mobile device) which allows to perform payments without the online connection to the bank. However, the cryptographic security of Brand’s e-cash system was never proven and hence the system was never initiated.

Another problem that often takes place in divisible, anonymous, offline e-cash systems is the lack of proof of the security of a complex cryptographic system. According to Rosenberg (2010), the majority of divisible e-cash systems to this day “use proofs about double-discrete logarithms and require similar sequences of primes in their setup”. It was noted in Brands (1993) and Cramer and Shoup (2003), the decisional Diffie–Hellman (DDH) assumption is needed to prove the cryptographic security of a number of previously proposed protocols. This comes from the fact that the Diffie-Hellman key exchange (Diffie and Hellman, 1976) cannot be proved secure in any reasonable and standard way just based on the computational Diffie–Hellman (CDH) assumption: the DDH assumption is required.

In Petersen and Poupard (1997) an efficient payment system with anonymity revocation and trusted third party (TTP) was presented. It was the first scheme that managed to achieve an offline prevention of all possible extortion attacks. Due to the system’s scalable security and efficiency, secure realizations for an internet payment scheme as well as a highly efficient payment scheme for electronic purse applications were developed on the basis of this scheme. The system also incorporated a possible way to revoke anonymity using the collaboration of a judge and the bank if a malicious purchaser was to be detected (Stadler et al., 1995). The judge could be implemented in a Purchaser’s smart device. However, it should be protected to ensure Purchaser’s anonymity.

This paper considers an offline, divisible, anonymous and transferable e-cash system with observers operating in the environment with TTP (the bank), which was previously presented in Sakalauskas et al. (2018). Detailed description of our scheme is presented in Sections 2.1–2.3. The analysed e-money system does not possess the data growth problem addressed above due to the utilization of observers. We also perform analysis of several attack scenarios, which include existential forgery of data by both parties (Purchaser and Vendor) of our system in Section 3. In Section 4 we show that both parties can trust each other. This analysis relies on the so-called BAN logic presented in Burrows et al. (1989) (hence it was named after the authors).

In this section we present a novel e-cash system with observers based on Schnorr identification and modified ElGamal e-signature. These cryptographic primitives are often implemented due to their provable security. Our e-cash system satisfies such e-cash system properties as divisibility, anonymity, offline payment, transferability and double-spending prevention requirements. To provide offline payment property and bypass the growth of the transferred e-cash data the implemented cryptographic bank’s trustee Observer (i.e. cryptographic chip) is used.

Presented e-cash system is executed between the following parties: the Bank (B), the Purchaser (P), the Vendor (V) and their Observers ( O P and O V respectively). Our e-cash system operates using withdrawal, payment and deposit protocols described in detail in Sections 2.1–2.3.

The general parameters and functions used in the proposed e-cash scheme are presented in Table 1 below:

Our e-cash system consists of Withdrawal, Payment and Deposit protocols. These protocols are presented below and are executed in order of presentation.

In this section we consider security of our scheme against adaptive inside adversary, i.e. we assume that an attacker is a legitimate user (Purchaser or Vendor) of the proposed system and hence has his own mobile device with an Observer and pre-generated data as described above. We consider the following attack scenarios:

To start our analysis we first focus on the Attack of MP scenario, i.e. actions, which can be executed by a dishonest Purchaser to benefit from the deal with an honest Vendor.

The prevention of double spending is guaranteed by Shnorr identification, i.e. upon receiving the same transaction twice the Vendor can recover the Purchaser’s identity by calculating the following expression: (1) r i ( 2 ) − r i ′ ( 2 ) r i ( 1 ) − r i ′ ( 1 ) = Id P , where responses r i ( 1 ) and r i ( 2 ) were received during the first sending whereas responses r i ′ ( 1 ) and r i ′ ( 2 ) were received during the second sending of the same transaction. The validity of (1) is proven in Sakalauskas et al. (2018). Note that expression (1) is calculated modulo q.

To consider forgery of the data by MP we recall the data sent during Payment protocol to the Vendor:

Trustworthiness of the proposed e-cash system is analysed using Burrows–Abadi–Needham (BAN) logic. BAN logic was first presented in Burrows et al. (1989) and is a set of rules that can be used to define and analyse the trustworthiness of a cryptographic protocol. BAN logic seeks to determine whether the exchanged information between different parties is trustworthy from malicious insiders such as malicious bank, vendor, purchaser or others. BAN logic starts with a set of goals that are to be proven, and relies on the assumptions which should be made and used as a basis for the proof. The main BAN logic notations are presented below.

Firstly, as mentioned above, the proposed scheme uses the following parameters:

Purchaser’s parameters: PrK p = x P , PuK p = { G , A P = G x P }.

Purchaser Observer’s parameters: PrK O = x O , PuK O = { G , A O = G x O }.

We are going to keep original notation for parameters ξ i ( 1 ) , ξ i ( 2 ) , A P Id P , w i ( 1 ) , w i ( 2 ) , N i ( 1 ) , N i ( 2 ) , S i ( 1 ) , S i ( 2 ) , S i ( 3 ) , S i ( 4 ) in order to provide clarity for further analysis.

In order to check the correctness and security of our payment protocol, we will set the following goals: G1:

The Vendor believes in the validity of the received payment: V | ≡ m i .

By applying the message meaning rule and assumption A3 we obtain: V | ≡ P | ∼ [ ( m i ′ | | t i ′ ) , A P ( m i ‖ t i ‖ Id V ) · g ξ i ( 1 ) , A P Id P · A P ( m i ‖ t i ‖ Id V ) · g ξ i ( 2 ) , A P ( m i ‖ t i ‖ Id V ) ] , i.e. the Vendor believes that it was the Purchaser, who sent him the specified data. Moreover, it follows from assumption A3 and concatenation rules that, due to correct values of total price m i and the time instance t i , it is the Purchaser, who is interested in acquiring the goods: V | ≡ P | ∼ [ ( m i | | t i ) , A P ( m i | | t i ) · g ξ i ( 1 ) , A P Id P · A P ( m i | | t i ) · g ξ i ( 2 ) , A P ( m i | | t i ) ] , V | ≡ P | ∼ ( m i | | t i ) .

We now apply the nonce-verification rule: V | ≡ P | ⇒ m i | | t i , V | ≡ O P ⇒ Id p , and hence the Vendor trusts that the Purchaser obtained the desired sum m i from the Bank at the time t i , i.e. the Purchaser has jurisdiction to spend this sum of money. Furthermore, the Vendor also believes that the Bank has the jurisdiction over the Purchaser via his representative (Observer O P ). Furthermore, the Vendor believes that the Purchaser knows his identity: V | ≡ P ⊲ Id p . Finally, using jurisdiction, control and referencing to the rules above, the Vendor trusts the Purchaser’s identity: V | ≡ Id p . The second goal V | ≡ P now follows from the proven results V | ≡ Id p and V | ≡ m i , since Vendor trusts the Purchaser‘s identity and fairness (the sum m i is not forged).

Now we consider the third goal. Due to M5, the Purchaser sees the following information received from the Vendor: P ⊲ [ Id V , { Id V m i | | t i } A O ] .

Note that the Vendor received this data from his Observer, implying that: V ⊲ [ Id V , { Id V m i | | t i } A O ] .

By applying the message meaning rule, concatenation rule, and assumption A4 we obtain: P | ≡ O V | ∼ [ Id V , { Id V m i | | t i } , A O ] , i.e. the Purchaser believes that it was the Vendor’s Observer, who generated the signature. Moreover, it follows from assumptions A4 and concatenation rules that, due to correct values of total price m i and the time instance t i , the Purchaser is dealing with an honest Vendor: P | ≡ O V | ∼ Id V . We now apply the nonce-verification rule: P | ≡ O V | ⇒ Id V . Hence, the Purchaser believes that the Vendor’s Observer has jurisdiction over the Vendor. Furthermore, due to this fact, the Purchaser trusts that the Vendor knows his identity since his Observer possesses this information: P | ≡ V ⊲ Id V , P | ≡ O V ⊲ Id V .

Finally, using jurisdiction, control and referencing to the rules above, the Purchaser trusts the Vendor’s identity: P | ≡ Id V . Hence, the validity of the third goal P | ≡ V now follows from the proven results.

Since the considerable amount of payment operations is performed in Observer having restricted computation resources, the effectivity of proposed e-wallet system depends on the estimation of the operation time.

The computation time is directly related with the processor’s clock frequency. If processor is running at 1 GHz clock frequency, then its clock cycle takes 10 − 9 s = 1 n s time.

The arithmetic operations required to perform a payment protocol is multiplication and addition together with shifting operation all performed in the registers of Observer. We name those operations as elementary operations.

We assume that 32 bits’ microprocessor is used in Observer. It is far less than the bit length of variables used in payment protocol represented by 2048 bit integers. Without the loss of generality, we assume that all elementary operations take one clock cycle.

The most time consuming operation is the exponentiation modulo p of length in 2048 bits. For the assessment of computation time, firstly, we must estimate the number of elementary operations required for the calculation of the modular exponent function r = g k mod p.

According to Knuth (1981), Hwang et al. (2005), the modular exponent function is computed using addition chain method (Knuth, 1981). The formulas to find the number of those operations are the following: MOD E ( k , p ) = 1 , 5 · l ( k ) [ M ( l ( p ) ) + 2 Mod ( l ( p ) ) + 1 ] , where: M ( w ) = 3 M ( w / 2 ) + 5 A ( w ) + 2 S , A ( w ) = w / 32 , Mod ( w ) = Mod ( w / 2 ) + 4 M ( w / 2 ) + 1 , 5 A ( w ) + 3 S .

The bit lengths of the variables in our scheme are presented in Table 3.

By default, we take 82 clock cycles for SHA-2 computation (Guilford et al., 2012).

After the number N of clock cycles is found, the operation time can be estimated in the following way: Time = N · T, where T = 1 / F and F is a clock frequency. We assume F = 1.6 GHz in further steps for the demonstration of calculations results.

By Hinterwälder et al. (2013, 2015) all Brands e-cash protocols take about 2966 ms in all protocols generated in cards. By Au et al. (2007) the computational time of CHL e-cash protocol in single payment is 30 modular exponentiations and takes about 2111 ms by Juang (2010) approximations, but it’s cost of each operation is somehow hard to compute because it depends of how many transactions have been made before and how many coins will be used. The comparison of our system with Brands and CHL systems is presented in Table 4.

Hence, our system requires approximately the same computation time, while its functionality has a significant advantage with respect to others.

In Table 5 we present a comparison of some offline payment e-cash systems and explore such properties as: transferability, traceability, data growth and anonymity (against Vendor and Bank). However, each of these systems possesses the flaw of money growth in size when transferred. Furthermore, any previously presented e-cash system, which eliminates this flaw, also loses anonymity against Vendor or other offline payment properties.

As it can be seen, our e-cash system has the following functional advantages: anonymity against Vendor, offline payment, divisibility, transferability and double-spending prevention requirements, and most important one – data does not grow in size when transferred.

Based on the presented comparison we conclude that our system stands out from the other systems since it possesses similar characteristics as those schemes while also avoiding a drawback of growing in size. Furthermore, it has better or approximate computation time if compared to other schemes presented in Table 5.

Proposed offline, divisible, anonymous and transferable e-cash system with observers is analysed in few ways: an existential forgery, trustworthiness analysis using BAN logic, and computation time comparison using addition chain method is provided.

Our transferable e-cash system does not possess the data growth in size problem due to the usage of observers.

The estimated execution time of all three protocols is 2535 ms, independently of how many e-cash has been spent.

All these characteristics allows us to claim that proposed e-cash system is adequate to medium payment usage.