Compact E-Cash with Efficient Coin-Tracing

AbstractCompact E-cash achieves an efficient system by withdrawing ${\text{2}}^{n}$2n coins within $O{\text{(1)}}$O(1) operations and storing the coins in $O(n)$O(n) bits. For preventing a double-spender from cheating again, it is necessary to trace his e-coins. So full-tracing in compact E-cash system means tracing double-spender and tracing his coins. However, the efficiency problem caused by coin-tracing without TTP (trusted third party) has not been solved. For solving this problem, we introduce a non-standard construction into zero-knowledge proof of payment protocol, which leaks coin information when double-spending but is proven to be perfect zero-knowledge to verifier when spending a coin only once. Therefore, it achieves tracing dishonest users’ coins and preserving the anonymity of honest users. Comparing with the existing most efficient method of coin-tracing without TTP, we improve computational complexity from $O(k)$O(k) to $O{\text{(1)}}$O(1) with less storage space. In addition, to improve efficiency and practicality further, batch-spending (spending any number of coins in one operation) and compact-spending (spending all coins in one operation) had been proposed. Based on the non-standard zero-knowledge proof, our scheme provides more efficient batch/compact–spending. Moreover, we also make a comparison with Bitcoin and Bitcoin Lightning Network, which have attracted considerable attention.