On Mon, 20 Sep 1999 at 01:52:43PM -0700, Wei Dai wrote:
> On Mon, Sep 20, 1999 at 09:02:17PM +0200, Anonymous wrote:
> > Yeah, neat idea! With b-money, newly minted value goes directly into
> > someone's account, but if it was used instead to create an anonymous
> > coin you would have an accountless system. In that case you don't even
> > need the mint for the initial phase.
>
> The account-based aspect is what enables the contract enforcement in
> b-money. You would lose that by going to an accountless system. What is the
> advantage of not having accounts (other than payer-payee unlinkability,
> which can be obtained by using Sanders-Ta-Shma as the payment subprotocol
> of b-money)?
It is good that b-money is able to include contract enforcement in the
protocol. However that means that it is a more ambitious and inclusive
system and so more of society would have to change in order to use it.
It is still worth considering how to create anonymous payment systems
which could be more compatible with other elements of present day society.
If all you want is an anonymous payment system, it seems that avoiding
accounts can increase privacy. There will be ideally no linkage between
any set of transactions with a pure anonymous cash system. With accounts
there might be some cumulative knowledge about spending patterns.
In the proposal to use the Sanders-Ta-Shma exchange with b-money, is
there a problem that payer and payee can be linked because they transfer
exactly the same amounts of money, if rounds have small granularity?
> > One problem though. For b-money, you have to expend resources equal
> > in value to the money you generate. That means that if you wanted to
> > re-create the U.S. money supply of a trillion dollars, you would have
> > to waste a trillion dollars worth of computing cycles. Not exactly an
> > attractive proposition.
>
> Unfortunately it seems unavoidable unless you have a trusted party control
> the money supply. You'd have the same problem if you used gold as the money
> supply, for example.
There could be a transition period during which some parties were trusted
(bankers, perhaps). Maybe there could be a special bank account that
people can make conventional payments to and get b-money in return.
Everyone would need to be able to monitor payments into that account.
> > What you might want to do, then, is to let people convert other forms
> > of money into these ecoins to get things going initially. Then use
> > b-money to create more if they are needed over the long term. This way
> > you avoid the huge startup costs with b-money.
>
> How do you propose letting people do this without having a trusted party?
> The only thing I can think of is broadcasting video clips of people burning
> their paper money, but it would be hard to verify the authenticity of the
> money being burnt.
Today's payment system does depend on trusted financial intermediaries
and it works OK most of the time. We could continue to rely on similar
trusted parties through the transition period. Some level of fraud
may be unavoidable, but with care it should be possible to minimize it.
After the transition then there is no longer a need for trust.
