Advanced applications and protocols 381
Untraceability. If the coin were to be trace able, the User’s identity must
somehow be coded into the coin’s signature. But even though the User
requires his identity I to create the coin (in particular the number A), his
identity is hidden unless the Bank or any other third party can find the
User’s random value s, which is itself hidden by the discre te logarithm
problem.
Anonymity. The Shop has the six values that co mprise the coin, as well as
the triple d, r
1
, r
2
. But none of these values enable the Shop to identify
the User: the values I and U cannot be obtained as they are safely
hidden by virtue of the discrete logarithm problem. Also, the va lues
that comprise the coin aren’t seen by the Bank until the ...