Anonymous Internet Banking - The Underlying Mathematics

The Underlying Mathematics

Anonymous internet banking depends on the mathematics of public key cryptography and blind signature algorithms. In this simple example we have Alice and Bob and a banker. The banker generates an RSA public key with modulus, where and are large primes, making a semiprime. As described in RSA operation, the bank also generates public key exponent and private key exponent .

Bob asks the banker for a $100 deposit slip in anticipation of Alice wanting to transfer money to him. To generate a deposit slip the bank selects a large, globally unique random number and encrypts it using the bank's public key; this means that it can only be decrypted with the bank's secret key:

This encrypted value is sent to Bob with the promise to deposit $100 into his account when Bob sends the value back to the bank. The bank is confident that Bob won't be able to break RSA to generate from within the heat death of the universe without knowledge of, so it does not worry about handing out the deposit slips without receiving anything from Bob.

When Alice wants to pay Bob $100 she asks for the deposit slip and Bob sends her . Alice selects a large random value coprime with (so as to have an inverse modulo ) and uses it to blind and sends it to the bank to be blind signed. The Bank charges Alice $100 for this operation and returns the blind signed value . Due to the symmetric properties of RSA, this provides her with :

Because of the blinding process, the Bank is not able to associate with or, so it is unable to determine that Bob and Alice are doing business together, preserving the anonymity of the transaction. Alice unblinds (by dividing it by ) to generate the original value, which she sends to Bob. Bob verifies that can be encrypted with the bank's public key by computing, which means that Alice has deposited $100 into the bank. Bob then sends this value to the bank and the bank checks its records to be sure that has not been already used. If it has not, it deposits $100 into his account and updates its database that the unique value has been redeemed.

Different public keys can be used for different denominations of currency so this system doesn't take appreciably longer for large transactions.

Note that if neither Alice nor Bob wishes the bank to know that they performed a transaction with each other, then it is hard for the bank to find out. However, in order to ensure this is the case many people need to be making transactions at the same time. Otherwise the bank can figure it out by the timing of the transactions, using traffic analysis.