From: Hal <hfinney@shell.portal.com>
Date: Sun, 2 Jan 94 16:38:42 PST
To: cypherpunks@toad.com
Subject: Re: Anonymous video on demand
Message-ID: <199401030038.QAA28203@jobe.shell.portal.com>
MIME-Version: 1.0
Content-Type: text/plain


Of course, with tamper-proof chips this problem can be solved easily.
You don't need oblivious transfer.  Rather, you get digital tokens from
the video provider which you pass on to the tamper-proof decryption
chip, where each token is worth a certain amount of decryption.  Then
you choose which movies you want to decrypt.

The only question would be whether the tamper-proof chip would keep a
record of your viewing habits.  But you should be able to monitor anything
it transmits (if it has to transmit anything) and it should not have to
send any encrypted messages.  So your secrets should be safe.

One problem with this approach (and the other ones we have discussed)
is that the vendor loses any information about which movies are most
watched, which hurts his ability to set prices and choose which movies
to carry.  Perhaps he could resort to a separate anonymous
public-opinion poll to determine this info (protected with is-a-person
(is-a-customer?) credentials so that our friend Detweiler can't
pseudo-spoof with his multiple tentacles ;-).

Or, perhaps another approach is to have a different decryption key for
each movie, and to simply sell those keys to anonymous buyers.  They would
then load them into their decryption boxes.  This does seem vulnerable to
pirating the keys, though.  Piracy could be avoided if the decryption keys
were stamped with the serial number of the particular tamper-proof decryption
box they were for (so that they would only work with that one box).  But
then you lose the anonymity.  I'm thinking that some form of blinding could
be used to produce a key which would only be accepted by one box, but for
which the movie seller would not be able to determine which box it was for.
This is very similar to the requirement for electronic cash, and I think a
similar idea would work.  This solution also is a nice example of the uses
of anonymous networks.  I wonder whether the NII could support DC-nets? :)

Hal