From: hfinney@shell.portal.com
Date: Sat, 16 Apr 94 14:32:25 PDT
To: cypherpunks@toad.com
Subject: Blind signature cash patents
Message-ID: <199404162133.OAA05438@jobe.shell.portal.com>
MIME-Version: 1.0
Content-Type: text/plain


A little while ago someone posted about a new company that would do patent
searches via email requests.  For another week they are doing free searches
as an introductory offer.  I did a search on blind-signature based cash
systems, and these are the patents it found.  This might be useful for those
considering implementing electronic cash.  Full text of patents are available
for $4.95.  The kind of search I did for free will cost $149 after another
week.  People are allowed 3 searches per day for free until then.

For more info send a message with just "help" in the body to
spo_patent@spo.eds.com.

Hal


2     04977595   19901211    380/24       Method and apparatus for implementing
                                          ++electronic++ ++cash++
Inventor: Ohta; Kazuo 
Assignee: Nippon Telegraph and Telephone Corporation 
Abstract:
      In an ++electronic++ ++cash++ implementing method, a user makes a 
  ++bank++ apply a ++blind++ signature to user information Vi produced, by a 
  one-way function, from secret information Si containing identification 
  information, thereby obtaining signed user information. Further, the user 
  makes the ++bank++ apply a ++blind++ signature to information containing 
  authentication information Xi produced, by a one-way function, from random 
  information Ri, thereby obtaining signed authentication information. The 
  user uses an information group containing the signed user information, the 
  signed authentication information, the user information and the 
  authentication information, as ++electronic++ ++cash++ for payment to a 
  ++shop++. The ++shop++ verifies the validity of the signed user 
  information and the signed authentication information, and produces and 
  sends to the user an inquiry. In response to the inquiry the user produces 
  a response Yi by using secret information and random information and sends 
  it to the ++shop++. Having verified the validity of the response the 
  ++shop++ accepts the ++electronic++ ++cash++. 

3     05224162   19930629    380/24       ++Electronic++ ++cash++ system
Inventor: Okamoto; Tatsuaki 
Assignee: Nippon Telegraph and Telephone Corporation 
Abstract:
      In an ++electronic++ ++cash++ system, K sets of ++blind++ signature 
  information are derived from secret information containing identification 
  information of a user, K/2 sets of them are opened and a ++bank++ attaches 
  a ++blind++ signature to the remaining K/2 sets of information. The user 
  obtains a signed license from the ++blind++ signature. The user generates 
  ++blind++ signature information from the license and a desired amount of 
  money and gets a ++blind++ signature of the ++bank++ to the ++blind++ 
  signature information and obtains ++electronic++ ++cash++ signed by the 
  ++bank++ from the ++blind++ signature. The user presents to a ++shop++ a 
  residue power root of a node in a money hierarchial structure and the 
  ++electronic++ ++cash++, corresponding to the amount of money to be used, 
  and the ++shop++ verifies their validity and, if they are valid, offers 
  inquiry information to the user. The user offers, as response information, 
  a residue power root of the node corresponding to the amount of money to 
  be used to the ++shop++. The ++shop++ verifies the validity of the 
  response information and, if it is valid, acknowledges the payment with 
  ++electronic++ ++cash++ of the amount of money to be used. 

4     04759063   19880719    380/30       ++Blind++ signature systems
Inventor: Chaum; David L. 
Abstract:
      A cryptographic system allows, in one exemplary use, a supplier to 
  cryptographically transform a plurality of messages responsive to secret 
  keys; the transformed messages to be digitally signed by a signer; and the 
  signed transformed messages returned to the supplier to be transformed by 
  the supplier, responsive to the same secret keys, in such a way that a 
  ++digital++ signature related to each original message is developed by the 
  supplier. One important property of these systems is that the signer 
  cannot determine which transformed message received for signing 
  corresponds with which ++digital++ signature-even though the signer knows 
  that such a correspondence must exist. 

6     04914698   19900403    380/30       One-show ++blind++ signature systems
Inventor: Chaum; David 
Abstract:
      Numbers standing for ++cash++ money can be ++spent++ only one time 
  each, otherwise the --account-- from which they were ++withdrawn++ would 
  be revealed. More generally, a technique for issuing and showing ++blind++ 
  ++digital++ signatures ensures that if they are shown responsive to 
  different challanges, then certain information their signer ensures they 
  contain will be revealed and can be recovered efficiently. Some 
  embodiments allow the signatures to be unconditionally untraceable if 
  shown no more than once. Extensions allow values to be encoded in the 
  signatures when they are shown, and for change on unshown value to be 
  obtained in a form that is aggregated and untraceable. 

11    04949380   19900814    380/30       Returned-value ++blind++ signature
                                          systems
Inventor: Chaum; David 
Abstract:
      A payer party obtains from a signer party by a ++blind++ signature 
  system a first public key ++digital++ signature having a first value in a 
  withdrawal transaction; the payer reduces the value of the first signature 
  obtained from the first value to a second value and provides this 
  reduced-value form of the signature to the signer in a payment 
  transaction; the signer returns a second ++digital++ signature to the 
  payer by a ++blind++ signature system in online consummation of the 
  payment transaction; the --paper-- derives from the first and the second 
  signature a third signature having a value increased corresponding to the 
  magnitude of the difference between the first and the second values. 
  Furthermore, the following additional features are provided: payments are 
  unlinkable to withdrawals; a ++shop++ between the payer and signer can be 
  kept from obtaining more value than desired by the payer; the first value 
  need not be revealed to the signer or intermediary in the payment 
  transaction; the returned difference can be accumulated across multiple 
  payment transactions; and the returned difference can be divided between a 
  plurality of payment transactions. 

19    04759064   19880719    380/30       ++Blind++ unanticipated signature
                                          systems
Inventor: Chaum; David L. 
Abstract:
      An improved ++blind++ signature system not requiring computation 
  during ++blinding++ for anticipating which of a plurality of possible 
  signatures will be made during signing, while still allowing the 
  ++blinding++ party to unblind and recover the unanticipated kind of 
  signature on what was ++blinded++. An exemplary embodiment ++blinds++ by 
  forming a product including a plurality of generators raised to powers 
  normally secret from the signing party, and unblinds by forming a product 
  with the multiplicative inverse of a signed form of the generators raised 
  to the original powers. Re-blinding allows a signature on a value to be 
  transformed into a signature on a particular ++blinded++ form of the 
  value. 

23    04206315   19800603    380/23       ++Digital++ signature system and
                                          apparatus
Inventor: Matyas; Stephen M. 
Assignee: International Business Machines Corporation 
Abstract:
      A ++digital++ signature machine provides a simplified method of 
  forming and verifying a signature that is appended to a ++digital++ 
  message. A sender transmits a signature with the usual signature keys and 
  with validation table entries that correspond to the unsent keys and with 
  the compressed encoding of the next validation table. The receiver uses 
  the compressed encoding of the next validation table to form validation 
  table entries from the signature keys so that the receiver has a full 
  validation table. This validation table is compressed and compared with 
  the compressed encoding which was received from the sender in a preceding 
  message.