Analogy: carbon (copy) paper inside an envelope


Given the following commutative inverse functions:


  1. Provider chooses an that is verifiable (), and sends the encrypted to the signer
  2. Signer performs the signature and sends it back to the provider
  3. Provider removes the encryption layer via
  4. A validator can check the signature via

Payment Flow

  • Payer generates a bunch of s, each of which represent (eg) $1
  • Forwards all to the bank
  • The bank signs them:
  • Payer performs
  • Payer hands to a payee
  • Payee runs the public check
  • Payee sends to the bank
  • Bank checks that
  • Banks records that was spent, and updates balances


  • The bank does know who the payer and payee are at the end
  • and must be treated as (shared) secrets
  • Payer or payee can attempt to double spend