Reading the article in the Whole Earth Review reminded me of our discussions several months ago about digital cash. I would be interested in seeing an implementation of digital cash suitable for email or Internet use. Chaum is working on "off-line" cash systems, where you don't have to check with the bank for every transaction. But I think there are problems with this in the network environment. The big issue in digital cash is double-spending. Someone could send the same piece of cash to more than one seller. (We say "double-spending" but really it could be triple- or worse.) Each seller can check that the cash was properly signed by the bank and not a forgery, but if they honor the cash only one of them can be reimbursed by the bank. On-line systems require the sellers to check with the bank to make sure a particular piece of cash has not been spent before. As long as the bank handles such queries sequentially, and adds each piece of cash to a database of "spent cash" as it sends an "OK" response back to a seller, then each piece of cash can only be spent once. Double-spending is prevented. Off-line systems are more complicated. They are designed so that the anonymity of the spender is lost if the cash is double-spent. This is achieved by having an exchange of messages between seller and spender, in which the seller specifies some random information and the spender responds based on the seller's message. Chaum's fancy mathematics guarantees that the spender's anonymity is protected if he only uses each piece of cash once. But if he uses it twice, the random information will be different for each transaction, and this will cause him to reveal more information about himself, enough information that the bank can deduce his identity. This process is problematical in the Internet environment, though. The need for a protocol between spender and seller might be tolerable for systems with direct TCP connections, but the universe of potential users of cash is much larger than this. I think it will be necessary for cash to work just via email. And in that case the requirement for three messages (spender to seller, seller to spender, spender to seller) for every transaction will be very cumbersome. Also, if double-spending is discovered it's not clear what you do about it. Ideally, if the customer has a large enough bank balance to cover the extra spending the bank can just dip into the account (once the customer's anonymity is broken by Chaum's algorithms) and pay off the sellers. But if this is not the case then it isn't clear who would take the loss or what legal redress the bank would have against the customer. All this seems to require some legal infrastructure which would delay the acceptance of digital cash. In an on-line system, transactions are somewhat easier. Customers send cash to sellers, sellers check the cash with the bank, and proceed with the sale. There are still three messages, but two of them are with the bank, so it is simpler because these always go to the same place. Spenders have it especially easy as they just send off their cash. So, I would think an on-line system would be more appropriate for the net environment as it exists today. Another big issue is the legality of cash. How legitimate does an initial implementation of digital cash need to be? PGP's acceptance has been hampered by its infringement of patents. Digital cash would have a worse time of it, probably; it infringes on RSA (for the bank signatures) as well as Chaum's patents. In the Whole Earth article Chaum indicated that he had the whole field pretty well locked up with patents. With PGP we can at least make a moral argument that non-commercial, personal use should be OK, but it's not clear that the concept "non-commercial" can really apply to digital money. Even if it could, RSAREF does not provide at all the functionality that is needed since it is the direct mathematics of RSA that provides the basis for blind signatures. So one would need to get permission to call the "pure RSA" entry points in RSAREF. Then some kind of agreement would be needed with Chaum. This is quite a daunting list. Whether you satisfy the patent lawyers or just decide to go with an under- ground approach, you then have the issue of backing the cash and the tax consequences. When I looked into this several months ago it looked to me like a digital cash system would be much like the "barter exchanges" which have been tried from time to time, and which have stringent tax reporting requirements, with associated serious penalties. England is apparently less strict about this than the U.S., with several cases of barter exchanges having been publicized recently. Perhaps that would be a better forum for launching a cash system. As for backing, I believe that the best way to give digital cash value is to make it possible to exchange it for regular cash. If you know that you can take received digital cash, email it to the bank, and receive a check in the mail a few days later for that amount, you will be likely to accept it. I have a Disney Dollar on my desk for which it is possible to take it to a Disney store and exchange it for a regular dollar. If the same thing can be done for digital cash then I think it will be accepted. All told, there are a lot of obstacles standing in the way of digital cash. The technology is complicated, patent issues arise at every turn, and the complexity of the tax and banking laws will have to be faced. It's not clear how soon we can expect to be able to tackle these problems. Hal