Yeah, lol no I'm not buying that. Maybe if the actual architecture and source code gets open sourced and people more knowledgeable than me audit it...
Promising complete privacy and fully offline transactions both sound dubious.
What mechanisms would be in place to allow me to transfer money from my KYC bank account to an anonymous wallet without it being tracked?
If the max is €3000 but it's entirely private, how could they possibly know I don't have a higher balance or multiple wallets?
What tech is even being used to allow fully private, offline transactions in the first place? How does the receiver verify that the digital cash is legit? And how does the network ensure that the money wasn't double spent while offline?
So many questions here, and I can't help but have a hunch that the gaps in description would be blocked by fundamental technical limitations.
I really doubt that they intend do use it, but zero-knowledge cryptography indeed can accomplish this, so there is no technical limitation afaik.
> If the max is €3000 but it's entirely private, how could they possibly know I don't have a higher balance or multiple wallets?
This gets trickier. Let's say we limit to 3000 per account (and use whatever else to limit accounts/person). This would be possible, but would also reveal the amount on the account: try to send decreasing amounts, first one that succeeds reveals previous balance. There's probably an entity that can simulate sending too.
> What tech is even being used to allow fully private, offline transactions in the first place? How does the receiver verify that the digital cash is legit? And how does the network ensure that the money wasn't double spent while offline?
Yeah, this one is impossible.
It's really hard to say without details of how the proposed system would actually work, but I don't think they can get away from KYC laws.
They'd still have the on ramp / off ramp problem of existing cryptocurrencies, my bank would know how much I transferred and some unique identifier of either my wallet or the transaction. Assuming that offline transactions aren't possible, the network would also know every transaction made and could link that back to my original bank deposit.
Still, the EU banks already have SEPA instant payments so the infrastructure for this is not hard to imagine.
And despite those drawbacks, it's still better than the VISA/MC duopoly on online payments
I'm always torn on this one. I really dislike monopolies (or duopolies in this case) and functionally the government has enough power today to compel Visa/MC to do whatever they want. Though as long as they are technically not part of the government we have a chance to rip apart that government power and remove their control of the financial institutions.
I have no real hope that those in charge would actually let it happen, but that small chance is gone if the government is running things directly.
By that definition neither the wallet holder nor the merchant would have to be online for a real 'offline' system.
GNU Taler e.g. is an online system on the other hand, where the merchant has to be online for pragmatic reasons. It's kind of sad to see them being categorically excluded by this requirement. Their the best we currently have afaik.
(Check out my answer below for sources https://news.ycombinator.com/item?id=36520725)
If they want to compare it to cash, I'd have to be able to give you the money directly without any network verification. Just the step of a receiver having to ask the network to validate means there is no guarantee of privacy.
For society, this is really important. Basically everyone needs a bank account. In some countries, the government even forces people implicitly to have one in order to pay taxes or fees.
In such a case, the government should provide a solution for this too.
Then, there are also economic implications of this. Society needs to run many banks, which uses a lot of resources (especially people). However, many people and companies only need one simple part of banking: cashless payment. Something that’s, from a technical perspective, just a database for transactions and accounts. So a default solution by the government makes sense to me.
Of course people will argue against this as the government would have full control over people’s money. But I think that’s the case anyway. Money is something inherently governmental as it’s produced by an governmental institution (central bank) and collected by the government in form of taxes.
To an extent, but (speaking for the US primarily) there is significant added friction from the current distributed nature of the legacy banking system. If it were as easy as typing a person's ID number into a form and the system would take care of the rest, it would certainly be used more freely (freezing the accounts of thousands of people attending a protest with today's system would be a monumental task, even with full judicial endorsement).
We already have that system. They put your name on a list, and everyone with that name or similar has lots of paperwork to do.
https://en.wikipedia.org/wiki/Financial_Action_Task_Force_bl...
Given a governmental approach, this would be subject to the Fifth Amendment and other laws.
Also, there’s always the freedom to not choose this system and stay with private banks.
So I guess this it would be a net positive.
Probably due to its security being based on the security of the embedded smart card, it had a much lower limit and other than my father showing me how it worked 20 years ago I have neither used nor seen anybody use it.
I wonder how they will implement the infrastructure. Having this will be an awesome replacement to the limitations of the visa/mastercard monopoly
Yes, they are a 2-3% leech on the economy in the US. In Europe, the regulators there have kept it a bit lower, which is reflected in EU credit cards having few benefits and high fees.
> I wonder how they will implement the infrastructure.
That's also what I wonder. A description of the cryptography and system would be interesting.
If this is only as anonymous as cash (i.e. unique serial numbers on every bill), then this would still be a step backwards, as it would be trivial to track individual e-bills around.
I am also surprised that they allow up to €3,000. This would make smuggling far easier/denser than physical €500/CHF1,000/USD100 notes. It could even allow a relay-attack smuggling, where the wallet is located far away from where the funds are used.
Sure. But somehow I'm not so confident about that...
There is also the issue of contradicting incentives. To keep payments safe from crooks, no-one should be able to follow any trails. But to trace crooks making payments, the authorities need to be able to follow the money.
A central digital coin concentrates a lot of power. Money and power are a magnet for crooks.
Not saying this can't/won't/shouldn't work, but it's quite a promise to make...
That's something that I don't quite understand.
Would they give a unique ID to each cent so that if two with the same ID appear they see the discrepancy, but even that wouldn't work for offline, unless if they're planning to make it so that you have to go online every set period of time and then they verify the money.
It's offline. Neither you nor the merchant have to have a connection to the bank for the transaction to happen.
I just don't see what the value is of having my account denominated in a way that getting coins/paper is gone. Even if we went to all digital money tomorrow we would probably quickly get a bank that denominates in gold and gives you back paper slips for proof of deposit. Or doesn't even bother with gold and gives paper slips of electronic currency deposits.
We can't even get rid of useless pennies in the US.
Because that actually looked like a decently private central-ish digital currency.
Basically he used (and invented) blind signatures to allow the bank to sign a 'coin' without knowing what they signed. The customer takes the blindly signed coins from the bank, pays at a merchant and later the merchant deposits the coins at the bank again, where the signature is checked.
In this context offline just means that the merchant can verify the authenticity of the coin without immediately needing a connection to the bank. At some point in the future, however, the merchant will have to connect to the bank to get their money. Check out his original paper for details[1].
Offline systems have drawbacks, though. E.g the GNU Taler people made the pragmatic decision to have an online system. See chapter 1.2.1 'Offline vs Online' of Florian Dold's Phd thesis for a discussion on why[2].
[1]: https://chaum.com/wp-content/uploads/2022/01/Chaum-1990-Chap... [2]: https://taler.net/papers/thesis-dold-phd-2019.pdf
It's not actually possible to prevent this entirely. It's not even possible with physical currency. You can always look at a bank note and make an exact-enough duplicate, then spend it twice.
> they're planning to make it so that you have to go online every set period of time and then they verify the money.
That's not a hard requirement, but yes. The central bank is the final authority on what currency is counterfeit or not.
-----
For current technology, I think it's probably sufficient to have a smart card issued by the central bank, with an embedded certificate chained to the central bank. For offline transactions, the two cards can establish an encrypted stream, mutually verify that they were attested by the central bank, and then mark notes as transferred to the other party in TXN#X, run the transfer, then delete the notes entirely.
Interrupting the process might leave the notes in a partial state (marked for transfer to a particular smart card), but the connection can be reestablished to try again, so long as the TXN# isn't incremented by another transaction.
Now you have to hack a smart card processor to double spend (and only offline, and still detectable), which is of similar difficulty and risk to making counterfeit banknotes.
Maybe North Korea will sell you an infinite money card, but it will only get you free coffee when hiking in the Alps, and only until that card's certificate is added to the revocation list and people update their transfer boxes.
This implies constant progress. We all use 20+ year old crypto like SHA2 without any real fears of it being broken in our lifetimes.
I was thinking along the lines of Bruce Schneier's infamous “Attacks always get better, they never get worse”.
In terms of hashes, md5 was once pretty secure. But we can't go back in time, we can't unlearn how to create hash collisions. And we can't force the world to only use 8 bit, 16 bit hardware from the 90s when brute forcing.
If the privacy of EU citizens were to solely rely on securely designed crypto of around a public ledger consider that 20 years of unbreakable crypto might be too little. What if every transaction you made 20 years ago was accessible to anyone? What if in 25 years they figured out how to make changes and no one could tell which one was authentic?
Sounds like scifi? Would probably be trivial for a block chain based on good old trusted DES.