VeloCash: Anonymous Decentralized Probabilistic Micropayments With Transferability

Micropayments are one of the challenges in cryptocurrencies.Micropayments on the blockchain have the problem that the fee is high for the transfer amount.As a countermeasure, a method called Layer-two has been proposed to consolidate transactions outside the blockchain and improve the blockchain's throughput.As one of the existing Layer-two schemes, Decentralized Probabilistic Micropayments have been proposed.The winning amount is registered in the blockchain, and the lottery tickets are issued to be won with probability p, which allows us to aggregate approximately (1/p) transactions into one.Unfortunately, existing solutions do not allow for ticket transferability, and the smaller p, the more difficult it is to use them in the real world.Here we propose VeloCash, Decentralized Probabilistic Micropayments with Transferability, which preserves anonymity.By introducing tamper-proof assumptions for sending and receiving the tickets, we make p smaller.As a tamper-proof hardware assumption, VeloCash uses Attested Execution Secure Processors, a formal abstraction of secure processors with attested execution functionality and Direct Anonymous Attestation to achieve anonymity for sending and receiving tickets.VeloCash can detect double-spending attacks perfectly and revoke the adversary's device.14 15 agree to update their state and transfer money by exchanging 163 authenticated state transitions in a so-called off-chain fashion.164 To conduct a transaction on Payment Channel, two parties 165 must first register a shared 2-of-2 multi-sig escrow fund in 166 the blockchain and establish the channel.The payment chan-167 nel enables the two parties to perform transactions through 168 private communications.After the sending and receiving are 169 completed in the channel, the final fixed value is registered 170 in the blockchain.Only two transactions are registered in the 171 blockchain per channel, the escrow fund transaction and the 172 final fixed value.A payer can send money to a user who has 173 not established a channel with the payer through the Payment 174 Network between users who have established a channel.For 175 example, suppose Alice sends 0.1 coins to Charlie, who 176 has not established a channel with Alice.First, Alice sends 177 0.1 coins to Bob, with whom Alice has a channel.Next, Bob 178 sends 0.1 coins to Charlie, whom Bob has a channel.179 Unfortunately, the payment channel and the network have 180 the disadvantage of high collateral cost [9].Each time a 181 channel is established, escrow is required between two par-182 ties.Also, the longer the payment network path, the more 183 reserves are required and locked.Since the reserves can not 184 be used during the locktime periods, the reserves represent 185 a lost opportunity.Furthermore, in a payment network, a fee 186 is charged for each pass through the nodes.Therefore, it is 187 impractical to adopt a payment network for micropayments 188 since it is undesirable to incur the cost for each node.189 B. PROBABILISTIC MICROPAYMENTS 190 The idea of Probabilistic Micropayments has been proposed 191 by Wheeler [10] and Rivest [11].Since small payments would 192 be costly if settled each time, they proposed a lottery-style 193 protocol where the ticket issuer deposits a large amount of 194 money in the bank, and the winner could receive the money 195 if they won.The lottery tickets can be used as currency, and 196 the value per ticket is regarded as the ticket's expected value.197 In this scheme, the existence of a bank is mandatory, and 198 participants are limited to people who have a relationship with 199 the bank.200 MICROPAY [12] and DAM [13] have been pro-201 posed as Decentralized Probabilistic Micropayments using 202 blockchain.Since both have a large overhead supporting 203 sequential micropayments, Almashaqbeh et al. have pro-204 posed MicroCash [3] which is a light-weight protocol for 205 non-interactive and sequential payments.206 C. INTERMEDIATED ANONYMITY 207 In TumbleBit, an untrusted intermediary, Tumbler, exists 208 between Alice (the payer) and Bob (the payee), and even 209 Tumbler can not link the payer and the payee.210 Zhang et al. [14] have extended TumbleBit and proposed 211 an Anonymous Off-blockchain Micropayments scheme, 212 AOM.In AOM, an escrow for micropayments under the stan-213 dard RSA assumption is set up by Alice with an intermedi-214 ary, who later aggregates the transactions.Ferretti et al. [15] a DAA scheme that uses Fiat-Shamir proof of knowledge for 274 NP relation.Thus, since the Extractor can be configured, it is 275 possible to extract and revoke the adversary's secret key from 276 the double-spending tickets with the same commitment but 277 different challenges.278 A possible alternative to anonymization other than DAA 279 is using ring signatures.Traceable ring signatures [18], [19] 280 limit the number of times a secret key can sign transac-281 tions, making it possible to detect double-spending attacks.282 However, ring signatures grow proportionally to the size of 283 the anonymity set.There is an inevitable trade-off between 284 anonymity and signature size while DAA signature size is 285 constant.