## 2 Security Requirements for CBDC and Digital Currencies
### No Double Spending  
[PERSON] [41] defines the problem of double spending as follows: \"...A potential flaw in cryptocurrency or other digital cash schemes whereby the same single digital token can be spent more than once...\". The double-spending issue has been considered to be the major obstacle that disturbs the propagation of e-cash. [PERSON] [42] reviewed the methods of blind signatures and wallets with observers that can be used in securing the traceability of e-cash transactions. [PERSON] stated that a restrictive blind signature method satisfies strict but efficient privacy requirements for the observer by using a tamper-resistant smart card. [PERSON] et al. [43] provided a solution for the double-spending issues in offline transactions by allowing the service providers to supply tokens with the same serial number to the buyer and the seller and allow transactions only between members with matching tokens. [PERSON] and [PERSON] [44] suggested a blind Rivest-Shamir-Adleman (RSA) signature and cut-and-choose method for recipients, since preventing the emergence of malicious e-cash double spenders is fundamentally impossible. Even in cryptocurrency, the problem of double spending can occur. [PERSON] and [PERSON] [45] describe the steps of double-spending issues in cryptocurrency as follows:  
**Step 1. ** The attacker purchases products/services using a cryptocurrency;  
**Step 2. ** The seller checks whether the attacker's purchase in **Step 1** is in the main blockchain and waits for other confirmation blocks to be added to the main chain blockchain that contains the record of the purchase in **Step 1**;  
**Step 3. ** In the meantime, while avoiding the seller's eyes, the attacker processes mining in a fake chain; the transaction in **Step 1** is not included;  
**Step 4. ** If the process in **Step 2** is completed, the seller sends the attacker products/services;  
**Step 5. ** After receiving products/services, the attacker secretly continues mining and lengthens the fake chain in **Step 3** to be longer than the main chain;  
**Step 6. ** As the longest chain is adopted as the main chain, miners will accept the fake chain that the attacker created as the new main chain, and the future proof of work will be conducted based on the new main chain;  
**Step 7. ** Since the new main chain does not include the record of the purchase in **Step 1**, the attacker can use the cryptocurrency used in **Step 1** again. In cryptocurrency, double-spending issues have not occurred frequently, since, due to the decentralized characteristics of the cryptocurrency, it is not easy for attackers to possess a hashing power of more than than 50% and make the fake main chain. Further, the mechanism of proof of work, which is the key structure of cryptocurrency, requires users to make a not insignificant but feasible amount of effort in making blocks, also preventing the possibility of double spending [45]. However, the proof-of-work mechanism has been considered to be unsuitable for fast payments [46]. Therefore, as possible measures for the vulnerability of proof of work, [PERSON] et al. [46] suggested the method of inserting observers during the transactions. The other alternative mechanism that can prevent the double-spending issue is the proof-of-stake mechanism, which is the method of allowing entities with high coin stakes to be involved in the processes of decision making. Procuring coin stakes of more than 50% of all issued coins is regarded to be more difficult than procuring the hashing power greater than 50% [47].