## 6 Security Analysis  
A digital cash system like the one presented in this paper should satisfy the following security requirements:  
1. [noitemsep]
2. Valued e-coins cannot be forged by malicious customers;
3. E-coins cannot be double-spent;
4. Customers cannot be falsely accused of double-spending an e-coin.  
Although the vendor can be assumed to be a somehow trusted party, 3 is still needed to prevent malicious double-spenders from claiming they are being accused falsely. The following lemmas address the fulfillment of the enumerated requirements.  
**Lemma 2**: _Valued e-coins of the proposed digital cash paradigm cannot be forged._  
Let us recall that an e-coin is a tuple of the form shown in Equation (3). An e-coin can only be spent if private key \(v_{S}\) is known. Otherwise, the digital signature required at step 1 of the \"Spending\" protocol cannot be computed. Hence, \(Q_{S}\) must be generated together with \(v_{S}\), and the \(Y_{S}\) component of its OAEP encoding (with plaintext awareness) is obtained pseudo-randomly by calling \(\text{OAEP}_{\text{PA}}(Q_{S},r_{S})\) for some random \(r_{S}\). Hence, the \(Y_{S}\) component cannot be chosen by a dishonest party aiming to forge an e-coin. Note also that the \(Y_{S}\) component of spent e-coins is checked not to be part of an already spent e-coin. In this way, there is no point in taking the \(Y_{S}\) component of a new e-coin from an existing one.  
If the forget then simulates the \(\{Y,\text{Sign}_{P_{K_{V}}}(Y)\}\) digest-signature pair, the resulting \(Y\) cannot be chosen (otherwise the underlying signature scheme would be forgeable), so that \(Y_{R}=Y\oplus Y_{S}\) can neither be chosen and, after taking any \(X_{R}\), the public key \(Q_{R}\) obtained from \((Q_{R},r_{R})=\text{OAEP}^{-1}(X_{R},Y_{R})\) is pseudo-random and its private key remains unknown. In this way, the resulting e-coin is no-valued. Lemma 1 guarantees that given \(Y_{R}\) and some chosen \(Q_{R}\), finding a \(\{r_{R},X_{R}\}\) pair satisfying the previous expression is unfeasible.  
Alternatively, the forger could generate a \(v_{R}/Q_{R}\) key-pair and OAEP-encode it into \((X_{R},Y_{R})\). In this case, the obtained \(Y_{R}\) component is pseudo-random and so the resulting \(Y=Y_{S}\oplus Y_{R}\) is. Hence, the signature \(\text{Sign}_{P_{K_{V}}}(Y)\) over \(Y\) cannot be obtained by the forger without the participation of the vendor.  
**Lemma 3**: \(E\)_-coins of the proposed digital cash system cannot be double-spent._  
When an e-coin is spent, the vendor stores a record which includes its \(Y_{S}\) component. Hence, any attempt to spend the same e-coin in the future will be detected.  
**Lemma 4**: _An honest customer cannot be falsely accused of being a double-spender by a dishonest vendor._  
Customers spending an e-coin are required to digitally sign a timestamped sequence using the \(v_{S}\) private key. This digital signature can be validated under public key \(Q_{S}\). Only the customer who generated an e-coin knows its \(v_{S}\) secret key.  
A vendor claiming that an e-coin is being double-spent is required to provide the signed timestamped sequence of the first time the e-coin was spent (Section 4.5, step 4). If the claim is false, they will be unable to provide it.