## 1 Introduction  
The European Commission defines digital cash (also referred to as _e-money_ or _e-cash_) as a digital alternative to cash. It allows users to make cashless payments with money stored on a card or a phone, or over the Internet. Digital cash was first proposed in the early 1980s by [PERSON] [1] in a proposal based on the newly invented blind signature cryptographic primitive. That proposal includes three actors: the _bank_, the _payer_ (the _customer_), and the _payee_ (the _vendor_), and three protocols: _withdraw_, _spend_, and _deposit_. An e-coin is a random sequence of data which has been digitally signed by the bank. During the withdraw protocol, the payer generates a random sequence and, after paying for it, asks the bank to digitally sign it through a blind signature protocol. This ensures that the bank does not learn any information about the issued e-coin so that the payer will be able to spend it anonymously in the future. An e-coin is spent by means of a process by which the payer transmits it to the payee. Finally, when the payee deposits an e-coin, they receive its monetary value from the bank. [PERSON]'s proposal [1] is both _anonymous_ (the identity of the payer is not revealed during payment) and _unlinkable_ (it is not possible to determine whether two payments were made by the same payer or not). A transaction using a digital currency occurs entirely digitally. This means that a dishonest payer could store a copy of an e-coin after having spent it and then try to spend it again in the future. This is the _double-spending_ fraud. Two main strategies have been proposed to cope with attempts to double-spend. In [1], upon receiving a payment, the payee asks the bank to check that the received e-coin has not been spent before. This is an _on-line_ double-spending fraud prevention strategy. In the _off-line_ alternative [2], double spending is not checked during the payment process, but it can be detected later when the e-coin is deposited. In cases of double-spending, the anonymity of the double-spender is lifted so that they can be prosecuted. Research on digital cash systems has addressed diverse features such as e-coin _divisibility_, which allows a user to withdraw a coin and spend it several times by dividing its value (up to a given limit). The first practical divisible digital cash system was proposed in [3]. That proposal is anonymous but it is possible to link several spends from a single divisible coin. The system in [4] is divisible and unlinkable but the vendor and the bank know which part of the coin is being spent. Hence, unlinkability is provided partially. The first divisible and strong unlinkable e-cash system was described in [5]. A more efficient system in terms of computational and communications cost was proposed later in [6]. Research in the divisibility feature is still active with proposals such as [7], in which a large e-coin can be divided into several small ones with arbitrarily integer values. The system is efficient as both the pay and deposit procedures run in constant time. The authors of [8] provide a formal and complete security model for divisible e-cash and study constructions based on pseudo-random functions. Another research line focused on digital cash systems able to deal with low value payments, that is, _micropayments_[9]. These systems have been addressed by the research community with proposals aiming to reduce the number of public key operations by replacing them with lightweight hash computations. The Micromint system [9] can be seen as a precursor of the widely-known _proof-of-work_ concept in modern cryptocurrencies. Although digital cash systems need to be efficient both in terms of computation and communication costs, the ever increasing capacity of computers and mobile devices has eliminated the need for so many lightweight proposals. For instance, the authors of [10] achieve a reduced cost by using elliptic curve public key cryptography. _Transferability_ is the most difficult feature of paper cash to be achieved in the digital world.