## 2 Security Requirements for CBDC and Digital Currencies
### Verifiability  
To detect and penalize any malicious acts that evade the security protocols, the electronic financial system should be verifiable--the transactions must be recorded, and the records must not be falsified.  
[PERSON] et al. [66] and [PERSON] and [PERSON] [67] researched the verifiability of the protocols for e-cash systems. [PERSON] et al. [66] propose a fair electronic protocol that uses the trusted third party (TTP) to check irrelevant actions within the transaction. [PERSON] and [PERSON] [67] reviewed the functions of an electronic funds transfer (EFT) protocol, which transfers money from bank accounts to other agencies through a computer system without the direct intervention of bank staff, and proposed a domain-verifiable signcryption scheme as an improvement of the EFT protocol. The scheme appoints pre-specified participants to check the transactions, allowing the protocol to have verifiability in the absence of TTP [67].  
Cryptocurrencies such as Bitcoin and Ethereum are verifiable, as all the transactions are recorded in blocks [68]. [PERSON] [69] proposes the Raziel system, which combines the multi-party computation (MPC) protocol and zero-knowledge proofs (ZKP). The MPC is a protocol in which individuals that do not trust each other do not share their input value, such as personal information, but share the encoded input value. The ZKP is a process in which code users can verify codes without opening information on the smart contracts. The Raziel system, which utilizes the benefits of both methods, has an advantage in verifying the smart contract without revealing personal information [68].  
Like cryptocurrencies based on DLT, CBDCs that use DLT satisfy the verifiability condition. However, not all CBDCs can be said to be based on DLT--some CBDCs, such as the permissioned CBDCs mentioned in Figure 1, only allow approved authorities to verify transactions and manage the ledger, and those CBDCs do not have the same verifiability standards as cryptocurrencies [70]. Therefore, [PERSON] [70] suggested that the CBDC systems use the know your customer (KYC) process as a verifiability measure. The CBDC system can accomplish the verifiability through the KYC process, which only allows verified users to use the CBDC system by ex-ante identification process and keeping the transaction history among them.  
[PERSON] Anonymity  
Cash transactions leave no trace of users. Such a characteristic is good for protecting a person's privacy but could be exploited for crimes such as tax evasion, causing negative externality in society [71]. Unlike cash, electronic financial systems can control anonymity--that is, electronic payment users' information can be disclosed under some predeterminedcircumstances. [PERSON] et al. [72] presented a protocol for e-cash systems that revokes anonymity through a trustee when illegal situations (Figure 2), such as blackmailing and money laundering, occur.  
[PERSON] [73] defined cryptocurrency as an electronic payment method not with \"real anonymity\" but with \"pseudonymity\". Numerous cryptocurrencies, including Bitcoin and Ethereum, need to build the reliability of the system by using a distributed ledger while ensuring users' anonymity. Public key cryptography, which generates pseudonymous addresses for the users in the transactions, is generally used for the purpose. However, not even public key technology can secure users' anonymity when users' public key usage is continued many times. Therefore, [PERSON] and [PERSON] [74] argued that the public key must be updatable according to the cryptocurrency users' will.  
Anonymity is also an important issue in CBDCs. Providing complete anonymity in CBDCs can cause the same money-laundering problems that happen in conventional financial systems. Accordingly, AML authorities have suggested the concept of anonymous vouchers, which limit the amount of CBDC that each user can utilize under the guarantee of anonymity [75].