fairCASH based on Loss resistant Teleportation (2011)

This work contributes technical to the field of fair exchange protocols by proposing a new way to move safeguarded secrets between cryptographically secure endpoints excluding the possibility of duplication. After a brief introduction and presentation of an overview of the subject matter, the problem areas of creating a way to teleport secrets with the help of tamper-resistant hardware are defined. Objects like the CASTOR (a HSM element), eCoins (the secrets) and a copy-less transportation (the teleportation protocol) are introduced as key elements for the intended solution to build the proposed technical framework. With this in hand, its application could work as central exchange engine in the construction of a Digital Cash environment. Adding an ATM (the eMint) and a trust center (the CA) to the scenario taking the role of an optimistic Trusted Third Party (TTP) provides generatability (minting new eCoins) and revocability (blacklisting existing eCoins and eWallets) to the system. This work describes key elements of the proposed Digital Cash framework named fairCASH with the required accuracy tied and held together by defining assumptions, objectives, properties and specific objects. This then leads to a technological solution for building an electronic payment system based upon transferable eCoins. [chapter 2]\nThematically this thesis starts providing a brief state-of-the art overview about how the field of mobile commerce gets involved by shifting more and more business from legacy methods to the Internet based ones. The need of an easy and safe way to endorse this transition with an adequate payment system is shown. The reader will find a first impression of the fairCASH architecture, infrastructure, and capabilities through the explanation of the main elements in its environment: eCoins based upon certificates, eWallets, and teleportation. In a first contribution overall guideline arguments are presented, why technology based developments are best suited to provide the tools for innovations like Digital Cash. The fundamental difference between token based blinding techniques widely used as a mean to protect ePayment systems against multi-spending and the proposed system by discussing the adversarial character for payment system users connected to that property is emphasized. Next, well-chosen system properties illustrating the real needs are presented. Here the interested reader will find a plurality of information around the fair exchange subject, starting with a formal definition. By following the existing literature, it is obvious that the exchange protocol has to be delayed fair, time lined, and effective to guarantee atomic parallelism. Naming the most important success factors for any Digital Cash system, this thesis goes on in its way to discuss functional must-have key elements including their meaning for a later protocol definition proposal. This chapter will be followed by a brief discussion of the characteristically metrics alongside with a comparison of Digital-Cash- and physical-token-currencies (by providing facts related to the €uro system), and finally a clear and pragmatic scenario definition including commented descriptions of a selection of contemporary (and failed) ePayment systems.\nThe possibility of turning a technology into business is mostly an exciting case. This thesis looks and discusses questions with respect to the central business:\n• Can fairCASH be the base to offer essential customer value?\n• Will it be possible to find enough advantages compared to other cash services?\n• Can such a technology offer a significant level of user satisfaction?\nPayments are actuated by humans but effected and conducted by technical means. This thesis takes a look onto the technical environment about how the interaction takes place. This includes possible configurations about the eWallet operation methods for device discovery and pairing. The way this is done decides about the ability and performance of such a financial infrastructure for their usage not only on a PoS but also on payment gates for masses. [chapter 3]\nNext, the underlying formal communication message channel model is introduced, followed by the factual issue of packet loss and the ‘byzantine generals’ undecidability state, which has to be respected in the following. The knowledge of the “position of the value” (ownership) during the transmission under all circumstances is mission critical. Acceptance of the fact to live with an unreliable channel for exchanging messages between Alice and Bob has a great influence on how to deal with atomic commitments, a desired feature in the termination phase of the teleportation protocol. The effect of state inconsistency in two-party communication environments based upon atomic delivery as proposed in literature is reviewed and it is concluded that up today there is no standard way to solve the atomic commitment problem within the fairCASH environment by applying existing methods. [chapter 4]\nThe previous discussion of different privacy levels and their meaning for anonymity concepts including unobservability, untraceability or unlinkability is pointing the way to a “delayed-true two-party fair exchange protocol”. Naming the requirements, this thesis proposes a general and modular definition for protocol assumptions, objectives and properties. Thereafter, a basic notation for the teleportation protocol is put on the table, following the usual methodology in consideration of the specific needs in the presented case. Describing the exchanged protocol messages, a complete definition about their structure and meanings is given. With that detailed step-by-step presentation and exhaustive discussion of all messages including their embedded elements, the reader is invited to follow Alice and Bob by logically stepping through the whole exchange process. Thereafter, the associated protocol states will be discussed and the analysis of achievable fairness, reasons why choosing special decisions in one case and in other cases being constrained by circumstances is presented. This leads to the solution about how to guarantee (by potentially recreating) true fairness through the usage of affidavits, proving a loss of value without exposing the system to new fraud threats, usable for automated reimbursements. Taking a closer look to the performance of the exchange, the forfeiture probability can be determined in the worst case scenario for transactions in the need of fairness recreation to an upper limit of 3% (never expected to exceed 1‰ in practice) based upon the nature of the teleportation protocol itself and the effective pledged Quality of Service (QoS) defined by international standards and recommendations. A calculation of transactions times in different networks based on a previously done estimation of message sizes shows an asymptotic barrier of about one second, introduced by the assumed processing speed of the eWallet. At this instance, it should be pointed out, that data objects are playing an important role in the protocol presented. In combination with the transfer protocol itself, they provide and guarantee the proposed protocol properties including and conforming to an ITU-T X.509v3 based PKI trust architecture. [chapter 5]\nForgery and multi-spending are the basic threats to counter in any financial system based on token circulation. A short presentation of the potentially different (technical) risks introduced by such a system is discussed, concluding to the question of possibility “to cheat the fairCASH system without tampering the eWallet”. Goals are discussed as ranking criteria, what needs a protection, and which skills do attackers have. To counter and stabilize the presented fairCASH system, a basic security management model and questions about how to respond to attack scenarios are introduced. To make this more practical, known basic attacks are classified, ordered and grouped into different threat categories. [chapter 6]\nProtection is the first obligation in an unsafe environment. The degree of protection is crucial to make a system like fairCASH operational or dysfunctional. Given enough time and resources, every protection system can be broken. However, it is good news that the postulation of the requirement for tamper-proved hardware, which we all know does not exist, is not necessary. It is shown that one of the central points of interest is: How long can an eWallet remain in the open market before it gets cracked. This is also a function of the continuous technical (attack) progress in a world where yesterdays technologies become cheap and widely available to today’s attackers. This opens a race in which the manufaction of an eWallet starts on the leading edge position, while continuously dropping down to an imaginary bottom line, reaching the point in time being replaced by a new one including again the up-to-time defense technologies; an ongoing continuing cycle. As rule of thumb, it should be noticed that capabilities of silicon based HSMs should not be overestimated and capabilities of attackers must never be underestimated. It will be a bad design decision using just a few (or a single) system component(s) in a financial environment (e.g. eWallets) as sole barrier, standing between the hacker and the money. Nevertheless, the CASTOR is an essential part of the proposed design philosophy within the fairCASH system introducing countermeasures relating to possible eWallet integrity manipulation attacks. A good tamper-protected hardware with adequately chosen instruments against anticipated attacks joint risk management and safeguards against hypothetical losses on system level is a good starting point. This thesis references existing and introduces some new countermeasures like the presented TRUSTLET concept, contributing to the secure boot paradigm first presented by the AEGIS architecture [9] in combination with t