16th Annual Computer Security Applications Conference
December 11-15, 2000
New Orleans, Louisiana
Efficient Commerce Protocols Based on One-Time Pads
Michael A. Schneider &
Edward W. Felten
We present a new commerce protocol that allows customers and merchants to
conduct face-to-face credit-card authorizations with a credit card company
securely with the option of anonymity for the customer, the merchant, or
both. Our protocol guarantees that both parties agree to and know the
outcome of each transaction. Our protocol has three advantages over
others. First, we need only two Message Authentication Code (MAC)
operations per party per transaction, fewer than most popular protocols.
Second, our own MAC function, OTPMAC, does not rely on the existence of
one-way functions or on any other unproven hypothesis. Third, our
protocol generates a new one-time identifier per party per transaction,
preventing the linkage of multiple transactions to a single party.
Additionally, the protocol can operate in modes using alternatives to the
one-time pad, including cryptographic random number generators, and
conventional cryptographic MAC functions.
Read Paper (in PDF)