隨著電子商務日益受到重視，愈來愈多的交易行為得以在網際網路上實現。因此，商家和顧客之間的交易也變得更為重要。為了達到在網路上公平的交換數位物品，公平交換協定已被提出且做過良好的研究。傳統的公平交換協定大多是探討物品之間的互換，如數位簽章、合約簽署及文件的交換。近來，學者開始對電子貨幣和數位商品之間的交易產生興趣，而提出植基於電子貨幣的公平交易協定。
　　使用電子貨幣透過網路購買數位商品，必須達到如同傳統貨幣一般的匿名性。即顧客的交易資訊除了顧客本人之外，任何人都不應該能夠得到，甚至包括在協定中幫忙解決紛爭的公正第三者角色在內。
　　在電子商務的環境之下，商家和顧客基本上是無法信賴彼此的。因此，在公平交換協定中常引入公正第三者的角色以達成真正的公平性。線上公正第三者在每一次的交易中都必須參與，雖然能達到真正的公平，但卻失去了效率。另一種形式，採用離線的公正第三者，正常情況下不需參與協定，只有在紛爭發生時才出面解決紛爭，可兼俱公平性及實用性，是實作上比較可行的方式。
　　本論文提出一個植基於電子貨幣的公平交易協定。利用對於電子貨幣的延伸研究，設計出適用於任何一種電子貨幣的公平交易協定。採用離線的公正第三者，增加了整個系統的效率及實用性。此外，顧客的交易資訊除了顧客本人之外，其他人均無法得知，包括公正第三者在內。因此，對於顧客的匿名性可以得到完整的保護。

Due to the growing interest in electronic commerce, more and more transactions now happen online. Thus, fair transactions between customers and merchants are getting important. To gain the fairness of the exchange of digital items, fair exchange protocols have been proposed and well studied. Most of the traditional fair exchange protocols are concerned about the exchange of digital items, such as digital signatures, contracts, and documents. Recently, researchers pay attention to the exchange of digital goods along with electronic cash, and have proposed some fair transaction protocols based on electronic cash.
To buy digital contents via electronic cash through network, the anonymity property as traditional cash possesses must be guaranteed. It means that the payment information of the customer cannot be revealed to anyone else including the trusted third party (TTP) who helps the customer and the merchant with resolving possible disputes in the protocol.
Since the customer and the merchant may not trust each other in an electronic transaction. In a fair exchange protocol, a TTP is employed to achieve true fairness. An on-line TTP has to take part in all transactions while they are proceeding. Despite it can gain true fairness, it is inefficient due to on-line interaction with the TTP. On the other hand, an off-line TTP does not need to join in the transaction protocol in normal cases. Instead, it participates in the protocol only when disputes happen. It is efficient and fair, and more feasible in practical situations.
In this thesis, we propose a fair transaction protocol based on electronic cash. With the extended research on electronic cash, we have designed a fair transaction protocol that is suitable for any electronic cash system. By using an off-line TTP, the protocol is more efficient and practical. Furthermore, payment information of the customer cannot be known to anyone else including the TTP, and thus, the anonymity of the customer is protected completely in our protocol.

誌謝 I
摘要 II
ABSTRACT III
TABLE OF CONTENTS V
LIST OF FIGURES VII
LIST OF TABLES VIII
CHAPTER 1 INTRODUCTION 1
1.1 MOTIVATION 1
1.2 RESEARCH CONTRIBUTIONS 2
1.3 THESIS ORGANIZATION 3
CHAPTER 2 PRELIMINARY 4
2.1 ONE-WAY HASH FUNCTION 4
2.2 DIGITAL SIGNATURES 5
2.3 BLIND SIGNATURES 7
2.4 A TYPICAL ELECTRONIC CASH SYSTEM 8
2.5 FAIR EXCHANGE 10
2.6 ANONYMOUS CHANNEL 14
CHAPTER 3 GENERIC BLIND SIGNATURE SCHEMES 16
3.1 FAN-CHEN GENERIC BLIND SIGNATURE SCHEME 16
3.2 GENERIC ELECTRONIC CASH SCHEME 18
CHAPTER 4 FAIR TRANSACTION PROTOCOLS BASED ON ELECTRONIC CASH 21
4.1 AN ANONYMOUS FAIR EXCHANGE PROTOCOL 21
4.2 UNTRACEABLE FAIR NETWORK PAYMENT PROTOCOL 27
CHAPTER 5 THE PROPOSED SCHEME 33
5.1 THE WITHDRAWING PROTOCOL 33
5.2 THE PAYMENT PROTOCOL 35
5.3 THE DISPUTE RESOLUTION PROTOCOL 39
5.4 DISCUSSIONS 40
CHAPTER 6 CONCLUSIONS 43
REFERENCES 44

[1] D. Chaum, "Blind signatures for untraceable payments," Advances in Cryptology-
CRYPTO'82, Springer-Verlag, pp. 199-203, 1983.
[2] D. Chaum, A. Fiat, and M. Naor, "Untraceable electronic cash," Advances in Cryptology-CRYPTO'88, LNCS 403, Springer-Verlag, pp.319-327, 1990.
[3] M. Abe and E. Fujisaki, "How to date blind signatures," Advances in Cryptology-
ASIACRYPT'96, LNCS 1163, Springer-Verlag, pp. 244-251, 1996.
[4] C. I. Fan, "Improved low-computation partially blind signatures," Applied Mathematics and Computation, vol. 145, no. 2-3, pp. 853-867, 2003.
[5] C. I. Fan and C. L. Lei, "User efficient blind signatures," Electronics Letters, vol. 34, no. 6, pp. 544-546, 1998.
[6] C. I. Fan and C. L. Lei, "A multi-recastable ticket scheme for electronic elections," Advances in Cryptology-AISACRYPT'96, LNCS 1163, Springer-Verlag, pp. 116-124, 1996.
[7] C. L. Lei and C. I. Fan, "A universal single-authority election system," IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, vol. E81-A, no.10, pp. 2186-2193, 1998.
[8] C. I. Fan and W. K. Chen, "An efficient blind signature scheme for information hiding, " International Journal of Electronic Commerce, vol. 6, no. 1, pp. 93-100, 2001.
[9] M. Bellare and P. Rogaway, "Random oracles are practical: a paradigm for designing efficient protocols, " 1st ACM Conference on Computer and Communications Security, ACM Press, pp. 62-73, 1993.
[10] A. Menezes, P. van Oorschot, and S. Vanstone, "Handbook of applied cryptography," CRC Press LLC, 1997.
[11] T. ElGamal, "A public key cryptosystem and a signature scheme based on discrete logarithm, " IEEE Transactions on Information Theory, vol. 31, pp. 469-472, 1985.
[12] R. L. Rivest, A. Shamir, and L. Adleman, "A method for obtaining digital signatures and public key cryptosystems," Communications of the ACM, vol. 21, no. 2, pp. 120-126. 1978.
[13] S. Brands, "Untraceable off-line cash in wallets with observers," Advances in Cryptology-CRYPTO’93, LNCS 773, Springer - Verlag, pp. 302-318, 1993.
[14] M. Blum, "How to exchange (secret) keys," ACM Transactions on Computer Systems, vol. 1, pp. 175-193, 1983.
[15] R. H. Deng, L. Gong, A. A. Lazar and W. Wang. "Practical Protocol for Certified Electronic Mail," Journal of Network and Systems Management, vol. 4, no. 3, pp. 279-297, 1996.
[16] F. Bao, R, H. Deng, W. Mao. "Efficient and Practical Fair Exchange Protocols with Off-line TTP," Proceedings of the 1998 IEEE Symposium on Security and Privacy. IEEE Computer Press, pp. 77-85, 1998.
[17] C. Boyd and E. Foo. "Off-line Fair Payment Protocols Using Convertible Signature," In Advances in Cryptology - proceedings of Asiacrypt’98, Springer - Verlag, pp. 271-285, 1998.
[18] L. Chen. "Efficient Fair Exchange with Verifiable Confirmation of Signatures," In Advances in Cryptology – proceedings of Asiacrypt’98, Springer - Verlag, pp. 286-299, 1998.
[19] J. Zhou and D. Gollmann. "An Efficient Non-repudiation Protocol," Proceedings of the 1997 IEEE Computer Security Foundations Workshop (CSFW 10). IEEE CS Press, pp. 126-132, 1997.
[20] C. H. Wang. "Untraceable Fair Network Payment Protocols with Off-Line TTP," In Advances in Cryptology - proceedings of Asiacrypt 2003, Springer - Verlag, pp. 173-187, 2003.
[21] I. Ray and N. Natarajan, "An Anonymous and Failure Resilient Fair-Exchange E-Commerce Protocol," Decision Support Systems, vol. 39, no. 3, Elsevier Publisher, pp. 267-292, 2005.
[22] M. Ben-Or, O. Goldrich, S. Micali, R. Rivest, "A fair protocol for signing contracts, " IEEE Transactions on Information Theory, vol. 36, no. 1, pp. 40-46, 1990.
[23] D. Chaum, "Untraceable electronic mail, return addresses, and digital pseudonyms," Communications of the ACM, vol. 24, no. 2, pp. 84-88, 1981.