現今生活中，電子商務的發展越來越廣，使用網路交易的人越來越頻繁。因此，人對於隱私上的需求越來越高。匿名性以及公平性已成為電子交易平台之基本需求。
在一個第三方電子交易平台中，使用者會希望交換貨物而不想要透露出個人訊息，因此雙方會在對彼此匿名而且只透露貨物資訊的情形下完成交易。而第三方電子交易平台將會在交易起爭議時出面保證交易的公平性。
根據我們調查的結果，目前的公平交易機制中，並沒有同時達到使用者雙向匿名以及離線第三方的機制。在這些機制中，第三方需要在交易前對貨物進行驗證，因此
對第三方及使用者造成不必要的成本負擔。因此，我們提出了一個新的公平交易機制，以解決上述問題。我們導入了同時簽章演算法以及可撤銷式匿名憑據系統，以達到雙向匿名以及公平性。

With the rapid development of e-commerce, fair exchange has become an important and issue
worthy of further discussion. Additionally, owing to rising awareness of privacy preservation,
anonymity and fairness have become the required attributes for a fair exchange platform. In
such an application, users expect the exchange process to be performed successfully without
revealing any personal information. When problems arise, a third party must make an appropriate
disposition in order to maintain fairness.

To the best of our knowledge, none of the existing fair exchange schemes achieves mutual
anonymity with an off-line third party. In existing schemes, the third party authorizes the
item before exchange, thereby causing undesired cost to the third party and to users. Therefore,
we propose a novel fair exchange scheme. We adopt an anonymous credential system
and a concurrent signature algorithm to construct the proposed scheme. Our proposed scheme
achieves both mutual anonymity and fairness while the third party remains off-line in the item
exchange protocol.

論文審定書. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . c
Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . f
摘要. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . g
Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . h
List of Figures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . l
List of Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . m
Chapter 1 Introduction 1
1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.2 Previous Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.3 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Chapter 2 Related Works 11
2.1 Fan et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.1.1 The Withdrawing Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.1.2 The Payment Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.1.3 The Dispute Resolution Protocol . . . . . . . . . . . . . . . . . . . . . . 14
2.2 Zhang et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.2.1 The Document Exchange Protocol . . . . . . . . . . . . . . . . . . . . . 18
2.2.2 The Key Recovery Protocol . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.3 Alqahtani’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.4 Optimistic Fair Exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.5 Ray et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.6 Hwang et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.6.1 Notarization Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.6.2 Fair Exchange Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.6.3 Arbitration Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Chapter 3 Background 30
3.1 Concurrent Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.1.1 Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.1.2 Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.2 Anonymous Credential Scheme Supporting Active Revocation . . . . . . . . . 34
3.2.1 Anonymous Credential . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
3.2.2 Join Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.2.3 Membership Proof Protocol . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.2.4 Revocation Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.3 Publicly Verifiable Secret Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.3.1 Verifiable Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Chapter 4 The Proposed Scheme 39
4.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
4.1.1 Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.1.2 Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.2 Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
4.2.1 Registration protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
4.2.2 Item Exchange Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
4.2.3 Key Recovery Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.2.4 Trace Back Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Chapter 5 Security Analysis 53
5.1 Security Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.2 Fairness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
5.3 Anonymity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
5.4 The third party . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
5.5 Undeniability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Chapter 6 Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Chapter 7 Conclusion and Future Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

[1] F.A. Alqahtani. A fair exchange&customer anonymity protocol using a trusted third party for electronic commerce transactions & payments. In International Journal of Network Security & Its Applications, pages 59–74, 2014.
[2] N. Asokan. Fairness in electronic commerce. PhD thesis, University of Waterloo.
[3] N. Asokan, M. Schunter, and M. Waidner. Optimistic protocols for multi-party fair exchange.1996.
[4] N. Asokan, M. Schunter, and M. Waidner. Optimistic protocols for fair exchange. In Proceedings of the 4th ACM conference on Computer and communications security, pages7–17, 1997.
[5] N. Asokan, M. Schunter, and M. Waidner. Asynchronous protocols for optimistic fair exchange. In Security and Privacy, pages 86–99, 1998.
[6] N. Asokan, V. Shoup, and M. Waidnr. Optimistic fair exchange of digital signatures. In Advances in Cryptology |EUROCRYPT, pages 591–606, 1998.
[7] F. Bao. Multi-party fair exchange with an off-line trusted neutral party. In Tenth International Workshop on Database and Expert Systems Applications, 1999. Proceedings., pages 858–862, 1999.
[8] F. Bao, R. Deng, andW. Mao. Efficient and practical fair exchange protocols with off-line ttp. In 1998 IEEE Symposium on Security and Privacy, pages 77–85, 1998.
[9] M. Ben-Or, O. Goldreich, S. Micali, and R.L. Rivest. A fair protocol for signing contracts. In Automata,Languages and Programming, pages 43–52, 1985.
[10] M. Blum. How to exchange (secrete) keys. In ACM Transactions on Computer Systems,1983.
[11] W. Caifen, G. Jianhua, E. XinJun, and Q. Jin. A multi-party non-repudiation protocol with semi-trusted third party. In 2002 IEEE Region 10 Conference on Computers, Communications, Control and Power Engineering, pages 188–191, 2002.
[12] L. Chen, C. Kudla, and K.G. Paterson. Concurrent signatures. In EUROCRYPT, pages 287–305, 2004.
[13] R.H. Deng, L. Gong, A.A. Lazar, and W. Wang. Practical protocol for certified electronic
mail. In Journal of Network and Systems Management, pages 279–297, 1996.
[14] Y. Dodis, P.J. Lee, and D.H. Yum. Optimistic fair exchange in a multi-user setting. In Public Key Cryptography – PKC 2007, pages 118–133, 2007.
[15] S. Even. A protocol for signing contracts. In ACM SIGACT News, pages 34–39, 1983.
[16] C.I. Fan and Y.K. Liang. Anonymous fair transaction protocols based on electronic cash. In International Journal of Electronic Commerce, pages 131–151, 2008.
[17] C.I. Fan, C.N. Wu, J.C. Hsu, and Y.F. Tseng. Anonymous credential scheme supporting
active revocation. In 2014 Ninth Asia Joint Conference on Information Security (ASIA
JCIS), pages 127–132, 2014.
[18] M.K. Franklin and M.K. Reiter. Fair exchange with a semi-trusted third party. In Proceedings of the 4th ACM conference on Computer and communications security, pages 1–5, 1997.
[19] R. Ganjavi. An ambiguous optimistic fair exchange protocol with traceability. In 2014 7th International Symposium on Telecommunications (IST), pages 919–924, 2014.
[20] R. Ganjavi and M.R. Asaar. A traceable optimistic fair exchange protocol. In 2014 11th International ISC Conference on Information Security and Cryptology (ISCISC), pages 161–166, 2014.
[21] O. Goldreich. A simple protocol for signing contracts. In Advances in Cryptology, pages 133–136, 1984.
[22] Q. Huang, G. Yang, D.S. Wong, and W. Susilo. Ambiguous optimistic fair exchange. In Advances in Cryptology - ASIACRYPT 2008, pages 74–89, 2008.
[23] Z. Huang, R. Huang, and X. Lin. Perfect concurrent signature protocol. In Software Engineering, Articial Intelligence, Networking, and Parallel/Distributed Computing, pages 467–472, 2007.
[24] R.J. Hwang and C.H. Lai. Provable fair document exchange protocol with transaction privacy for e-commerce. In Symmetry 2015, pages 464–487, 2015.
[25] S. Micali. Simple and fast optimistic protocols for fair electronic exchange. In Proceedings of the twenty-second annual symposium on Principles of distributed computing, pages 12–19, 2003.
[26] M.M. Payeras-Capellà, J.L. Ferrer-Gomila, and L. Huguet-Rotger. Anonymous payment in a fair e-commerce protocol with verifiable ttp. In Trust, Privacy, and Security in Digital
Business, pages 66–69, 2005.
[27] I. Ray and I. Ray. An anonymous fair exchange e-commerce protocol. In International Parallel and Distributed Processing Symposium, 2001.
[28] I. Ray and I. Ray. Fair exchange in e-commerce. In ACM SIGecom, pages 9–17, 2002.
[29] I. Ray, I. Ray, and N. Natarajan. An anonymous and failure resilient fair-exchange ecommerce protocol. In Decision Support Systems, page 267–292, 2005.
[30] M. Stadler. Publicly verifiable secret sharing. In Advances in Cryptology—EUROCRYPT
’96, pages 190–199, 1996.
[31] W. Susilo, M.H. Au, Y.Wang, and D.S.Wong. Fairness in concurrent signatures revisited. In Information Security and Privacy, pages 318–329, 2013.
[32] W. Susilo, Y. Mu, and F. Zhang. Perfect concurrent signature schemes. In Information and Communications Security, pages 14–26, 2004.
[33] J. Wang and Z.A. Kissel. Introduction to Network Security: Theory and Practice. Wiley,2015.
[34] N. Zhang, Q. Shi, and M. Merabti. Anonymous public-key certicates for anonymous and fair document exchange. In IEE Proceedings - Communications, pages 345–350, 2000.
[35] N. Zhang, Q. Shi, and M. Merabti. An efficient protocol for anonymous and fair document exchange. In Computer Networks, page 19–28, 2003.
[36] Q. Zhang and K. Markantonakis. A mutual authentication enabled fair-exchange and anonymous e-payment protocol. In The 3rd IEEE International Conference on ECommerce Technology, 2006. The 8th IEEE International Conference on and Enterprise Computing, E-Commerce, and E-Services, 2006.