payment mix

[Wei Dai <weidai@eskimo.com>]

A payment mix is like an email mix, but instead of mixing and remailing
emails, it mixes and repays payments. This would be useful when the
payment system itself does not offer anonymity. A payment mix basicly
turns any traceable payment system into an anonymous one.

Payment mixes could be chained for additional security, just like email
mixes. But by using blind signatures this could also be avoided. In that
case the payment mix would be acting like a mini ecash mint. To illustrate
how it would work, suppose Alice wants to give $1 to Bob.

1. Alice pays $1 to the payment mix using the traceable payment system.

2. In exchange, the payment mix issues Alice $1 in blinded (Chaumian)
ecash.

3. Alice gives the ecash to Bob.

4. Bob gives the ecash back to the payment mix.

5. The payment mix pays Bob $1 using the traceable payment system.

Notice that because of blinding, in step 4 the payment mix cannot connect
the ecash it gets from Bob to the ecash it issued to Alice.

This is a pretty simple idea, but I don't remember if we talked about it
here already. If blinding is used, a payment mix would basicly BE an ecash
mint, except the cash it issues would be held only momentarily by its
users. Because its total outstanding liability at any given moment would
be fairly low, a payment mix would only have to be minimally trusted.