313

While I have used the term "electronic lottery tickets" as a pedagogic device

in explaining the scheme, I should emphasize that there are some real differences

between this scheme and ordinary lotteries, which are usually highly regulated.

First, note that in these schemes the role of buyer and seller are turned

around, because a lottery ticket is used as a

payment

rather than as an

item

being bought.

The typical user

issues

a lottery ticket and incurs an obligation to

pay it off if it wins, rather than

purchasing

a lottery ticket and hoping to receive

money if it is wins.

Second, the face values are considerably smaller here (say $10) than is usual

for typical lotteries (which may run into the millions of dollars).

Third, the "purchaser" of lottery tickets here (whom we have been calling

the "vendor") does not pay for them with money, but with information. No one

is going to make money by running a lottery of our sort if all they are receive in

return is access to web pages. The way to circumvent this claim would be to have

side payments by the vendor to the issuer for the lottery tickets. Perhaps the

simplest approach legally would be to restrict lottery

payments

by individuals to

some modest amount (say $1000 per year) to cover their micropayment needs,

without enabling them to run a large-scale lottery.

8 Privacy and Anonymity

Compared to ordinary credit-card payments or non-anonymous digital cash, elec-

tronic lottery tickets improve a user's privacy tremendously, because very few of

his transactions are reported to the bank. Thus, the bank learns about only a

few of the vendors that the user contacts.

True anonymity of the user from the vendor is more costly, as it requires

an intermediary (the vendor needs to have routing/delivery information for the

goods sold). That third party could also intermediate the payments for the user--

the user pays the intermediary, and the intermediary pays the vendor. This

works for electronic lottery tickets as for any electronic payment scheme. Here

it is simplest if the vendor reveals the winning number w after he receives his

lottery ticket, so that with slight protocol changes the intermediary's ticket to the

vendor can be made winning if and only if the user's ticket to the intermediary

is winning.

Another way of achieving such anonymity from the vendor is for the issuer's

credential to have no identification of the issuer other than a pseudonym known

to the issuer and the bank, and to run the payment protocol as usual, except that

an intermediary is used to hide the issuer's network address from the vendor.

9 Conclusions and

Discussion

We have presented a micropayment scheme, based on "electronic lottery tickets,"