Even if you somehow mandated a special ecash chip, #2 with #4 would seem to be very difficult to secure - with all the motivation in the world to crack. It's the clipper chip, except this time with digital cash! Seems like it would also have privacy and gov't monitoring concerns.

> This probably can't go wrong, and certainly wouldn't motivate groundbreaking research into breaking TPMs

Is the e-cash proposal qualitatively different from Apple Pay (or other phone wallets designed to hold credit cards) in this regard?

Credit cards are centrally managed by a bank, need network communications and have transaction reversibility. This is literally a P2P system and their solution to avoid double spends is to have the device's root user not be the owners of such devices basically with something that is TPM like.

If you break the TPM and get device or key control, then you can double spend. Double spending victims will find out they've been fooled when they go redeem their ecash for non-ecash and find out someone else already redeemed it.

This is why bitcoin was such an innovation, because it prevented double spending, and it also made it you didn't need to trust a central ledger database maintainer (aka bank) to not mess with the ledger either and it let you do it over a distributed network!

I think they're really talking about chaumian ecash with this act: https://en.wikipedia.org/wiki/Ecash

I get that it's better (from the victim's perspective) to have to deal with fraudulent credit card transactions, but I don't get the difference from the point of view of the fraudster. If anything, breaking Apple Pay would be better than cracking a hardware wallet containing ecash, since someone's credit limit on the linked cards would generally be greater than the amount of cash they have on hand.

If you break Apple Pay on your device, you can essentially get... your own credit card number. If you break open an e-$100 bill you get as many copies of that hundred dollars as you can spend before getting caught.

Ah, I thought you were talking about the individual holder's risk of theft, not the system's risk of counterfeiting.

My understanding from the article is that the TPM would be used to prevent theft, and counterfeiting would be prevented by something like RSA blind signatures (e.g., http://www.hit.bme.hu/~buttyan/courses/BMEVIHIM219/2009/Chau...)