Unlinkable electronic coupon protocol with anonymity control

In a variant of the electronic cash protocol, an electronic coupon protocol, a withdrawn coin is divided into many sub-coins whose face values are fixed in advance, and the sub-coins are only used in payments. The original coin is called ticket and the sub-coins are called sub-tickets. The electronic cash protocol should satisfy not only the anonymity that the payer cannot be traced from the payments, but also the unlinkability. The unlinkability means that anyone cannot determine whether payments were made by the same payer. If the unlinkability does not hold, tracing the payer from one payment leads to tracing the payer from all his/her payments, and the link between the payments also facilitates the de-anonymization. In the previously proposed electronic coupon protocol, payments of sub-tickets derived from the same ticket are linkable. Since the complete anonymity of payments facilitates fraud and criminal acts, the electronic cash protocols should equip the revocation of the anonymity. In this paper, an electronic coupon protocol is proposed, where all payments are unlinkable but the anonymity of the payments can be revoked.