Brussels unveils plans for a digital euro promising complete privacy

We already have that system. They put your name on a list, and everyone with that name or similar has lots of paperwork to do.

https://en.wikipedia.org/wiki/Financial_Action_Task_Force_bl...

I really doubt that they intend do use it, but zero-knowledge cryptography indeed can accomplish this, so there is no technical limitation afaik.

> If the max is €3000 but it's entirely private, how could they possibly know I don't have a higher balance or multiple wallets?

This gets trickier. Let's say we limit to 3000 per account (and use whatever else to limit accounts/person). This would be possible, but would also reveal the amount on the account: try to send decreasing amounts, first one that succeeds reveals previous balance. There's probably an entity that can simulate sending too.

> What tech is even being used to allow fully private, offline transactions in the first place? How does the receiver verify that the digital cash is legit? And how does the network ensure that the money wasn't double spent while offline?

Yeah, this one is impossible.

It's not actually possible to prevent this entirely. It's not even possible with physical currency. You can always look at a bank note and make an exact-enough duplicate, then spend it twice.

> they're planning to make it so that you have to go online every set period of time and then they verify the money.

That's not a hard requirement, but yes. The central bank is the final authority on what currency is counterfeit or not.

-----

For current technology, I think it's probably sufficient to have a smart card issued by the central bank, with an embedded certificate chained to the central bank. For offline transactions, the two cards can establish an encrypted stream, mutually verify that they were attested by the central bank, and then mark notes as transferred to the other party in TXN#X, run the transfer, then delete the notes entirely.

Interrupting the process might leave the notes in a partial state (marked for transfer to a particular smart card), but the connection can be reestablished to try again, so long as the TXN# isn't incremented by another transaction.

Now you have to hack a smart card processor to double spend (and only offline, and still detectable), which is of similar difficulty and risk to making counterfeit banknotes.

Maybe North Korea will sell you an infinite money card, but it will only get you free coffee when hiking in the Alps, and only until that card's certificate is added to the revocation list and people update their transfer boxes.

Basically he used (and invented) blind signatures to allow the bank to sign a 'coin' without knowing what they signed. The customer takes the blindly signed coins from the bank, pays at a merchant and later the merchant deposits the coins at the bank again, where the signature is checked.

In this context offline just means that the merchant can verify the authenticity of the coin without immediately needing a connection to the bank. At some point in the future, however, the merchant will have to connect to the bank to get their money. Check out his original paper for details[1].

Offline systems have drawbacks, though. E.g the GNU Taler people made the pragmatic decision to have an online system. See chapter 1.2.1 'Offline vs Online' of Florian Dold's Phd thesis for a discussion on why[2].

[1]: https://chaum.com/wp-content/uploads/2022/01/Chaum-1990-Chap... [2]: https://taler.net/papers/thesis-dold-phd-2019.pdf