Abstract

We specify an anonymous peer-to-peer payment and tipping method in which one signed transaction binds three properties: per-action proof of personhood by user-verified FIDO2/WebAuthn signing on an attested platform authenticator, physical proximity attestation by Ultra-Wideband (UWB) or Bluetooth Low Energy (BLE) ranging, and sender anonymity toward the recipient. The device-signed ranging transcript is placed inside the payload over which the WebAuthn assertion is computed, with a verifier-issued single-use nonce, so user verification and co-location are attested by one signature over one object.

Proximity requires one UWB ranging (IEEE 802.15.4z secure ranging where exposed) or two agreeing mechanisms among UWB, BLE and signed GPS with anti-spoofing checks, within a radius set by population density — r = clamp(10 km · ρ^(−1/2), 100 m, 10 km), ρ per km² read on the device from a cached tile, doubled for BLE-only attestation. Biometric modality is enforced by an authenticator (AAGUID) allow-list, not by the user-verified flag.

The recipient receives the message, any monetary value, the attestations and a stable per-recipient pseudonym, HMAC(salt_R, sender_id), uncorrelated across recipients; the verifying party retains identity for audit. The disclosure further specifies verifier checks, collusion and sybil detection by graph analysis, per-pseudonym rate limits and block lists against harassment, amount quantization against covert channels, replay protection, threshold-based regulatory disclosure, and an optional kinship-verification layer. Stated residuals: PIN fallback, shared or synced passkeys, UWB distance-reduction and BLE relay attacks, unattended recipient devices, and no unlinkability toward the verifier.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS