Decentralized, offline, and privacy-preserving e-cash could fulfil the need
for both scalable and byzantine fault-resistant payment systems. Existing
offline anonymous e-cash schemes are unsuitable for distributed environments
due to a central bank. We construct a distributed offline anonymous e-cash
scheme, in which the role of the bank is performed by a quorum of authorities,
and present its two instantiations. Our first scheme is compact, i.e. the cost
of the issuance protocol and the size of a wallet are independent of the number
of coins issued, but the cost of payment grows linearly with the number of
coins spent. Our second scheme is divisible and thus the cost of payments is
also independent of the number of coins spent, but the verification of deposits
is more costly. We provide formal security proof of both schemes and compare
the efficiency of their implementations.