One point of Taler's architecture is that blind signatures are used to create tokens, so the issuer doesn't know which coin was issued to which person. Then the merchant doesn't know who the coin was issued to but can redeem it with the issuer if it's valid. So if there's enough transaction volume it'll be hard for issue of coins and redemption at merchants to be correlated.
What worries me is the SNB whitepaper on "how to issue a digital currency" they worked on with Taler: https://www.snb.ch/public/asset/de/www-snb-ch/publications/r...
> > In addition, charging an exchange fee would allow the central bank to implement negative interest rates, if deemed necessary. The central bank could also impose a conversion limit per customer for AML/CFT (“cash” limits) or financial stability reasons (to prevent hoarding or bank runs), if desired.
And also I don't think they have a privacy-preserving solution for money transfers between consumers. So if I wanted to give you 20€ I think that has to be represented as a burning of tokens and a reissue, so the central issuer learns all those transactions even though purchases at merchants are private.
The privacy properties for P2P transfers between consumers are identical to those with merchants: the exchange can require the receiver to provide information about themselves, but the payer remains anonymous just like for purchases at a merchant. And yes, it involves spending (burning, if you prefer) the old tokens (we prefer digital coins) and issuing (blindly signing) fresh coins. Afterwards, the fresh digital coins are indistinguishable from those issued during a regular withdrawal from a bank account.
Would it be technically possible to transfer tokens to another user directly, without an exchange acting as an intermediate?
My assumption is that this is possible but not supported by default, since there’s no way to guarantee (without using an exchange) that the giver has really deleted the tokens they sent to the receiver, and will not spend them before the receiver can (which would render the receiver’s copy of the tokens unusable).
But assuming someone implements this in software, would it be possible to make direct transfers like this while relying entirely on trust? Or are the tokens somehow tied to the wallet that has first received them?
You can backup tokens and restore them to another wallet (and we are in the process of making that easier). We call that sharing, and it is not a transaction as it is simply granting access to the same money to both wallets.
Right, because you can issue coins as a "purchase" of the coins being transferred. That makes sense, but still doesn't address the concerns around the system being designed to support negative interest rates and withdrawal rate limits.