Abstract: The paper shows that there are two errors in the E-cash system [1]. (1) In the setup phase, the factors p1, p2 of modulus n are not published. This makes the user and the bank cannot make valid signatures in the withdraw phase. (2) The shop M must directly obtain those data (h, h1, h2, h3) used in payment phase in a secure way, instead of receiving them from a signature offered by a user U. Otherwise, the adversary can forge signatures in the payment phase. Therefore, there are four redundant data among the signature (z, a, b, r, j, h, h1, h2, h3) offered by a user.

Key words: forward-secure, electronic cash, discrete logarithm problem, blind signature, redundant data.