Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I was wondering if there is any kind of cryptosystem where the following characteristics are met:

  1. Both public and private keys are generated by a two-party key generation protocol between a user and a Certificate Authority/Key Generation Center/Whatever.
  2. The user cannot create valid (i.e., "certified") key pairs on his own. In other words, it is not possible to produce ciphertexts under his public key nor to decrypt ciphertexts unless the protocol has been followed.
  3. There is no key escrow (i.e., at the end of the protocol the CA does not know the private key)
  4. The CA cannot decrypt messages either.

It reminds me to Certificate-based Encryption (CBE), except that in this case the public key is also produced by the two-party protocol, so CBE would not satisfy requirement 2.

share|improve this question

put on hold as unclear what you're asking by Ilmari Karonen, e-sushi yesterday

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

Could you specify what you mean by 2. since the user can always generate a key pair for some unrelated system (e.g. RSA) and that key pair can be used for encryption and decryption. Do you mean that the user should not be able to use the certified key pair before it's certified? I.e. when a key pair is certified it is known that it hasn't been used yet? –  otus yesterday
Of course, as you say, it is always possible to bypass this by using other cryptosystem. However, RickyDemer's answer made me rethink my question, and now I'm tempted to delete it, since I don't have a clear view of the requirements. –  cygnusv yesterday

1 Answer 1

No. $\:$ The adversary lets the public key and the private key and the ciphertext all equal
the empty string. $\:$ By doing so, the adversary either created a valid key pair on its own
or produced a ciphertext under its public key without the protocol having been followed.

share|improve this answer
Sorry, I think I'll have to rephrase my question. In your solution, users are still able to decrypt ciphertexts when the signature was not checked during encryption. For this reason, I required that also the private key was product of the protocol. I have just updated the question. –  cygnusv yesterday
I changed my answer. $\;$ –  Ricky Demer yesterday

Not the answer you're looking for? Browse other questions tagged or ask your own question.