# Data-validating protocol

I have to implement protocol of secure data transfer that can be described as

1. Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table)
2. Alice encrypts selected data with some symmetric(!) algorithm and sends it to Bob.
3. Bob decrypts data and get $m$
4. Bob verifies that $m\in M$. It's important to realize here that Bob have no need to authenticate Alice, he must only be sure that $m$ is belong to $M$. However, Bob have no direct access to $M$
5. If $m\in M$ then Bob sends $m$ via secure channel to Carol, else Bob ignore the $m$.

In other words, Bob serves as a gateway that provide secured communication and keeps Carol away from flooding of invalid messages.

Is there a protocol to achieve my goal? Please share any thoughts about it.

P.S. I don't want to use any TTP.

-
You did not say what kind of access Bob as to $M$. And what's TTP? –  CodesInChaos Sep 19 '12 at 11:29
@CodesInChaos: That's why I just assumed he wants Bob to have no information about M other than the elements of M that he gets from Alice. Also, Trusted Third Party. –  Ricky Demer Sep 19 '12 at 11:45
Can the part "Bob verifies that $m\in M$" be performed by assuming Alice plays by the rules and only enciphers $m\in M$? If yes, it seems any form of authenticated encryption will do. –  fgrieu Sep 19 '12 at 16:37
@fgrieu: of course I just can authenticate Alice as it always sends valid messages, but my conditions are weaker as I mentioned in question and I dont want to implement any behaviour that can implies impossibility of not authenticated participants to send valid messages. –  tsionyx Sep 19 '12 at 17:13
Well, you've already made it so that it's not necessarily feasible for not authenticated $\hspace{0.65 in}$ participants to send valid messages. $\:$ –  Ricky Demer Sep 19 '12 at 18:13

to a formal description of $M$. $\:$ Carol sends both of those to both Alice and Bob, and additionally
sends the associated decommit string to Alice. $\;\;$ For each message $m$ in $M$, Alice calculates
the proof of $\:m\in M\:$ and encrypts it along with $m$ before sending the ciphertext to Bob.
After decrypting, Bob can then verify that $\:m\in M\:$ by verifying the NIZK proof.