Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have to implement protocol of secure data transfer that can be described as

  1. Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table)
  2. Alice encrypts selected data with some symmetric(!) algorithm and sends it to Bob.
  3. Bob decrypts data and get $m$
  4. Bob verifies that $m\in M$. It's important to realize here that Bob have no need to authenticate Alice, he must only be sure that $m$ is belong to $M$. However, Bob have no direct access to $M$
  5. If $m\in M$ then Bob sends $m$ via secure channel to Carol, else Bob ignore the $m$.

In other words, Bob serves as a gateway that provide secured communication and keeps Carol away from flooding of invalid messages.

Is there a protocol to achieve my goal? Please share any thoughts about it.

P.S. I don't want to use any TTP.

share|improve this question
    
You did not say what kind of access Bob as to $M$. And what's TTP? –  CodesInChaos Sep 19 '12 at 11:29
    
@CodesInChaos: That's why I just assumed he wants Bob to have no information about M other than the elements of M that he gets from Alice. Also, Trusted Third Party. –  Ricky Demer Sep 19 '12 at 11:45
    
Can the part "Bob verifies that $m\in M$" be performed by assuming Alice plays by the rules and only enciphers $m\in M$? If yes, it seems any form of authenticated encryption will do. –  fgrieu Sep 19 '12 at 16:37
    
@fgrieu: of course I just can authenticate Alice as it always sends valid messages, but my conditions are weaker as I mentioned in question and I dont want to implement any behaviour that can implies impossibility of not authenticated participants to send valid messages. –  T_12 Sep 19 '12 at 17:13
    
Well, you've already made it so that it's not necessarily feasible for not authenticated $\hspace{0.65 in}$ participants to send valid messages. $\:$ –  Ricky Demer Sep 19 '12 at 18:13

1 Answer 1

Carol generates a NIZK proof common reference string and a statistically binding commitment
to a formal description of $M$. $\:$ Carol sends both of those to both Alice and Bob, and additionally
sends the associated decommit string to Alice. $\;\;$ For each message $m$ in $M$, Alice calculates
the proof of $\:m\in M\:$ and encrypts it along with $m$ before sending the ciphertext to Bob.
After decrypting, Bob can then verify that $\:m\in M\:$ by verifying the NIZK proof.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.