# Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and send the encrypted messages to one another.

Now is there some cryptographic scheme thinkable that lets Alice only decrypt her message (using key B) when Bob is able to decrypt his (via key A)? To guarantee that Alice will tell Bob her key after Bob told his?

The simplest solution would be a third-party which releases both keys at exactly the same time, but maybe there is also a cryptographic way to do this?

-
Are you familiar with en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange? If yes, and this wouldn't meet your specific requirements, please explain why. –  Henrick Hellström May 13 '13 at 10:09
@Joshua: $\:$ How should Bob verify the key he gets? $\;\;\;$ –  Ricky Demer May 14 '13 at 1:07

Note that it is probably technically impossible to meet your requirement that both secrets have to be revealed at exactly the same time, if interpreted literally. However, if we interpret this requirement as meaning that each party needs guarantees that the other party selected its own message, before decrypting the message of the other party, then this might be achieved using a scheme by which each party commits to a message without revealing it, before actually sending it.

Note: In order to guarantee that Alice will get $M_B$ when revealing $M_A$, you need a trusted third party. However, if your requirements are consistent with simply giving Alice the ability to abort further interactions with Bob if Bob decides to cheat, the following scheme should be sufficient.

For simplicity, suppose each party has a RSA key pair that can be used for both signing and encryption, and that Alice already has the public key of Bob, and vice versa.

1. Alice selects a message $M_A$. Bob selects a message $M_B$.
2. Alice selects a symmetric AES key $K_A$. Bob selects a symmetric AES key $K_B$.
3. Alice generates $S_A = Sign_{Priv_A}(K_A)$. Bob generates $S_B = Sign_{Priv_B}(K_B)$.
4. Alice generates $C_A = AESEnc_{K_A}(M_A)$. Bob generates $C_B = AESEnc_{K_B}(M_B)$.
5. Alice sends $S_A,C_A$ to Bob. Bob sends $S_B,C_B$ to Alice.
6. Alice generates $T_A = Encrypt_{Publ_B}(K_A)$. Bob generates $T_B = Encrypt_{Publ_A}(K_B)$
7. Alice sends $T_A$ to Bob. Bob sends $T_B$ to Alice.
8. Alice generates $K'_B = Decrypt_{Priv_A}(T_B)$ and aborts if $Verify_{Publ_B}(S_B,K'_B)$ fails. Bob generates $K'_A = Decrypt_{Priv_B}(T_A)$ and aborts if $Verify_{Publ_A}(S_A,K'_A)$ fails.
9. Alice generates $M'_B = AESDec_{K'_B}(C_B)$. Bob generates $M'_A = AESDec_{K'_A}(C_A)$.

The above scheme should only be regarded as a general outline.

-
I think you know this, but just to be very explicit: The protocol in this answer doesn't meet the requirement of the original question. If Alice is malicious, she can arrange to learn Bob's message without revealing her own message. –  D.W. May 13 '13 at 17:46
Yes, that perhaps should be made explicit. The best you can do without a trusted third party, is to get the ability to abort if the other party tries to change its message after you reveal yours. For some scenarios that is enough. –  Henrick Hellström May 13 '13 at 17:57
I think that "designated aborter" (as you described) and "an aborter can't learn the honest party's $\;\;$ message with much less effort than the honest party can learn the aborter's message" are the two optimal properties for the setting without a third party (and that a protocol in that setting can't have both of those). $\:$ –  Ricky Demer May 13 '13 at 20:59
@RickyDemer: Without additional assumptions and constraints, protocols with the latter property are not possible without a third party. cs.utexas.edu/~shmat/courses/cs395t_fall04/pagnia.pdf –  Henrick Hellström May 13 '13 at 21:24
I suppose the assumption/constraint needed for the latter property is that $\hspace{1.33 in}$ computation is not much easier for the adversary. $\:$ –  Ricky Demer May 13 '13 at 21:37