# Tag Info

21

Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such as XOR. Purchase a plane ticket for an international flight connecting through Sheremetyevo airport. ...

11

First up, I think your question is less something for crypto.SE and would fit better in the security.SE corner. Nevertheless, here goes: ...except his name or identity... That's in itself already describes your problems when it comes to security and cryptography. Problem due to lack of verification options. Currently, world news outlets (example: ...

10

You are probably looking for what is called "anonymous credentials". An anonymous credentials system relates three types of parties: authorities, users, and verifiers. An authority (Alice) can issue a credential to a user (Bob), that certifies that the user satisfies some property (in your case, that would be "is trusted"). Credentials are unforgeable. ...

7

Using exponential Elgamal as the encryption function, Define the list of candidates: e.g., Alice, Bob, Carol Voters submit an encryption of their vote: e.g., to voter for Alice: $v=\langle\mathsf{Enc}(1),\mathsf{Enc}(0),\mathsf{Enc}(0)\rangle$ Use an OR-proof (Fig 2) to show each ciphertext encrypts a 0 or a 1: e.g., $\langle \pi_1, \pi_2, \pi_3 \rangle$ ...

5

Sorry for my boring and stolen answer (from http://crypto.stackexchange.com/a/9026/6961) : Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such ...

5

Yes. There has been extensive research on this question: there is even a community of cryptographers who work on building voting schemes of this sort (see end-to-end auditable voting system). I'll give you some advice based upon the experience from that field. Don't design your own. Don't try to design your own. There has been extensive research into ...

5

The other answers cover it quite elaborately, but in short: No. But let's consider this to be a game, with the following assumptions: There is a person called "Snowden". Somewhere. In the world. And he has no way to authenticate himself. Snowden initially trusts no one. There is no trustworthy way to authenticate anyone. What is the attackers ...

3

I'd like to refer you to the other answer in the original question. Suppose your laptop and Snowden's laptop are both capable of quantum communication. Suppose there is also a quantum phone book, or a quantum DNS service. When his passport got revoked, Snowden's address is also removed from the phone book (makes sense right?). Assuming you managed to grab a ...

3

An RSA ciphertext won't reveal who it is encrypted to, but it might reveal some information about who it isn't. We'll assume that everyone has an RSA key of the same length (e.g. 2048 bits). Now, a public key consists of a large modulus N (and an exponent, that's not important for this discussion); a ciphertext consists of a value C between 0 and N-1. ...

2

You can use blind signatures: "Blind signatures can also be used to provide unlinkability, which prevents the signer from linking the blinded message it signs to a later un-blinded version that it may be called upon to verify. In this case, the signer's response is first "un-blinded" prior to verification in such a way that the signature remains valid for ...

2

Something along these lines could be accomplished with zero-knowledge proofs. The voter proves that each one of the ballots is in the set $\{0,1\}$ and that the sum of the ballots is $1$. Prove this to each of the $n$ trusted third parties. Each of the third parties signs the ballots once the proof is done. Then the voter casts the ballots. Signatures can ...

2

It may be an interesting avenue to explore. I've read the highlight reel of the digital cash literature but I do not know it well enough to know how well these issues have been addressed. A few things to consider for #2: In a quick read of Lucre, it seems that the payee does no verification before passing the coin onto the mint. It seems, if the mint has ...

2

You could cheat and use different keys for each recipient. That would work assuming the recipients don't know each other (and cannot compare keys). Mix networks are by design hard to trace so it depends on the network. EDIT: Sending a message to Bob implies Alice knows how to find Bob in the first place, or knows someone who knows where Bob is, without Bob ...

2

If the buyer is selecting proxies to use as trusted third parties, presumably the buyer needs to trust that at least one of them is honest and not colluding with the other three. Therefore, if you need to be sure that they're not colluding, the answer is that the buyer should choose the three proxies to ensure that they're not colluding. Precisely how to ...

2

What you are describing is an anonymous credential system. There are two different ways to go about making these and two actual systems that use those techniques: Microsoft's U-prove and IBM's Idemix. If you're interested in smart card usage, you'd probably prefer U-prove as it tends to work better with smart cards. It's described by its original ...

2

If Bob and Charlie will share a secret, then it information-theoretic privacy might be possible, otherwise the best that can be hoped for is computational anonymity. I haven't come up up with any way to achieve information-theoretic privacy when Bob and Charlie share a secret, so I will only be addressing computational privacy. I assume that Bob can ...

2

I found a few for shuffles. The papers below will be good pointers for recent results. Stephanie Bayer and Jens Groth: Efficient Zero-Knowledge Argument for Correctness of a Shuffle. EUROCRYPT 2012. Melissa Chase and Markulf Kohlweiss and Anna Lysyanskaya and Sarah Meiklejohn: Verifiable Elections That Scale for Free. PKC 2013. Melissa Chase and Markulf ...

2

Encryption based voting will always suffer for a different reason. As a human, I cannot look at a numeric token to know if the value is "Yes" or "No". I have to 100% trust that the voting system is telling me this number is a vote for my candidate or not. It doesn't matter if there's a solidly convincing mathematical proof. As an ordinary voter, I ...

2

After reading your question again, I think that a MIX net with at least two mixes may solve your problem. Onion routing (in particular Tor as an implementation of its second generation) is designed for low latency services, such as web browsing. Another approach for services which tolerate high latency (such as email) is for instance mixminion. Typically, it ...

2

As @DrLecter commented, the property you refer is captured by "key privacy." There are more tricky ways to achieve key privacy (against chosen-ciphertext attacks) based on the RSA encryption scheme. Let us assume $2^{k-1} < N < 2^{k}$. Repeating Repeating to generate a ciphertext $y$ until the result is in the common domain, say, $[0,2^{k-1})$. See ...

2

Your aim is to have a number $y' = y + rn$ that gives an uniform distribution over any valid key modulus $n'$, so that no keys can be ruled out. For that, you need $y'$ to be uniformly distributed modulo a larger number. How large is the question. If you have uniform samples from $[0, 2^l-1]$, according to this (pdf, page 20 talking about key generation, ...

1

YES. What mix-networks provide is anonymous routing. Using a chain of proxies, incoming messages are shuffled and then they are sent in random order. So, the sender remains anonymous. Similarly the Bitmessage protocol mixes all encrypted messages of a given user with all other encrypted messages of the network. As a result, the sender remains invisible. ...

1

No. What this means is that they concatenate all of this data and then SHA1-hash the concatenation. There's no xor-ing of digests or anything like that. The reason it's described this way is because many hashing APIs allow you to specify the data in a streaming fashion: you can specify the first few bytes of the message to be hashed, then you can specify ...

1

If Alice didn't know who Bob was before, she still doesn't. All she knows is that she communicated with someone who has the private key corresponding with that public key, which presumably is the reason Bob has a public key.

1

By this point, mixnets are pretty mature technology. The main reason you aren't finding many recent papers is they just work. Instead, most of the research effort has been devoted to building larger systems (sometimes using mixnet as just one of many building blocks).

1

If you can find such an efficiently computable function (other than the trivial solution $\hat{e}( x, y ) = 1\ \$ for all $x$, $y$), then you have shown that the decisional Diffie-Hellman problem is easy. That is, given $g$, $g^a$, $g^b$, $g^c$, you can check whether $$ab = c$$ simply by testing: $$\hat{e}( g^a, g^b ) = \hat{e}( g, g^c)$$ The ...

Only top voted, non community-wiki answers of a minimum length are eligible