# Tag Info

7

You are probably looking for what is called "anonymous credentials". An anonymous credentials system relates three types of parties: authorities, users, and verifiers. An authority (Alice) can issue a credential to a user (Bob), that certifies that the user satisfies some property (in your case, that would be "is trusted"). Credentials are unforgeable. ...

5

OTR can provide forward secrecy because both partners create fresh ephemeral (one-time-use) keys, which are discarded afterwards, so they can't be recovered by later attackers. The long-term public keys are only used to authenticate them, to avoid any man-in-the-middle attack. For offline communication like e-mails this is not easily possible, since the ...

4

It is possible that you have some additional implicit constraints that invalidate the following solution. But as the question currently stands the following might give you what you are looking for: Assume we have a authenticated symmetric encryption scheme. (Say encrypt-then-mac with a blockcipher in a suitable mode.) We get our two messages $m_0,m_1$ and ...

4

Yes, this is possible (conditionally). It sounds like you want Format Preserving Encryption. FPE works by encrypting from an arbitrary domain $X$ onto $X$. Consequentially, if plaintext $M \in X$ is encrypted to ciphertext $C \in X$, any decryption of $C$ - even with the wrong key - will yield a decrypted message inside of $X$. Thus an attacker doesn't know ...

3

It looks like you might be interested in applying Deniable Encryption. The general idea of this kind of encryption is that you can decrypt the data to produce a different (but still plausible) plaintext. In this way, the airport staff or whoever is asking you to decrypt the data, would by no means differentiate between the real plaintext and the ...

3

Your problem, the way I read it, could be described as follows: You are currently using password encryption for protecting the confidentiality of files on a known format. You have concerns regarding the long term confidentiality of those files, given that you don't know what computers will be able to do in the future. Ideally, you want the confidentiality to ...

3

Deniable encryption is a topic that has been worked on for a while, but recently (in the last year or two), I have seen many more papers. I haven't kept up with the area but can make a few comments: The schemes are typically built with public key primitives instead of symmetric key ones (the distinguishing feature not being the symmetry of the keys, ...

3

I am assuming that AES decryption with a common chaining mode (e.g. CBC) is used. For an encrypted text (any sequence of bytes of the right length), any key will yield some kind of "decrypted text". For deniable encryption, the following must be met: There must be no integrity check, or the alternate keys must match it (so the encryption format should have ...

3

There are two requirements here: Anonymity - the two end points must not be able to discover the other's location or identity, nor must any other party be able to identify either endpoint. Plausible Deniability - both parties must be able to plausibly deny that they participated in the conversation. The problem with this type of communication over the ...

2

It does not break Bob's deniability since MAC keys are symmetric. Bob still has plausible deniability as Alice could have just as easily forged any message she claims was from Bob. Also, remember that OTR uses malleable encryption (a stream cipher mode) and has a forgeability property, which makes deniability even easier for Bob.

1

A one-time pad would meet your requirements, but is impractical. If the key length is much shorter than the message length, and the ciphertext length is not much longer than the plaintext length, it is known that the problem is unsolvable in practice. You might also be interested in non-committing encryption.

1

Anonymous channels like mix networks and Tor allows messages to be untraceable, meaning the content of the message can be learnt but the originator of the message cannot be determined. (See answer by Polynomial for details). Deniable channels like OTR Messaging allow the content of the message to denied (after the message is sent, either party can make up ...

Only top voted, non community-wiki answers of a minimum length are eligible