# Tag Info

10

You are probably looking for what is called "anonymous credentials". An anonymous credentials system relates three types of parties: authorities, users, and verifiers. An authority (Alice) can issue a credential to a user (Bob), that certifies that the user satisfies some property (in your case, that would be "is trusted"). Credentials are unforgeable. ...

9

OTR can provide forward secrecy because both partners create fresh ephemeral (one-time-use) keys, which are discarded afterwards, so they can't be recovered by later attackers. The long-term public keys are only used to authenticate them, to avoid any man-in-the-middle attack. For offline communication like e-mails this is not easily possible, since the ...

6

Yes, this is possible (conditionally). It sounds like you want Format Preserving Encryption. FPE works by encrypting from an arbitrary domain $X$ onto $X$. Consequentially, if plaintext $M \in X$ is encrypted to ciphertext $C \in X$, any decryption of $C$ - even with the wrong key - will yield a decrypted message inside of $X$. Thus an attacker doesn't know ...

5

We need clear goals. The question asks for "plausible deniability" or "deniable encryption", and these terms needs a precise definition in a public-key context (implied by RSA). I assume that in addition to the IND-CPA and IND-CCA1 properties of a cipher, including hybrid (as implied by AES), it is desired that: One without the private key can't ...

4

There are two requirements here: Anonymity - the two end points must not be able to discover the other's location or identity, nor must any other party be able to identify either endpoint. Plausible Deniability - both parties must be able to plausibly deny that they participated in the conversation. The problem with this type of communication over the ...

4

It is possible that you have some additional implicit constraints that invalidate the following solution. But as the question currently stands the following might give you what you are looking for: Assume we have a authenticated symmetric encryption scheme. (Say encrypt-then-mac with a blockcipher in a suitable mode.) We get our two messages $m_0,m_1$ and ...

3

I understand the question as asking for a method such that: after step 3., we'll have a reasonably small password P2; deciphering MJ using P1 will give "Mocking Jay"; deciphering MJ using P2 will give "The Hobbit", or a meaningful extract of that, at least comparable in size to MJ; MJ is produced at step 2. without "The Hobbit" as input. By an entropy ...

3

It looks like you might be interested in applying Deniable Encryption. The general idea of this kind of encryption is that you can decrypt the data to produce a different (but still plausible) plaintext. In this way, the airport staff or whoever is asking you to decrypt the data, would by no means differentiate between the real plaintext and the ...

3

Your problem, the way I read it, could be described as follows: You are currently using password encryption for protecting the confidentiality of files on a known format. You have concerns regarding the long term confidentiality of those files, given that you don't know what computers will be able to do in the future. Ideally, you want the confidentiality to ...

3

Deniable encryption is a topic that has been worked on for a while, but recently (in the last year or two), I have seen many more papers. I haven't kept up with the area but can make a few comments: The schemes are typically built with public key primitives instead of symmetric key ones (the distinguishing feature not being the symmetry of the keys, ...

3

I am assuming that AES decryption with a common chaining mode (e.g. CBC) is used. For an encrypted text (any sequence of bytes of the right length), any key will yield some kind of "decrypted text". For deniable encryption, the following must be met: There must be no integrity check, or the alternate keys must match it (so the encryption format should have ...

2

Anonymous channels like mix networks and Tor allows messages to be untraceable, meaning the content of the message can be learnt but the originator of the message cannot be determined. (See answer by Polynomial for details). Deniable channels like OTR Messaging allow the content of the message to denied (after the message is sent, either party can make up ...

2

It does not break Bob's deniability since MAC keys are symmetric. Bob still has plausible deniability as Alice could have just as easily forged any message she claims was from Bob. Also, remember that OTR uses malleable encryption (a stream cipher mode) and has a forgeability property, which makes deniability even easier for Bob.

2

Alice must send enough data for both Mocking Jay and The Hobbit. But there may be a plausible reason for all that data. Alice encrypts Mocking Jay using a method that produces ciphertext indistinguishable from random. Alice appends random data to that ciphertext to bring it to the length of The Hobbit (presumed at least as long as Mocking Jay). Alice sends ...

1

Well it makes the arguments about PFS stronger. If they would not frequently do a re-keying and securely erasing the old key (note that then they can not even read their own past messages anymore) an adversary that breaks either into Alices or Bobs computer and gets the shared secret can read and link all the previous communication between Alice and Bob. ...

1

In step 2 for Alice, what is the purpose of including Bob's public key in the hash? you can include a timestamp to prevent replay attacks instead. In step 2 for Bob, there is a typo - should use Alice's public key instead of her private key. Actually your protocol is similar to PGP, and I dont think it provides deniability because if Bob can prove that the ...

1

fgrieu addressed the entropy argument (hard to fit The Hobbit without expanding the input/output too much). I would like to point out following details: Extra data added in in compression etc. may still appear to to somebody analyzing the output (steganography) Asymmetric cryptography contains many bits that are random by the specification, for instance, ...

1

Have you considered using a one-time pad scheme if you really want plausible deniability? Each bit of the plaintext is XORed with a bit from the secret random pad. Even without the correct random pad or key, the ciphertext can be decrypted to all possible messages of the given length.

1

Note that the fact that a deniable encryption scheme has been used or at least is available for use is hard or even impossible to hide. Competent attackers observing the mathematical possibility of secondary plaintext will assume it has been used and will thus attempt to beat or persuade the second password out of you. So the situation regarding the ...

1

A one-time pad would meet your requirements, but is impractical. If the key length is much shorter than the message length, and the ciphertext length is not much longer than the plaintext length, it is known that the problem is unsolvable in practice. You might also be interested in non-committing encryption.

1

Its of course doable. Please be referred to this paper for more details.

Only top voted, non community-wiki answers of a minimum length are eligible