124 reputation
4
bio website
location
age
visits member for 1 year, 9 months
seen Aug 22 '13 at 14:58

Feb
6
comment Is such a crypto-system available?
@poncho Could you point out to a paper that explains the efficiency of the factorization in case same modulus is reused for multiple pairs?
Feb
6
comment Is such a crypto-system available?
@poncho The solution satisfies the requirements although I would like to share my thoughts on its deficiencies (btw. Bob knows k_new and Eve knows k2). First is the storage overhead needed to store the hash tree. With the Barack Obama's solution I have to store k_new (and modulus) only for the portions I share (although public key crypto is much slower than symmetric encryption). If new data is added there is a problem again (if I shared H8 now Bob would know also H16, H17, right?). Regarding my interests: they are mixed indeed, but solving the real example has a bigger priority for me.
Feb
6
awarded  Commentator
Feb
6
comment Is such a crypto-system available?
@BarackObama I think the conditions haven't changed that much from the original (a non-negligible change is that I haven't thought that alternative k2' k_new' pairs might reveal original k1). The use case description is just an example to help other readers understand the abstract description, no new requirements are introduced there. However it may be, I am thankful to all people considering this post worth spending their time, regardless of the actual contributions. By the way using different modulus for different pairs seems to solve the (k2', k_new') problem.
Feb
6
awarded  Scholar
Feb
6
accepted Is such a crypto-system available?
Feb
6
revised Is such a crypto-system available?
added 12 characters in body
Feb
6
comment Is such a crypto-system available?
@fgrieu there is no need in a trusted authority. Alice generated k1, k2 and computes k_new as a function of k1 and k2. It is ok if k_new is independent of k1 and k2 but I can't imagine something like this is possible (after all c2 is some sort of a function of k1 and k2). Bob needs only k_new to recover the original plaintext.
Feb
6
comment Is such a crypto-system available?
@IlmariKaronen yes the questions seem to be identical, except mine has a "non-theoretical" use case :) and there is no requirement on the type of cryto-system used.
Feb
6
revised Is such a crypto-system available?
added a use case
Feb
6
comment Is such a crypto-system available?
It doesn't matter for me as long as it satisfies the properties specified in the question. The originator of the data has key k1, Alice has key k_new. Even if Alice finds k2 or any other pairs (k2', k_new') she shouldn't be able to compute k1.
Feb
6
comment Is such a crypto-system available?
@jug Searching for "DES is not a group" I gradually found proxy re-encryption which seems like something I am looking for.
Feb
6
comment Is such a crypto-system available?
The point is not to make the encryption stronger, the point is to enable a third party see only a subset of the data with minimal overhead (avoiding the naive scenario where one has to decrypt c1, encrypt with k2 and then just share k2).
Feb
5
revised Is such a crypto-system available?
added 103 characters in body
Feb
5
comment Is such a crypto-system available?
@poncho regarding your comment on k1, k2, k3. How one can deduce k1?
Feb
5
comment Is such a crypto-system available?
Checking my understanding of the suggested solution: $pt^{k_1} = c_1, c_1^{k_2} = c_2, k_{new} = (k_1 * k_2)^{-1} mod(\phi(N))$. $pt = c_2^{k_{new}} = pt^{k_1 * k_2 *(k_1 * k_2)^{-1}}$ Is that right?
Feb
5
comment Is such a crypto-system available?
Suppose I encrypt a large text with $k_1$. Now I want to share a small portion of that text by encrypting it with $k_2$. Now I can share $k_{new}$ with Alice. Alice can decrypt only the portion she is supposed to see.
Feb
5
revised Is such a crypto-system available?
Clarifications related to first comments
Feb
5
comment Is such a crypto-system available?
The value of k1
Feb
5
awarded  Editor