4
$\begingroup$

Let's say I have a document. I want to give you a copy, and then I want to prove that I gave you a copy. Ie, I want some kind of digitally signed receipt from you. If you're dishonest, you may receive the document and then refuse to give me a receipt. I would like some sort of cryptographic protocol that provides some sort of "simultaneous swap" - I give you a document, you give me the receipt. Does anything like this exist?

PS. I'm happy to do the research myself, but I have no idea what terms to google for. "Proof of disclosure" definitely isn't the right search term.

Improve this question
$\endgroup$
5
  • $\begingroup$ That might be related to the two generals problem, for which there is no fully satisfactory solution. But more complex. $\endgroup$
    – fgrieu ♦
    Commented Oct 25, 2017 at 22:13
  • $\begingroup$ That's my instinct too - it feels like the two generals problem. However, despite this, I feel like I have a semi-satisfactory solution: $\endgroup$
    – jyelon
    Commented Oct 26, 2017 at 3:50
  • $\begingroup$ OK, here's my solution: Alice gives the document, wrapped in a 1000-year time-lock puzzle. Bob gives the receipt, wrapped in a 1000-year time-lock puzzle. Repeat, with delays that are 5% less (eg, 950 years on iteration 2). Keep repeating until the delays are negligible. If Bob aborts the iteration early, then the receipt is received 5% later than the doc - which is still pretty close to "simultaneous." If Bob never sends receipt at all, he has to wait 1000 years. Problems: expensive protocol, and I don't know how to prove that the time-lock puzzle contains the desired info. $\endgroup$
    – jyelon
    Commented Oct 26, 2017 at 4:03
  • $\begingroup$ Because you're also asking for keywords, I can try to give you some: the property you're trying to achieve here is called fairness in crypto (A gets her output iff B does). Your idea of using time-lock puzzles is ingenious and closely resemble a primitive called timed commitment, which has essentially the same purpose. Regarding the issues of your solution: I doubt there is something considerably more efficient than what you do (fairness is very hard to achieve). Proving that the TLP contains the right info (say, a digital signature) can be done quite efficiently with an appropriate ZKP. $\endgroup$
    – Geoffroy Couteau
    Commented Oct 26, 2017 at 16:56
  • $\begingroup$ Thanks! I've googled fairness and then "fair exchange" and I'm on the right track. Thank you for pointing me in the right direction. $\endgroup$
    – jyelon
    Commented Oct 26, 2017 at 17:10

1 Answer 1

Reset to default
1
$\begingroup$

You could probably achieve this with a distributed ledger (e.g. a blockchain). If you were to have an image taken of your document recipient holding the document, otherwise you would take the document back immediately or nullifying its effect (e.g. revoke a digital signature on the document that would've been useful for the recipient), and hash that image, and place that onto said ledger, you would have proof that you disclosed information to the recipient. The importance is that due to distribution, the record is redundant, immutable, and most importantly, irrefutable. This method could also be used as a proof of chronology.

One example of this is Bitcoinproof, a method of hashing image data into a Bitcoin address, and sending either a small transaction or no bitcoins to that address. By doing so, the transaction can be mined into a block, becoming a permanent record that can be verified using an image.

Finding the image hash as a Bitcoin address (SHA-256, RIPEMD-160, and base58check), which will have likely only 1 transaction to it, with a timestamp that cannot change, i.e. a proof of chronology. This can also be used as a proof of disclosure, as you mentioned.

That is, unless you're exceptionally good at Photoshopping an image of your recipient into holding your document.

And it might fail, if you lose the photo, or if the network becomes less popular.

Also, this wouldn't be good for private information. You would be using a public ledger, so in the event the receiver disputes your claim, you would have to reveal the information to the public in order to prove this. This means that the document is only good for gaining one time access to a system, through a digital signature.

Improve this answer
$\endgroup$
1
  • $\begingroup$ In my application, there's no way to "take the document back." The document contains useful information, once I've released it, it's out. $\endgroup$
    – jyelon
    Commented Oct 26, 2017 at 3:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.