With public-key cryptography, I know Alice can "seal" a message that only Bob can open. But in that case, Alice knows the message that she is sealing.
What if Alice wants to seal a random number which she doesn't know? Could she seal it such that only Bob can determine it, not Alice?
Here, more specifically, is the kind of situation I'm wondering about:
Say the random number is from a uniform distribution 1 through 10. Alice seals an envelope containing the random number, without knowing what it is. While she doesn't know the number, she can be sure that it is one of the options 1-10 with uniform probability. Bob (and only Bob) can unseal it, and he can be sure that he's the only person who can. So when he opens it, he knows he is the first and only person to see what random number was generated by Alice. Then he can tell Alice what he got. And provide verification, so that Alice is then able to verify that Bob is being truthful about the number he claimed he got.
Bob should have cryptographic assurance that:
- He was the first to "scratch off" (identify) the randomly generated number.
- The number was fairly generated from the [1..10] uniform distribution.
Is such a cryptographic algorithm known or possible?
EDIT: Thank you for all the helpful discussion and feedback!
To take this question one step further: is there a way that Alice can prepare and send the "ticket" to Bob using only one message?
Meaning, basically: Can Alice prepare such a ticket using only Bob's public key?
Or, more exactly: Alice, in preparing the ticket to send to Bob, can use Bob's public key, or other previously known information -- but she can generate multiple different tickets to send without needing Bob to contact her each time a new one is generated. Only one packet -- the one from Alice to Bob, would be needed to send Bob one ticket.
Is an algorithm possible to create the "lottery ticket" with this additional "single-packet" limitation?