I'd like to know if there's any cryptographic scheme that implements something similar to what I'm summarizing here below.

Thanks a lot for reading and for any hint or question.


There's a public encrypted ledger of accounts such that each contains a balance of funds.

Whoever owns the private keys to one account can read and move the funds. Moving the funds consists in issuing a digitally signed "strong" modification of the account encrypted data (and other stuff related with the destination of the funds but we will ignore that for simplicity). This "strong" modification works in a way that, whoever issues it, can only move funds actually existing in the account.

In order to implement obfuscation on data modifications there's another kind of modification available to those that don't have the private key of an account: the "weak" modification.

"Weak" modifications occur together with a "strong" one in order to make impossible for an observer to tell which is the "strong" modification among all the modifications issued. "Weak" modifications are indistinguishable from "strong" ones for anyone without the private key of the account, but they actually just mess around with the encrypted data. "Weak" modifications can't result in a true "strong" modification - that is they can't add or move funds from the account, even by chance.

When the owner of the private keys wants to make a "strong" modification on his account - or read his account balance, he can revert the "weak" modifications - if any - back to the original account data, before executing the "strong" modification.

More analitically:

  1. Data encr(D) is encrypted, public and only Bob that controls the private key k(D) can access its decrypted version D and issue "strong" modifications to the data. "Strong" modifications are strictly defined by the protocol and are only possible to the private key holder.

  2. Alice "weakly" modifies encr(D) via a function w(encr(D), k(A)) that depends on encr(D) and on the private key available to Alice only, k(A) - this key is the one used to secure the "strong" modification of Alice's account among the "weak" ones. "Weak" modifications are "not strong". That is: Alice overwrites the encrypted data following deterministic rules TBD, without understanding of the consequences on the actual underlying data. "Weak" modifications follow rules by which they can't accidentally result in "strong" ones. Think to this as obfuscation: Alice pretends to be the owner of Bob's account and to perform some action on the balance but she actually just messes around with the encrypted data. Only Alice (who issued the weak modification) and Bob (who owns the private key for D) can tell that this is a weak modification on Bob's account.

  3. The result of 2) is public data encr(wD). There is a public function reverse(encr(wD), k(D)) that provably (that is without the risk of forgeries) and deterministically outputs back encr(D). This particular step seems the perfect target for the implementation of a zero knowledge proof: the account owner needs to prove that he didn't make up the data without giving them away.

  4. There is a public function strong(reverse(encr(wD), k(D)), k(D), strongmod_data) that takes the original or recovered encr(D) and strongly modifies it according to the modification strongmod_data, issued by Bob. Think for example to Bob wanting to move his funds. He takes the data messed up by Alice, applies the reverse function to obtain the original account balance and issues an order to "strong" modify his account. This action won't let other users acknowledge neither that his modification is "strong" nor that Alice's modification was "weak".


Is this recursively possible by any known scheme?

That is: can we have arbitrary N different Alices performing "weak" modifications on N subsequent versions of encr(D) and Bob would still be able to reverse to the initial version from the last, strongly modify it, all while proving that this is indeed the "good" version of the data and not something that he has concocted for his own interests?

PS: I know that there are many obfuscation schemes around but as far as I can tell they can't be adapted to the kind of underlying data structures I'd like to work with.

PPS: Should I give up trying to find secure schemes good for my desired data structures and try to adapt my data structures to well known secure schemes?

  • 1
    $\begingroup$ Two things: 1. Note that Bob being able to reverse to the last "strong modification" might let him detect that other modifications were "weak modifications". This may not be what you are hoping for. 2. "Obfuscation" often means something somewhat technical in cryptography that is different than what you talk about. In particular, it generally refers to starting with some program (formalized via a circuit C), and producing another circuit C' that has the same input-output behavior but which obfuscates the implementation details of C'. $\endgroup$
    – Mark Schultz-Wu
    Commented Mar 21 at 0:45
  • $\begingroup$ @MarkSchultz-Wu Regarding your first point: in point 2) of my question I stated that it is exactly as intended. Since Bob is the owner of the account he must necessarily be able to tell that some modifications are weak: he's the only one able to issue strong ones. $\endgroup$
    – Lorenzo
    Commented Mar 22 at 9:42
  • $\begingroup$ @MarkSchultz-Wu Regarding your point 2. For "obfuscation" I meant any program behavior that "hides something" - making it hard to "understand", "anticipate", "simulate", "reverse", etc the behavior of the program - depending ofc on the circumstancial goals of obfuscation. In this case I guess I've been too ambitious with the request - even if a similar scheme is actually possible, putting all the pieces together is a very demanding task. I should split my question in various questions to see if there's something out there that checks all the conditions and only later put the things together $\endgroup$
    – Lorenzo
    Commented Mar 22 at 9:42
  • $\begingroup$ @MarkSchultz-Wu. Can't modify the comment, sorry for the disorder. Adding to your point 1. Think e.g. about Alice issuing a strong modification and 10 weak ones to obfuscate it. Even if Bob knows that Alice issued a weak modification on his account, he can't tell which strong modification Alice actually performed on which of the other 10 accounts. $\endgroup$
    – Lorenzo
    Commented Mar 22 at 9:49


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.