2
$\begingroup$

I plan to circulate a petition, asking people to support it. This petition will reach a senior government official.

In regular circumstances, people would support such petitions by writing their name, their national ID number, and their physical or email address.

However, due to the nature of the petition, people may be reluctant to sign it because it would expose their name to other people. People may even be reluctant to provide their name to the person collecting the signatures (me).

Let us assume that we trust in the senior government official receiving the petition: that official has the right to know what our real names are, and we assume that our identities and contact info will be safe.

Let us assume also that people who sign have no incentive to fake their signatures (sign using the name of someone else, etc).

Assume that the senior government official has a public key.

I was thinking about this setup: I get this website, with the text of the petition. People can enter a piece of text there.

That piece of text would be their name, national ID and contact info, encoded if they wish. If it is encoded, the only person able to decode that text should be the senior official.

Is there a user friendly way in which people can get a set of keys, write a short text, encode it, and then copy-paste it to the petition website?

Note that I don't want to install a key generator on my own petition website, since people would be right not to trust it.

$\endgroup$
1
$\begingroup$

This depends on the level of authenticity you want to provide with your system. A lot of public petition systems do not enforce authenticity of petitioners at all. Basically, anyone can submit a petition in behalf of their neighbor, for example, simply by introducing relatively public info about them (name, address, ID number, etc). In this case, public-key encryption seems the way to go. For example, this could be done with plain, old PGP, where the public key belongs to the government officer.

On the contrary, if you want the petitioners to actually sign the petition (digitally, obviously), then this has to be done with some sort of digital signature. I think you could implement this with designated verified signatures:

A designated verifier signature is a signature scheme in which signatures can only be verified by a single designated verifier who is chosen by the signer.

In this case, the designated verifier could be trusted government officer receiving the petition.

$\endgroup$
1
  • $\begingroup$ The plain PGP approach seems to be adequate. Since it is likely that potential petitioners would not be familiar with encryption, what would you suggest for them to be able to encrypt their name/contact info and copy-paste the resulting string to the form in my petition website? $\endgroup$ – Juan Zuluaga Apr 22 '16 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.