I have to implement protocol of secure data transfer that can be described as

  1. Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table)
  2. Alice encrypts selected data with some symmetric(!) algorithm and sends it to Bob.
  3. Bob decrypts data and get $m$
  4. Bob verifies that $m\in M$. It's important to realize here that Bob have no need to authenticate Alice, he must only be sure that $m$ is belong to $M$. However, Bob have no direct access to $M$
  5. If $m\in M$ then Bob sends $m$ via secure channel to Carol, else Bob ignore the $m$.

In other words, Bob serves as a gateway that provide secured communication and keeps Carol away from flooding of invalid messages.

Is there a protocol to achieve my goal? Please share any thoughts about it.

P.S. I don't want to use any TTP.

  • $\begingroup$ You did not say what kind of access Bob as to $M$. And what's TTP? $\endgroup$ Sep 19, 2012 at 11:29
  • $\begingroup$ @CodesInChaos: That's why I just assumed he wants Bob to have no information about M other than the elements of M that he gets from Alice. Also, Trusted Third Party. $\endgroup$
    – user991
    Sep 19, 2012 at 11:45
  • $\begingroup$ Can the part "Bob verifies that $m\in M$" be performed by assuming Alice plays by the rules and only enciphers $m\in M$? If yes, it seems any form of authenticated encryption will do. $\endgroup$
    – fgrieu
    Sep 19, 2012 at 16:37
  • $\begingroup$ @fgrieu: of course I just can authenticate Alice as it always sends valid messages, but my conditions are weaker as I mentioned in question and I dont want to implement any behaviour that can implies impossibility of not authenticated participants to send valid messages. $\endgroup$
    – tsionyx
    Sep 19, 2012 at 17:13
  • $\begingroup$ Well, you've already made it so that it's not necessarily feasible for not authenticated $\hspace{0.65 in}$ participants to send valid messages. $\:$ $\endgroup$
    – user991
    Sep 19, 2012 at 18:13

1 Answer 1


Carol generates a NIZK proof common reference string and a statistically binding commitment
to a formal description of $M$. $\:$ Carol sends both of those to both Alice and Bob, and additionally
sends the associated decommit string to Alice. $\;\;$ For each message $m$ in $M$, Alice calculates
the proof of $\:m\in M\:$ and encrypts it along with $m$ before sending the ciphertext to Bob.
After decrypting, Bob can then verify that $\:m\in M\:$ by verifying the NIZK proof.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.