3
$\begingroup$

Suppose that Alice runs a paid archival service.

  1. Bob wants to download a well-known plaintext M with hash H(M) from Alice by sending her the hash.
  2. Alice does not want to send M to Bob without Bob paying and Bob does not want to pay unless Alice sends him the real thing. Thus, Alice encrypts M with some temporary key K into: E(M, K) and sends that to Bob alongs with H(K).
  3. Bob checks that E(M, K) is indeed M encrypted with K, knowing only {E(M, K), H(K), H(M)}.

Is step 3 possible under some crypto system?

$\endgroup$
  • 1
    $\begingroup$ You probably need some form of zero knowledge proofs to do this. $\endgroup$ – puzzlepalace Jul 13 '17 at 17:28
  • $\begingroup$ I can imagine something like that using smart contracts on a blockchain... (i.e. changing steps 2 and 3 completely, but ending up with a way to ensure both delivery of the good and of the money to both receivers, without requiring a trusted third party.) This would prove useful to deal with ransomware, imho. $\endgroup$ – Lery Jul 14 '17 at 14:20
  • $\begingroup$ @Lery Can you share how it is done? I already read that fair exchange is impossible without a trusted third party but my case does not seem to fit the description. M is no secret, it just takes resources to store and retrieve. $\endgroup$ – Le Viet Bach Jul 14 '17 at 14:54
2
$\begingroup$

Answering in a pragmatic way (it might help, depending on the background of the question):

Even if step 3 is possible, it does not matter, since this will not add any additional security value.

Because: Bob still has to trust Alice that she will send him K in case that he pays the money. So Bob could also simply trust Alice, that she has already send him the correct encrypted text E(M, K) in the first place.

$\endgroup$
  • $\begingroup$ Well, this might not necessarily be the case, it all depends on the way you send the money... If the money is sent using a way which delivers it conditionally on K being correct, then Bob could send it... (But then how do you deal with dishonest Bobs? Well, the validity of K should be checked without having to trust him.) That's a nice problem to deal with. And there certainly are multiple ways around it. $\endgroup$ – Lery Jul 14 '17 at 14:24
  • 1
    $\begingroup$ Bob can sign a contract saying: "I pay the person who puts K (or rather: something that hashes to H(K)) here and sign it". That is not my big concern for now. The contract is also much smaller compared to M so they can even use some trusted third party to settle. $\endgroup$ – Le Viet Bach Jul 14 '17 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.