I don't exactly know what I'm searching for but the scenario is at follows. Alice and Bob want to get married. According to the law, they have to make a set of medical investigations. Bob must show his medical results to Alice and Alice must show Bob her medical results. After that, they both need to go to a doctor that has to certify that they showed each other their medical results but the doctor isn't allowed to view the results of investigations from either Bob nor Alice. Can this task be resolved by a zero knowledge proof? If so, can you give me some references please? Thank you!
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
3
How about:
Alice and Bob both have to answer a series of yes-or-no questions by the doctor. Alice and Bob have to answer these questions separately.
Before they answer any question they agree that "1" is "yes" and "0" is "no", but the doctor doesn't know which is which. The doctor also has shuffled the questions so that Alice and Bob can't make some sort of predefined pattern for their answers.
One of the questions could i.e. be: "Does Bob have diabetes?".
Alice and Bob both know the correct answer to this (let's say that Bob doesn't have diabetes) and they both answer to this question with "0".
The doctor is not allowed to ask them questions that he knows the answer to, i.e. "Does Alice have blue eyes?"
The doctor now has both of their answers and compares them. If they both have the same answer to each question (assuming they answered truthfully and didn't make any mistakes) the doctor can be sure that they told each other their results.
The zero-knowledge part of this is, that the doctor still doesn't know anything about their medical results.
answered Aug 20, 2018 at 9:12
-
$\begingroup$ “The doctor is not allowed to ask them questions that he knows the answers”, apart from this being subjective, it might be impossible for someone who is not a doctor to figure out if two or more questions are related/dependent or obvious from a doctor’s point of of view. Statistically some some data leak might be possible. $\endgroup$ Commented Aug 20, 2018 at 13:46
-
$\begingroup$ This doesn't work. If Bob wants to hide info about his diabetes, he can just "feed" Alice with incorrect data ("no diabetes"). Then, they both will answer as "No diabetes", and it's accepted by your protocol. $\endgroup$ Commented Dec 7, 2018 at 10:30
-
$\begingroup$ The scope of the question is just about the fact that the medical doctor doesn't know about the results. The doctor only wants to find out if Bob and Alice have shared their info. If Bob lies to Alice about anything or vice versa is redundant. Alice and Bob aren't as the doctor in the ZK-part. $\endgroup$ Commented Dec 7, 2018 at 11:43
$\begingroup$
$\endgroup$
I would say you have a very unclear formulation of the problem. Where Alice/Bob get their medical results from? why not from the doctor? in any case, they should get it from some certified medical service. This certified medical service obviously knows the result. The medical service could just sign the result, so anybody can verify the authenticity of it. Then, Alice just receives the signed result from the medical service and show it to Bob. Bob should check the signature. That's it. Then, if you want to be sure that Bob knows the results of Alice, you just can ask him whether he saw a document with results? whether Alice full name was in the doc? whether the fresh date was in the doc? and whether the doc was properly signed by the medical service? that's enough.
Another interesting question: can Alice hide her person from the medical service, when she gets tested? in other words - unbind the result and her person, so the medical service obviously possesses the results, but don't know a person whom the result belongs to. To achieve this, both organizational and cryptographic techniques needed. I see the following approach. Alice (as well as everyone) sends her blood samples under some anonymous one-time identifier. Then, the medical service publishes all results with corresponding identifiers to some public site. Again, with signatures. When the result is ready, Alice sees it on the site. Nobody knows, except Alice, that this specific result corresponds to her. Well, but now she needs to convince Bob (and only him) that this identifier is her. This is where ZKP could bring a help. For example, we can employ Schnorr protocol, which allows proving a knowledge of discrete logarithm. So, Alive generates her anonymous identifier as an exponent of some secret value. Then, Alice can prove that she knows this secret value, using Schnorr protocol. (any other ZKP protocols could be used here)
When I wrote the last words, I've found that this approach has some security holes :) To cheat Bob, Alice can ask her friend to get tested instead of her (of course, the friend tells Alice the secret value). So actually, Bob will receive results of the friend of Alice. This can be also fixed in some way. You can elaborate more in this direction.
