There is a package that contains a device, the device is activated/deactivated over a short range radio signal - it's function is to detect any unauthorised tampering of the package during the time it is active.
Our three actors
- Tom - the sender of the package.
- Dick - the intended recipient of the package (Dick only wants the package if Harry has not tampered with it's contents).
- Harry - our black hat that wants to tamper with the contents of the package and then frame Dick for ordering it.
Tom sends Package to Dick and since Harry never touched it then Dick wants to take delivery.
Tom sends Package to Dick but Harry tampers with it, Dick has knowledge of the tampering and so refuses to take possession of the package thwarting Harries plan.
Scenario 3: (the bad one)
Tom sends Package to Dick, Harry tampers with it, Dick takes possession of the package and is deemed culpable for it's contents.
So now the rub is for Harry to be able to gain the knowledge needed to make a choice to accept the package without first revealing anything that could be used to prove he was expecting the package if he needs to turn around and deny it.
Enough with the setup then, so this is my solution I'm hoping will solve the dilemma...
When activating the device in the package Tom includes a secret code which he also communicates over a separate secure channel to Dick and sends the package on its way.
During transit if Harry intercepts it the device automatically wipes all trace of the secret code from memory (so Harry can't discover it and make a spoof of the device).
When it arrives at Dick's front door he transmits a randomly generated challenge string to the device - the device responds by hashing the challenge against the secret code (or against some non value if it happened to have been compromised) which can then be confirmed by comparing a similarly generated but unbroadcast hash with the known secret code.
And now finally my questions
Is my reasoning correct that Dick would maintain 'plausible deniability', are there any glaring vulnerabilities I have omitted? I'm new to this kind of thinking - would what I have been outlining be considered some form of 'security protocol' - if not what would it fall under so I can do some further reading? I'm working on programming the device inside the package mentioned above - so would like to get my self woke on these matters so the device isn't a complete pushover for the eventual Harries in the future!