1
$\begingroup$

Suppose I have some knowledge that I want to transfer securely from Alice's computer to Bob's computer, and prove that future breaches to Alice's computer will not reveal that information to someone else. I.e., I want to be able to treat that information like a physical object, which can be moved, but not simply copied.

I have discovered that Proofs of Ignorance are a thing, but I don't really understand them very well. So, for any arbitrary piece of information x, is there any protocol between Alice & Bob in which Alive reveals x to Bob (thus proving that she did in fact know it at one point), and then subsequently prove that Alice has forgotten?

| improve this question | |
$\endgroup$
2
$\begingroup$

From the linked paper on Proofs of Ignorance:

Intuitively, it seems impossible, since one can always pretend to be ignorant. We explore the settings in which one could give a convincing proof of ignorance. As a thought experiment, suppose that Alice holds a locked box and wants to convince Bob that she does not know the contents inside the box. In general, Bob has no reason to believe Alice unless Alice provides some evidence on how she got the box in the first place. Suppose Bob trusts that Charlie gives locked boxes without revealing its contents and suppose that Alice is able to prove that she got the box from Charlie, then Bob might be convinced of Alice’s assertion.

The paper's concept of a proof of ignorance is only applicable to certain settings where a player can prove that they never had the information to begin with. It doesn't offer a way for a player to prove that they've forgotten some information they knew at some point. I don't think there's any sure way that you could prove that.

If you know the knowledge is intended for Bob from the start, could you not encrypt it directly to Bob? If you and Bob had a pre-shared key, then you could symmetrically encrypt the knowledge with that key, or if Bob had published a public key, then you could asymmetrically encrypt the knowledge with that key. Alice wouldn't be able to make any sense of the information, but could still be able to relay the encrypted information to Bob.

There are some possible reasons that the encryption-based scenario wouldn't work for your case:

  • You don't know yet who will be "Bob" when you give the information to Alice (maybe Alice chooses who Bob will be), and Alice needs to be able to complete the process without your involvement.
  • Your only communication channel to Bob is a one-shot communication through Alice, so you can't share a key with each other ahead of time or after the fact.

If the encryption-based solution doesn't work for you, then this question otherwise seems like a more specific version of How to use proof of lack of knowledge?. That question is to prove a lack of knowledge, and this question is about proving a lack of knowledge that was previously held.

I provided an answer to that question based on incentives, but that answer is less than perfect for this scenario because it also incentivizes Alice to retain the information and claim the bounty.

| improve this answer | |
$\endgroup$
  • $\begingroup$ I had in mind a slightly different case: Alice is the originator of the information, but wants to prove to Bob that the secret will be kept--that it cannot be given by Alice to anyone else. That would be useful, e.g., if Alice were a digital artist who wanted to sell limited-edition works, to prove to the customer that they really do have the only copy. As far as I can tell, though, that is equivalent to the case where you are sending information though Alice, but don't know who Bob is yet. $\endgroup$ – Logan R. Kearsley Feb 9 '19 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.