I am making a protocol that has one missing piece. It involves 2 non-trusted party $A$ and $B$ and a semihonest third party $C$. This protocol has a contingency step where if $A$ leaves prematurely, $B$ is supposed receive time locked puzzle. It is important that $B$ cannot get the puzzle early. The puzzle ensures that after a period of time, $B$ will get a value he is supposed to get, but not immediately. Neither $A$ nor $B$ want $C$ to be able to learn the value hidden in the puzzle (therefore $C$ can't have the puzzle), and $B$ shouldn't be able to start working on the puzzle until $A$ leaves and $C$ reveals the puzzle. $A$ also needs to prove to $B$ that the value hidden in the puzzle matches a commitment (preferably Pedersen) at the beginning of the protocol. Note that once $A$ leaves, $C$ wishes to leave almost immediately (for important structural reasons), so it can't just be an encryption to which $C$ holds the key and $C$ gives it to $B$.

My question is does such a system currently exist? This system being as follows: $A$ creates a time locked puzzle that cannot be worked on by $B$ until a value is released while still proving that the puzzle hides the same value as a commitment.

I know that such a scheme can be created by going down to the bit-level, but I would strongly prefer a more efficient solution.

I am aiming for a sequential puzzle that takes around 2 hours for a powerful computer to solve, akin to this paper.

TLDR: Is there a way to encrypt a puzzle such that the puzzle cannot be worked on until it is decrypted while still proving that the solution to the puzzle matches a commitment?

  • $\begingroup$ This is a XY problem, you propose the solution already along your problem. You don't need a timelocked something. You could also have a secret shared between B and C, where C sends his share to B if A leaves. Nothing fancy, just let A create the shares and a ZK proof that the shares actually contain what they are supposed to contain. $\endgroup$ – tylo Jun 20 '19 at 22:24
  • $\begingroup$ That solution won't work. $C$ can't wait around after $A$ leaves, but $B$ can't have the secret until some time has passed. If $B$ has the value immediately, it poses a problem for $A$, and $A$ leaving isn't necessarily malicious. $\endgroup$ – Zarquan Jun 21 '19 at 3:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.