2
$\begingroup$

I am making a protocol that has one missing piece. It involves 2 non-trusted party $A$ and $B$ and a semihonest third party $C$. This protocol has a contingency step where if $A$ leaves prematurely, $B$ is supposed receive time locked puzzle. It is important that $B$ cannot get the puzzle early. The puzzle ensures that after a period of time, $B$ will get a value he is supposed to get, but not immediately. Neither $A$ nor $B$ want $C$ to be able to learn the value hidden in the puzzle (therefore $C$ can't have the puzzle), and $B$ shouldn't be able to start working on the puzzle until $A$ leaves and $C$ reveals the puzzle. $A$ also needs to prove to $B$ that the value hidden in the puzzle matches a commitment (preferably Pedersen) at the beginning of the protocol. Note that once $A$ leaves, $C$ wishes to leave almost immediately (for important structural reasons), so it can't just be an encryption to which $C$ holds the key and $C$ gives it to $B$.

My question is does such a system currently exist? This system being as follows: $A$ creates a time locked puzzle that cannot be worked on by $B$ until a value is released while still proving that the puzzle hides the same value as a commitment.

I know that such a scheme can be created by going down to the bit-level, but I would strongly prefer a more efficient solution.

I am aiming for a sequential puzzle that takes around 2 hours for a powerful computer to solve, akin to this paper.

TLDR: Is there a way to encrypt a puzzle such that the puzzle cannot be worked on until it is decrypted while still proving that the solution to the puzzle matches a commitment?

$\endgroup$
2
  • $\begingroup$ This is a XY problem, you propose the solution already along your problem. You don't need a timelocked something. You could also have a secret shared between B and C, where C sends his share to B if A leaves. Nothing fancy, just let A create the shares and a ZK proof that the shares actually contain what they are supposed to contain. $\endgroup$
    – tylo
    Jun 20, 2019 at 22:24
  • $\begingroup$ That solution won't work. $C$ can't wait around after $A$ leaves, but $B$ can't have the secret until some time has passed. If $B$ has the value immediately, it poses a problem for $A$, and $A$ leaving isn't necessarily malicious. $\endgroup$
    – Zarquan
    Jun 21, 2019 at 3:00

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.