3
$\begingroup$

I'm Alice, and I generate a public/private key pair. I securely & confidentially share my public key with Bob and Carol, who securely & confidentially share it with various other benevolent users – all of whom can now send me encrypted messages that only I can decrypt.

I'd like to authenticate that the encrypted messages I'm receiving are from users that have been legitimately sent my public key. Malicious Mallory has not been sent my public key, but has access to the network and can see the encrypted messages that I'm being sent. I need to ensure she cannot deduce my public key to send me malicious encrypted messages.

What do I need to look for in a crypto library to achieve this?

Improve this question
$\endgroup$
8
  • 2
    $\begingroup$ DHIES / ECIES should easily prevent public key deduction from ciphertexts (you can figure out the group, but not the public key element), with RSA it's probably a little bit more tricky. $\endgroup$
    – SEJPM ♦
    Jan 19 '20 at 15:37
  • 1
    $\begingroup$ Of course you could also have the other participants authenticate their messages. Generally it is useful to know who send you which message. Otherwise Bob can send messages as Carol. That usually means having a (separate) PKI to distribute public keys of the other participants. And when we are on that subject: usually public keys are shared in such a way that they can be trusted. You seem to assume that "securely share" is synonymous with "confidentially share", which in this kind of scheme, it is not. Public and secret almost opposites after all. $\endgroup$
    – Maarten Bodewes ♦
    Jan 19 '20 at 17:39
  • $\begingroup$ @MaartenBodewes Seperate PKI unfortunately isn't an option for the use case. It also doesn't matter that benevolent users can send messages as other benevolent users. $\endgroup$
    – Max
    Jan 19 '20 at 17:59
  • 2
    $\begingroup$ You could also bundle a static symmetric MAC key as part of the public key and MAC the ciphertext to check if the sender got the public key. $\endgroup$
    – SEJPM ♦
    Jan 19 '20 at 18:16
  • 2
    $\begingroup$ @mentallurg It can make sense, e.g. if you want all parties from a set to be able to send messages to one party while ensuring the message originally came from the set and without anyone else but the sender from the set being able to know the message. $\endgroup$
    – SEJPM ♦
    Jan 19 '20 at 19:18
3
$\begingroup$

What do I need to look for in a crypto library to achieve this?

There are multiple options for this (from most to least desirable):

  1. You want any public-key encryption scheme and any MAC algorithm and distribute as your public key, the encryption scheme's public key and the MAC key. Then you enforce that every message either has the MAC applied on the ciphertext correctly (proving possession of the key) or on the entire message and the MAC is then also encrypted.
  2. You could also use static-authentication and a CCA2-secure public key encryption sheme (like DHIES, ECIES, RSA-KEM, or RSA-OAEP) and prepend a static secret to each message encrypting it as well. This heavily relies on the fact that an attacker cannot change encrypted messages meaningfully with CCA2-security and is "less clean" than using a MAC.
  3. You can use a scheme that naturally hides the public key, e.g. DHIES or ECIES where one may only learn the group but no the public element from ciphertexts without breaking the encryption. Of course this is a much less common security notion, so one has to be careful whether a given scheme naturally satisfies it.
Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.