I don't quite know how to even ask the question for what I have in mind; but succinctly, I'm looking for some publicly implemented cryptosystem where messages for a user with id U
can be sent to U
using nothing but a single system-wide public key and knowledge of U
.
I have an unusual situation where I've been asked to code support for a massive peer-to-peer computing project with no central server. There is a central trusted authority that can email people secrets, very slowly, but isn't available at scale or in realtime to resolve issues of identity and authorization during a time when they will all be heavily active talking to each other.
Each entity in the system has a unique identifier U
, which we can imagine as a positive integer. As an abuse of notation, I'll use U
to both refer to the entity, and their id.
Rather than try to publish and/or promulgate a very large number of authority-issued certificates tying U
to its own public key, which I think is the normal way of doing this, I'm hoping to use a cryptographic communication scheme such that given a shared (ie, known to all entities) public key E
, any party can send a private message M
to U
via some f[U, E](M)
.
For instance, based on my limited understanding of RSA, the idea is for some master to generate N = p*q
, for p and q prime, and then calculate some E
and D
, E*D == 1 mod phi(N)
. Then E
may serve as a public key, and D
as a private key, via (M**E)**D mod N
. If instead we use E*D*U == 1 mod phi(N)
, then D*U
may be used to encrypt M
, and E
can be U
's private key. As a bonus, this remains symmetric; U
can sign something using D
, and anyone else can verify using U*E
.
The idea is then that the central authority could pick N
, not reveal p or q, promulgate N
and E
publicly, and email each entity U
its private secret D
value, by which they would later identify themselves. From that point forward, any doubter could authenticate an entity claiming to be U
, by sending challenges encrypted as E*U
, and confirming the entity claiming to be U
can decrypt. (I do not worry about private keys having been compromised.)
So good in theory, but all I've ever heard is that you don't want to ever implement your own crypto library. Is there anything like the above that already pre-exists as an open-source and battle-tested solution?