Is it possible for one party to encrypt some data and have another party (unknown to the first party) view that original data if a certain condition is met?

I cannot find any information about this despite numerous searches. I might have the terminology wrong, or perhaps... it is impossible!

I read about zk-SNARKS, and as I understand it, this technique is used to prove a computation on an encrypted value or perhaps show the opening of some commitment in a set.

I thought perhaps you could set a condition in a circuit. Say (for simplicity), using a (public) input integer x less than 100 (or maybe part of a set or something), you could print secret data y. But that would mean the encrypting party would have to produce an unsatisfied partial SNARK somehow. Then the person that wants to attempt decryption would have to input their integer later.

I guess it's not a great example unless the input is provably random, but is there some technique to do this? I only mention SNARKS as it's the only thing I could think of where you can have arbitrary conditions like this. In reality, I was thinking of something where the data revealed could be any size, like a huge text file or something other than an integer y.

  • $\begingroup$ Maybe witness encryption is what you're looking for? $\endgroup$ – Maeher Oct 19 '20 at 10:11
  • 2
    $\begingroup$ Could you be looking for "attribute-based encryption"? $\endgroup$ – DannyNiu Jan 24 at 12:46

"Conditional decryption" title could be confusing. A ciphertex verification was demonstrated at Bitcoin workshop Financial Crypto 2016, to be a valid solution of a Sudoku instance. No third (another) party required.

Technically, we prove satisfiability of an R1CS system with a SNARK proof, and "computation on an encrypted value" could be expressed as R1CS equations, leading to just one single proof. One could also create "some secret plaintext is less than parameter AND this ciphertext is valid for that plaintex and some secret key" circuit.

Sure one could make a comparator circuit with a parameter (100 in your example), in hope to get a secret in logarithmic number of verification queries, alledgely rendering encryption useless. However, there is no oracle with SNARKs, only one single snark-proof for specific parameter value (for example, =100). If a prover would create too many comparator snark-proofs himself, he will break his encryption.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.