1
$\begingroup$

Is it possible for one party to encrypt some data and have another party (unknown to the first party) view that original data if a certain condition is met?

I cannot find any information about this despite numerous searches. I might have the terminology wrong, or perhaps... it is impossible!

I read about zk-SNARKS, and as I understand it, this technique is used to prove a computation on an encrypted value or perhaps show the opening of some commitment in a set.

I thought perhaps you could set a condition in a circuit. Say (for simplicity), using a (public) input integer x less than 100 (or maybe part of a set or something), you could print secret data y. But that would mean the encrypting party would have to produce an unsatisfied partial SNARK somehow. Then the person that wants to attempt decryption would have to input their integer later.

I guess it's not a great example unless the input is provably random, but is there some technique to do this? I only mention SNARKS as it's the only thing I could think of where you can have arbitrary conditions like this. In reality, I was thinking of something where the data revealed could be any size, like a huge text file or something other than an integer y.

Improve this question
$\endgroup$
3
  • $\begingroup$ Maybe witness encryption is what you're looking for? $\endgroup$
    – Maeher
    Oct 19, 2020 at 10:11
  • 5
    $\begingroup$ Could you be looking for "attribute-based encryption"? $\endgroup$
    – DannyNiu
    Jan 24, 2021 at 12:46
  • $\begingroup$ Perhaps the following line of thought can help here: the basic condition for decrypting something is having the correct key. But a key, can be, at least partially, derived from any information you like. So, can you cook up a scheme in which the user will be able to provide materials for the key derivation, that he would only be able to obtain if a certain condition (the condition you're interested in) is satisfied? And of course, add into that the requirement, that this "condition space" is large enough, in order for the key space to be large enough, and not susceptible to exhaustive search. $\endgroup$
    – Amit
    Feb 14 at 17:43

1 Answer 1

Reset to default
0
$\begingroup$

"Conditional decryption" title could be confusing. A ciphertex verification was demonstrated at Bitcoin workshop Financial Crypto 2016, to be a valid solution of a Sudoku instance. No third (another) party required.

Technically, we prove satisfiability of an R1CS system with a SNARK proof, and "computation on an encrypted value" could be expressed as R1CS equations, leading to just one single proof. One could also create "some secret plaintext is less than parameter AND this ciphertext is valid for that plaintex and some secret key" circuit.

Sure one could make a comparator circuit with a parameter (100 in your example), in hope to get a secret in logarithmic number of verification queries, alledgely rendering encryption useless. However, there is no oracle with SNARKs, only one single snark-proof for specific parameter value (for example, =100). If a prover would create too many comparator snark-proofs himself, he will break his encryption.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.