I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for a possible theoretic solution for the following, without being able to change the rules.
Consider the following threat model:
A website that allows accounts for journalists to receive leaked documents / data.
Each journalist has an ID on this website (say username, public key, public key fingerprint, whatever will do).
Whistle blowers use those IDs to send leaked data using this website.
The journalists need to be able to log into their accounts on the website and see all the information that was sent to them, like a list of "support tickets" or something like this.
The website should not be able to see that data content in clear text. - this problem is fixable by implementing database encryption with key derived from user password and kept in session, and dumped at the end.
The threat that needs to be fixed: CENSORSHIP OF ACCOUNTS.
The problem with the above system is that journalists accounts are static. They are also public, and known to everyone including the possible censors. So, a censor with "authority" can easily force the website to "block" account XXX or otherwise make its data unavailable. Regardless the data itself is secure and safe, not read by any party, it can still be made unavailable to the journalist by censoring their accounts.
What I need is a hint in order to implement multiple cryptographic functions in a system that will allow a website to map data to an account anonymously.
Explained in laymen terms (for simplicity):
- You go to a website to send some information to user / account: XXX.
- Consider the information you send is already encrypted end to end from you to the receiver, so the information itself is not at risk. The only risk is for the information not to reach the receiver.
- The website needs to be able to show that data to user / account XXX when they log in and needs to also have a technical impossibility to "freeze" or "censor" the account XXX in order to not receive further information if required by a censor.
I was thinking of zeroproof systems but I have no clear way to implement them. Also, if instead of account names we use whole pubkeys, senders can send encrypted data directly but a censor can force the website to "filter" pubkey X. So, the base problem remains unsolved.
Even if one would use Time based codes based on OTP that link to certain accounts, a censor could still force the website to identify the journalist account by trying to send some dummy data themselves to that certain account using a time based token.
Ideas? Thanks in advance.