Is there an encryption scheme such that

  1. you can encrypt some data (such as an image) once,
  2. generate multiple decryption keys that can decrypt the ciphertext (so far this is just shamir's secret sharing, but wait for it!), and
  3. when the data is decrypted it comes out slightly modified/"watermarked" in a way that reveals which decryption key was used to decrypt it (so in the image example, maybe some pixels are a little bit off, and if you know the algorithm, the encryption key, the possible decryption keys, and the original image, you can figure out which decryption key was used).

Obviously, a simple layering of modifying the data after it is decrypted does not work, because then an untrusted party implementing the decryption step can just skip the modification and get the original un-watermarked data. I was wondering if it is possible to make it so that the modification and decryption are intrinsically linked such that there is no unmodified decryption possible - either the data decrypts watermarked to that specific key, or not at all.

  • $\begingroup$ I guess there's an untold but critical requirement: that it's hard to modify the decryption algorithm/code or key so that it outputs with no watermark, or the watermark associated with a different key. $\endgroup$
    – fgrieu
    Commented Nov 28, 2020 at 19:41
  • $\begingroup$ @fgrieu Exactly! Sorry, I thought it was obvious enough to the kind of people who could answer that I didn't need to say it, but I guess it is kinda subtle. Do you think I should edit that into the question body? $\endgroup$
    – mtraceur
    Commented Nov 28, 2020 at 19:44
  • 1
    $\begingroup$ Yes, in crypto, precise requirements are critical, and should be explicit. And there are critical variations in what I mentioned. Like, are adversaries trying to remove/alter the watermark assumed to know how to read the watermark, or not? Independently, you have not mentioned if the decrypted+watermarked output is assumed to be compressed with loss (e.g. jpeg), or not (png, gif), which makes a huge difference; and if a trusted execution environment is assumed for the decryption, which is of paramount importance. $\endgroup$
    – fgrieu
    Commented Nov 28, 2020 at 20:02
  • $\begingroup$ Are the watermarks to be used by the person encrypting to know who distributes the data (say on torrent), or by the person decrypting to prove it is their copy? $\endgroup$
    – Modal Nest
    Commented Nov 29, 2020 at 13:04


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.