3 votes
Accepted

How could you disclose what you like and have someone respond with what you want without revealing who you are?

All Bob needs is to generate an Ephemeral key: just make (say) an RSA key, use it to initiate and proceed with communications with Alice, then delete it when he's done, taking care never to use it to ...
user avatar
3 votes

Check if two anonymously signed messages have the same author

Ok, here's a simple method that appears to address your requirements. It uses two signature methods; the first one (the "inner signature") is conventional; the second one (the "outer signature") is ...
user avatar
  • 134k
3 votes
Accepted

Understanding the big picture with regard to how anonymous credentials work

I'll try to give some high-level intuition of the used construction paradigms in my answer below. First, note that we distinguish between one-show and multi-show anonymous credential schemes. For one-...
user avatar
  • 1,293
3 votes
Accepted

Is it possible to derive an Ed25519-public-key from an Ed25519-signature?

From Wikipedia, an EdDSA signature is a pair $(R, s)$ of a point $R \in E(k)$ and scalar $s \in \mathbb Z$ satisfying the verification equation $$[2^c s] B = [2^c] R + [2^c H(R, A, M)] A,$$ where $E/k$...
user avatar
3 votes

What are the actual anonymity features of ZCash?

As a short answer, yes you can have a transaction that does not allow others to trace who the money was paid. Zcash supports four kinds of transactions that are categorized as follows, Public-...
user avatar
  • 271
3 votes
Accepted

Alice answering Bob without knowing the question

You can use Oblivious transfer protocol for the answers: https://en.wikipedia.org/wiki/Oblivious_transfer Here is an example with only 2 answers ($m0$ and $m1$) and uses RSA ($e,d,N$) : In your case ...
user avatar
  • 9,829
3 votes

anonymous signature implementation and usage?

The first google-entry brought up this paper. To answer your questions: An anonymous signature is a signature that is unforgeable in the classic sense. But without the message no informations about ...
user avatar
  • 44.7k
2 votes

Are Anonymity and Authentication possible together?

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am ...
user avatar
  • 83
2 votes
Accepted

How CL-signature can act as positive & additive accumulator?

Any signature scheme can work as an accumulator: when elements are signed with the manager's secret key, signature works as a system membership witness (positive acc). It is also additive because you ...
user avatar
  • 36
2 votes

Advantages of group signature schemes without encryption over with encryption

Usually the schemes without encryption are more efficient in terms of computational and size complexity. This owes to the fact that encrypting a membership certificate and proving the consistency is ...
user avatar
  • 1,293
2 votes

Does an anonymous signature hide the sender's identity from the receiver?

It is perhaps more complicated. Signer anonymity for anonymous signatures means anyone who has the signature but not the message (or does not know enough about the message) cannot reveal the identity ...
user avatar
  • 4,048
2 votes
Accepted

A method to receive payments at obscured addresses

Your algorithm should be secure since it's basicly the same as the "one-time-address"-algorithm in the CryptoNote protocol, which is described as following: Alice generates two secret keys $a$ and $b$...
user avatar
  • 1,454
2 votes
Accepted

What is an "anonymous admissible timestamp"?

What he meant is quite unclear. It could be that he's referring to a Timestamping Authority (TA) (See related RFC like 3161). What they do is basically sign a document/hash with the current time and ...
user avatar
  • 376
2 votes
Accepted

Anonymous Group Signature

Ring signatures are similar to group signatures, but do not have group managers. Another key difference is that a "ring" can be formed at signing time with whoever's keys you like - you don'...
user avatar
  • 1,523
1 vote
Accepted

l-Diversity logarithm

Entropy and other measures of information can be defined to any base and so should always be quoted with units (bits/shannons for base 2, nats for base e, and bans/harts for base 10). The most common ...
user avatar
  • 11.8k
1 vote
Accepted

Anonymity of Paillier cryptosystem in e-voting system

You've discovered some of the challenges of secure electronic voting. As you can see, merely having a cipher that allows you to confidentially tally numbers is not sufficient to conduct a secure ...
user avatar
  • 19.3k
1 vote

IS zk-SNARK not suitable for constructing anonymous authentication scheme?

For now, I have gradually understood why the zk-SNARK cannot be suitable for constructing anonymous authentication scheme. That is the performance issue. According to some references: [1]Succinct Non-...
user avatar
  • 186
1 vote
Accepted

Algorithm for anonymous but associated communications from a set of verified communicants?

You are describing linkable ring signatures. Here's a paper from ICCSA that goes into the model and proposes some schemes.
user avatar
  • 11.8k
1 vote

Crypto scheme to map data to users in a way that is anonymous to database server

I'm not sure this threat model is realistic, since I would expect an adversary to want to shutdown the entire site, instead of just censoring specific "contributors" :-). To protect from ...
user avatar
  • 652
1 vote
Accepted

How to achieve identity authentication without revealing credentials

The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of ...
user avatar
1 vote

To what extent would Bitcoin be private without address reuse?

This would not help, and would actually make things worse. Bitcoin transactions are public, the input and output addresses are known. This can therefore be traced. Simply tracking the transaction from ...
user avatar
1 vote

Faster Shuffling for a Simple Application

The obvious way is to use two oblivious transfers. In case you need reminding: an Oblivious Transfer is a protocol where one party (Alice) has a number of secrets (in this case, two), and the other ...
user avatar
  • 134k
1 vote

What is the difference between an anonymous-encryption scheme and an authenticated-encryption scheme?

authenticated-encryption scheme This one takes the sender's public key $g^a$ and the recipients public key $g^b$ and using the currently available secret key ($a$ or $b$) computes $g^{ab}$ and ...
user avatar
  • 44.7k
1 vote

Is there any way to check signed documents in a group of people without knowing who signed which?

It is possible with a group signature scheme. The idea of group signature was proposed by David Chaum and Eugene van Heyst exactly for the scenario you described. Citing from the abstract: In ...
user avatar
  • 4,048
1 vote
Accepted

Is there any way to check signed documents in a group of people without knowing who signed which?

There is more than 1 way to do it. You can use Group signatures or Ring signature which allow anyone in a predefined collection to sign a message on behalf of a group. Group signatures require a ...
user avatar
  • 492
1 vote
Accepted

What is the difference between "Linkable" and "Traceable" Ring Signatures?

The Wikipedia Article on Ring Signatures, though, suggests Linkable Ring Signatures can't be used for that purpose. The Wikipedia article doesn't say or imply that. It lists possible applications: ...
user avatar
  • 12.3k
1 vote

Choice of bilinear group for implementation of BLS signature with NIWI proof?

If you want to try a scheme that is already being used in the industry, you may try EPID. A paper describing it is on IACR eprint 2009-095.
user avatar
  • 622
1 vote
Accepted

Why is Tor alone not enough to guarantee anonymity for Bitcoin?

Bitcoin was designed to be decentralized, but was not designed to be anonymous. How you use (earn or spend) Bitcoin cannot (in general) be made anonymous because the protocol was not designed to ...
user avatar
  • 425

Only top scored, non community-wiki answers of a minimum length are eligible