21

Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such as XOR. Purchase a plane ticket for an international flight connecting through Sheremetyevo airport. ...


11

First up, I think your question is less something for crypto.SE and would fit better in the security.SE corner. Nevertheless, here goes: ...except his name or identity... That's in itself already describes your problems when it comes to security and cryptography. Problem due to lack of verification options. Currently, world news outlets (example: ...


5

Sorry for my boring and stolen answer (from https://crypto.stackexchange.com/a/9026/6961) : Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such ...


5

The other answers cover it quite elaborately, but in short: No. But let's consider this to be a game, with the following assumptions: There is a person called "Snowden". Somewhere. In the world. And he has no way to authenticate himself. Snowden initially trusts no one. There is no trustworthy way to authenticate anyone. What is the attackers probability ...


4

An RSA ciphertext won't reveal who it is encrypted to, but it might reveal some information about who it isn't. We'll assume that everyone has an RSA key of the same length (e.g. 2048 bits). Now, a public key consists of a large modulus N (and an exponent, that's not important for this discussion); a ciphertext consists of a value C between 0 and N-1. ...


3

Ok, here's a simple method that appears to address your requirements. It uses two signature methods; the first one (the "inner signature") is conventional; the second one (the "outer signature") is anonymized. When Alice generates a message $m$, she either generates a public/private key pair $Pub_a, Priv_a$ for the inner one, or reuses a $Pub_a, Priv_a$ ...


3

You can use Oblivious transfer protocol for the answers: https://en.wikipedia.org/wiki/Oblivious_transfer Here is an example with only 2 answers ($m0$ and $m1$) and uses RSA ($e,d,N$) : In your case Alice would have to send $x_0 \ldots x_9$ and Bob would have to pick $b \in \{0,\ldots,9\}$ where $b$ is the number of his question. The operation $m + k$ can ...


3

After reading your question again, I think that a MIX net with at least two mixes may solve your problem. Onion routing (in particular Tor as an implementation of its second generation) is designed for low latency services, such as web browsing. Another approach for services which tolerate high latency (such as email) is for instance mixminion. Typically, it ...


3

I'd like to refer you to the other answer in the original question. Suppose your laptop and Snowden's laptop are both capable of quantum communication. Suppose there is also a quantum phone book, or a quantum DNS service. When his passport got revoked, Snowden's address is also removed from the phone book (makes sense right?). Assuming you managed to grab a ...


3

The first google-entry brought up this paper. To answer your questions: An anonymous signature is a signature that is unforgeable in the classic sense. But without the message no informations about the signer can be extracted from the signature even if brute-force of all public keys is possible. If I'm understanding things correctly, a blind signature hides ...


3

You could cheat and use different keys for each recipient. That would work assuming the recipients don't know each other (and cannot compare keys). Mix networks are by design hard to trace so it depends on the network. EDIT: Sending a message to Bob implies Alice knows how to find Bob in the first place, or knows someone who knows where Bob is, without Bob ...


3

As a short answer, yes you can have a transaction that does not allow others to trace who the money was paid. Zcash supports four kinds of transactions that are categorized as follows, Public-address to Public-address (like as the ones in Bitcoin) Public-address to Private-address (they call it shielded transactions) Private-address to Public-address (...


3

From Wikipedia, an EdDSA signature is a pair $(R, s)$ of a point $R \in E(k)$ and scalar $s \in \mathbb Z$ satisfying the verification equation $$[2^c s] B = [2^c] R + [2^c H(R, A, M)] A,$$ where $E/k$ is the underlying curve over a field $k$, $B \in E(k)$ is the standard $k$-rational base point of large prime order and cofactor $2^c$, and $A \in E(k)$ is ...


3

I'll try to give some high-level intuition of the used construction paradigms in my answer below. First, note that we distinguish between one-show and multi-show anonymous credential schemes. For one-show credential schemes, you essentially have that multiple showings of the same credential can be linked to each other, while showings are unlinkable to the ...


2

If the buyer is selecting proxies to use as trusted third parties, presumably the buyer needs to trust that at least one of them is honest and not colluding with the other three. Therefore, if you need to be sure that they're not colluding, the answer is that the buyer should choose the three proxies to ensure that they're not colluding. Precisely how to ...


2

What you are describing is an anonymous credential system. There are two different ways to go about making these and two actual systems that use those techniques: Microsoft's U-prove and IBM's Idemix. If you're interested in smart card usage, you'd probably prefer U-prove as it tends to work better with smart cards. It's described by its original ...


2

I found a few for shuffles. The papers below will be good pointers for recent results. Stephanie Bayer and Jens Groth: Efficient Zero-Knowledge Argument for Correctness of a Shuffle. EUROCRYPT 2012. Melissa Chase and Markulf Kohlweiss and Anna Lysyanskaya and Sarah Meiklejohn: Verifiable Elections That Scale for Free. PKC 2013. Melissa Chase and Markulf ...


2

If Alice didn't know who Bob was before, she still doesn't. All she knows is that she communicated with someone who has the private key corresponding with that public key, which presumably is the reason Bob has a public key.


2

As @DrLecter commented, the property you refer is captured by "key privacy." There are more tricky ways to achieve key privacy (against chosen-ciphertext attacks) based on the RSA encryption scheme. Let us assume $2^{k-1} < N < 2^{k}$. Repeating Repeating to generate a ciphertext $y$ until the result is in the common domain, say, $[0,2^{k-1})$. See ...


2

Your aim is to have a number $y' = y + rn$ that gives an uniform distribution over any valid key modulus $n'$, so that no keys can be ruled out. For that, you need $y'$ to be uniformly distributed modulo a larger number. How large is the question. If you have uniform samples from $[0, 2^l-1]$, according to this (pdf, page 20 talking about key generation, ...


2

YES. What mix-networks provide is anonymous routing. Using a chain of proxies, incoming messages are shuffled and then they are sent in random order. So, the sender remains anonymous. Similarly the Bitmessage protocol mixes all encrypted messages of a given user with all other encrypted messages of the network. As a result, the sender remains invisible. Here,...


2

Any signature scheme can work as an accumulator: when elements are signed with the manager's secret key, signature works as a system membership witness (positive acc). It is also additive because you can only add elements in the system by signing them, you cannot cancel a signature in the future (to delete them).


2

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national. A person may well have multiple identities. ...


2

Your algorithm should be secure since it's basicly the same as the "one-time-address"-algorithm in the CryptoNote protocol, which is described as following: Alice generates two secret keys $a$ and $b$ and publishes $A = aG$ and $B=bG$. Bob, who wants to send a coin to Alice generates a random $r$ and publishes $R = rG$ and $P = H(rA)G+B$. Alice (or any ...


2

It is perhaps more complicated. Signer anonymity for anonymous signatures means anyone who has the signature but not the message (or does not know enough about the message) cannot reveal the identity of the signer. Thus it really depends on, in your model, what the receiver or eavesdropper knows. For example, if one sends the signature and the message (in ...


2

Usually the schemes without encryption are more efficient in terms of computational and size complexity. This owes to the fact that encrypting a membership certificate and proving the consistency is typically more expensive than simply randomising some signature and proving a simpler statement. It should be noted, however, that some schemes following the ...


2

What he meant is quite unclear. It could be that he's referring to a Timestamping Authority (TA) (See related RFC like 3161). What they do is basically sign a document/hash with the current time and date and sequential transaction id (IIRC). Ideally, the TA is public and anonymous, allowing anyone to submit any hash and get a signed timestamp for it, the ...


Only top voted, non community-wiki answers of a minimum length are eligible