# Tag Info

Accepted

### How could you disclose what you like and have someone respond with what you want without revealing who you are?

All Bob needs is to generate an Ephemeral key: just make (say) an RSA key, use it to initiate and proceed with communications with Alice, then delete it when he's done, taking care never to use it to ...

### Check if two anonymously signed messages have the same author

Ok, here's a simple method that appears to address your requirements. It uses two signature methods; the first one (the "inner signature") is conventional; the second one (the "outer signature") is ...
• 134k
Accepted

### Understanding the big picture with regard to how anonymous credentials work

I'll try to give some high-level intuition of the used construction paradigms in my answer below. First, note that we distinguish between one-show and multi-show anonymous credential schemes. For one-...
• 1,293
Accepted

### Is it possible to derive an Ed25519-public-key from an Ed25519-signature?

From Wikipedia, an EdDSA signature is a pair $(R, s)$ of a point $R \in E(k)$ and scalar $s \in \mathbb Z$ satisfying the verification equation $$[2^c s] B = [2^c] R + [2^c H(R, A, M)] A,$$ where $E/k$...

### What are the actual anonymity features of ZCash?

As a short answer, yes you can have a transaction that does not allow others to trace who the money was paid. Zcash supports four kinds of transactions that are categorized as follows, Public-...
• 271
Accepted

### Alice answering Bob without knowing the question

You can use Oblivious transfer protocol for the answers: https://en.wikipedia.org/wiki/Oblivious_transfer Here is an example with only 2 answers ($m0$ and $m1$) and uses RSA ($e,d,N$) : In your case ...
• 9,829

### anonymous signature implementation and usage?

The first google-entry brought up this paper. To answer your questions: An anonymous signature is a signature that is unforgeable in the classic sense. But without the message no informations about ...
• 44.7k

### Are Anonymity and Authentication possible together?

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am ...
• 83
Accepted

### How CL-signature can act as positive & additive accumulator?

Any signature scheme can work as an accumulator: when elements are signed with the manager's secret key, signature works as a system membership witness (positive acc). It is also additive because you ...
• 36

### Advantages of group signature schemes without encryption over with encryption

Usually the schemes without encryption are more efficient in terms of computational and size complexity. This owes to the fact that encrypting a membership certificate and proving the consistency is ...
• 1,293

### Does an anonymous signature hide the sender's identity from the receiver?

It is perhaps more complicated. Signer anonymity for anonymous signatures means anyone who has the signature but not the message (or does not know enough about the message) cannot reveal the identity ...
• 4,048
Accepted

Your algorithm should be secure since it's basicly the same as the "one-time-address"-algorithm in the CryptoNote protocol, which is described as following: Alice generates two secret keys $a$ and $b$...
• 1,454
Accepted

### What is an "anonymous admissible timestamp"?

What he meant is quite unclear. It could be that he's referring to a Timestamping Authority (TA) (See related RFC like 3161). What they do is basically sign a document/hash with the current time and ...
• 376
Accepted

### Anonymous Group Signature

Ring signatures are similar to group signatures, but do not have group managers. Another key difference is that a "ring" can be formed at signing time with whoever's keys you like - you don'...
• 1,523
1 vote
Accepted

### l-Diversity logarithm

Entropy and other measures of information can be defined to any base and so should always be quoted with units (bits/shannons for base 2, nats for base e, and bans/harts for base 10). The most common ...
• 11.8k
1 vote
Accepted

### Anonymity of Paillier cryptosystem in e-voting system

You've discovered some of the challenges of secure electronic voting. As you can see, merely having a cipher that allows you to confidentially tally numbers is not sufficient to conduct a secure ...
• 19.3k
1 vote

### IS zk-SNARK not suitable for constructing anonymous authentication scheme?

For now, I have gradually understood why the zk-SNARK cannot be suitable for constructing anonymous authentication scheme. That is the performance issue. According to some references: [1]Succinct Non-...
• 186
1 vote
Accepted

### Algorithm for anonymous but associated communications from a set of verified communicants?

You are describing linkable ring signatures. Here's a paper from ICCSA that goes into the model and proposes some schemes.
• 11.8k
1 vote

### Crypto scheme to map data to users in a way that is anonymous to database server

I'm not sure this threat model is realistic, since I would expect an adversary to want to shutdown the entire site, instead of just censoring specific "contributors" :-). To protect from ...
• 652
1 vote
Accepted

### How to achieve identity authentication without revealing credentials

The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of ...
1 vote

### To what extent would Bitcoin be private without address reuse?

This would not help, and would actually make things worse. Bitcoin transactions are public, the input and output addresses are known. This can therefore be traced. Simply tracking the transaction from ...
• 5,018
1 vote

### Faster Shuffling for a Simple Application

The obvious way is to use two oblivious transfers. In case you need reminding: an Oblivious Transfer is a protocol where one party (Alice) has a number of secrets (in this case, two), and the other ...
• 134k
1 vote

### What is the difference between an anonymous-encryption scheme and an authenticated-encryption scheme?

authenticated-encryption scheme This one takes the sender's public key $g^a$ and the recipients public key $g^b$ and using the currently available secret key ($a$ or $b$) computes $g^{ab}$ and ...
• 44.7k
1 vote

### Is there any way to check signed documents in a group of people without knowing who signed which?

It is possible with a group signature scheme. The idea of group signature was proposed by David Chaum and Eugene van Heyst exactly for the scenario you described. Citing from the abstract: In ...
• 4,048
1 vote
Accepted

### Is there any way to check signed documents in a group of people without knowing who signed which?

There is more than 1 way to do it. You can use Group signatures or Ring signature which allow anyone in a predefined collection to sign a message on behalf of a group. Group signatures require a ...
• 492
1 vote
Accepted

### What is the difference between "Linkable" and "Traceable" Ring Signatures?

The Wikipedia Article on Ring Signatures, though, suggests Linkable Ring Signatures can't be used for that purpose. The Wikipedia article doesn't say or imply that. It lists possible applications: ...
• 12.3k
1 vote

### Choice of bilinear group for implementation of BLS signature with NIWI proof?

If you want to try a scheme that is already being used in the industry, you may try EPID. A paper describing it is on IACR eprint 2009-095.
• 622
1 vote
Accepted

### Why is Tor alone not enough to guarantee anonymity for Bitcoin?

Bitcoin was designed to be decentralized, but was not designed to be anonymous. How you use (earn or spend) Bitcoin cannot (in general) be made anonymous because the protocol was not designed to ...
• 425

Only top scored, non community-wiki answers of a minimum length are eligible