3

After reading your question again, I think that a MIX net with at least two mixes may solve your problem. Onion routing (in particular Tor as an implementation of its second generation) is designed for low latency services, such as web browsing. Another approach for services which tolerate high latency (such as email) is for instance mixminion. Typically, it ...


3

Ok, here's a simple method that appears to address your requirements. It uses two signature methods; the first one (the "inner signature") is conventional; the second one (the "outer signature") is anonymized. When Alice generates a message $m$, she either generates a public/private key pair $Pub_a, Priv_a$ for the inner one, or reuses a $Pub_a, Priv_a$ ...


3

I'll try to give some high-level intuition of the used construction paradigms in my answer below. First, note that we distinguish between one-show and multi-show anonymous credential schemes. For one-show credential schemes, you essentially have that multiple showings of the same credential can be linked to each other, while showings are unlinkable to the ...


3

From Wikipedia, an EdDSA signature is a pair $(R, s)$ of a point $R \in E(k)$ and scalar $s \in \mathbb Z$ satisfying the verification equation $$[2^c s] B = [2^c] R + [2^c H(R, A, M)] A,$$ where $E/k$ is the underlying curve over a field $k$, $B \in E(k)$ is the standard $k$-rational base point of large prime order and cofactor $2^c$, and $A \in E(k)$ is ...


3

As a short answer, yes you can have a transaction that does not allow others to trace who the money was paid. Zcash supports four kinds of transactions that are categorized as follows, Public-address to Public-address (like as the ones in Bitcoin) Public-address to Private-address (they call it shielded transactions) Private-address to Public-address (...


3

You can use Oblivious transfer protocol for the answers: https://en.wikipedia.org/wiki/Oblivious_transfer Here is an example with only 2 answers ($m0$ and $m1$) and uses RSA ($e,d,N$) : In your case Alice would have to send $x_0 \ldots x_9$ and Bob would have to pick $b \in \{0,\ldots,9\}$ where $b$ is the number of his question. The operation $m + k$ can ...


3

The first google-entry brought up this paper. To answer your questions: An anonymous signature is a signature that is unforgeable in the classic sense. But without the message no informations about the signer can be extracted from the signature even if brute-force of all public keys is possible. If I'm understanding things correctly, a blind signature hides ...


3

All Bob needs is to generate an Ephemeral key: just make (say) an RSA key, use it to initiate and proceed with communications with Alice, then delete it when he's done, taking care never to use it to process any personally-identifying information. In fact, this is what web browsers do every time you connect to a website: by default, only the server has a ...


2

As @DrLecter commented, the property you refer is captured by "key privacy." There are more tricky ways to achieve key privacy (against chosen-ciphertext attacks) based on the RSA encryption scheme. Let us assume $2^{k-1} < N < 2^{k}$. Repeating Repeating to generate a ciphertext $y$ until the result is in the common domain, say, $[0,2^{k-1})$. See ...


2

Your aim is to have a number $y' = y + rn$ that gives an uniform distribution over any valid key modulus $n'$, so that no keys can be ruled out. For that, you need $y'$ to be uniformly distributed modulo a larger number. How large is the question. If you have uniform samples from $[0, 2^l-1]$, according to this (pdf, page 20 talking about key generation, ...


2

YES. What mix-networks provide is anonymous routing. Using a chain of proxies, incoming messages are shuffled and then they are sent in random order. So, the sender remains anonymous. Similarly the Bitmessage protocol mixes all encrypted messages of a given user with all other encrypted messages of the network. As a result, the sender remains invisible. Here,...


2

Any signature scheme can work as an accumulator: when elements are signed with the manager's secret key, signature works as a system membership witness (positive acc). It is also additive because you can only add elements in the system by signing them, you cannot cancel a signature in the future (to delete them).


2

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national. A person may well have multiple identities. ...


2

Usually the schemes without encryption are more efficient in terms of computational and size complexity. This owes to the fact that encrypting a membership certificate and proving the consistency is typically more expensive than simply randomising some signature and proving a simpler statement. It should be noted, however, that some schemes following the ...


2

It is perhaps more complicated. Signer anonymity for anonymous signatures means anyone who has the signature but not the message (or does not know enough about the message) cannot reveal the identity of the signer. Thus it really depends on, in your model, what the receiver or eavesdropper knows. For example, if one sends the signature and the message (in ...


2

Your algorithm should be secure since it's basicly the same as the "one-time-address"-algorithm in the CryptoNote protocol, which is described as following: Alice generates two secret keys $a$ and $b$ and publishes $A = aG$ and $B=bG$. Bob, who wants to send a coin to Alice generates a random $r$ and publishes $R = rG$ and $P = H(rA)G+B$. Alice (or any ...


2

What he meant is quite unclear. It could be that he's referring to a Timestamping Authority (TA) (See related RFC like 3161). What they do is basically sign a document/hash with the current time and date and sequential transaction id (IIRC). Ideally, the TA is public and anonymous, allowing anyone to submit any hash and get a signed timestamp for it, the ...


1

I'm not sure this threat model is realistic, since I would expect an adversary to want to shutdown the entire site, instead of just censoring specific "contributors" :-). To protect from this (and from the users becoming de-anonymized) one would likely use an anonymity network such as Tor. The website should not be able to see that data content in ...


1

The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of references to the literature on this subject.


1

This would not help, and would actually make things worse. Bitcoin transactions are public, the input and output addresses are known. This can therefore be traced. Simply tracking the transaction from an initial input (say, buying currency on an exchange that complies with Anti Money Laundering (AML) laws) through each of its single outputs to a destination ...


1

The obvious way is to use two oblivious transfers. In case you need reminding: an Oblivious Transfer is a protocol where one party (Alice) has a number of secrets (in this case, two), and the other party (Bob or Charlie) gets to pick which one he gets to learn, but he doesn't learn the other (and Alice doesn't learn which one he picked). There are several ...


1

authenticated-encryption scheme This one takes the sender's public key $g^a$ and the recipients public key $g^b$ and using the currently available secret key ($a$ or $b$) computes $g^{ab}$ and derives a symmetric encryption key from that. This is called a static-static Diffie-Hellman key exchange. It provides authentication for the sender because only the ...


1

It is possible with a group signature scheme. The idea of group signature was proposed by David Chaum and Eugene van Heyst exactly for the scenario you described. Citing from the abstract: In this paper we present a new type of signature for a group of persons, called a group signature, which has the following properties: only members of the ...


1

There is more than 1 way to do it. You can use Group signatures or Ring signature which allow anyone in a predefined collection to sign a message on behalf of a group. Group signatures require a group manager who creates the group and can de-anonymise the signer. Ring signatures do not have such an entity and the signer cannot be de-anonymised. There are ...


1

You've discovered some of the challenges of secure electronic voting. As you can see, merely having a cipher that allows you to confidentially tally numbers is not sufficient to conduct a secure election. Now if each vote is not signed (or identifiable in some way) how can I exclude that Trudy has not forged a huge amount of fake votes? For that reason I ...


1

The Wikipedia Article on Ring Signatures, though, suggests Linkable Ring Signatures can't be used for that purpose. The Wikipedia article doesn't say or imply that. It lists possible applications: Linkable Ring Signatures: "... One of the possible applications can be an offline e-cash system." Tracable Ring Signatures: "... An e-voting system can be ...


1

If you want to try a scheme that is already being used in the industry, you may try EPID. A paper describing it is on IACR eprint 2009-095.


1

If you're okay with getting statistics that are not perfectly exact but noisy, a variant of randomized response could solve your problem. Instead of sending you real information about their usage, your users will send you noisy data. For a given user, you can't know for sure whether their answer to a particular question is exact or is just random (and you ...


Only top voted, non community-wiki answers of a minimum length are eligible