# Tag Info

21

Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such as XOR. Purchase a plane ticket for an international flight connecting through Sheremetyevo airport. ...

12

You are probably looking for what is called "anonymous credentials". An anonymous credentials system relates three types of parties: authorities, users, and verifiers. An authority (Alice) can issue a credential to a user (Bob), that certifies that the user satisfies some property (in your case, that would be "is trusted"). Credentials are unforgeable. Then,...

11

First up, I think your question is less something for crypto.SE and would fit better in the security.SE corner. Nevertheless, here goes: ...except his name or identity... That's in itself already describes your problems when it comes to security and cryptography. Problem due to lack of verification options. Currently, world news outlets (example: ...

8

Using exponential Elgamal as the encryption function, Define the list of candidates: e.g., Alice, Bob, Carol Voters submit an encryption of their vote: e.g., to voter for Alice: $v=\langle\mathsf{Enc}(1),\mathsf{Enc}(0),\mathsf{Enc}(0)\rangle$ Use an OR-proof (Fig 2) to show each ciphertext encrypts a 0 or a 1: e.g., $\langle \pi_1, \pi_2, \pi_3 \rangle$ ...

7

Yes. There has been extensive research on this question: there is even a community of cryptographers who work on building voting schemes of this sort (see end-to-end auditable voting system). I'll give you some advice based upon the experience from that field. Don't design your own. Don't try to design your own. There has been extensive research into ...

5

Sorry for my boring and stolen answer (from https://crypto.stackexchange.com/a/9026/6961) : Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such ...

5

The other answers cover it quite elaborately, but in short: No. But let's consider this to be a game, with the following assumptions: There is a person called "Snowden". Somewhere. In the world. And he has no way to authenticate himself. Snowden initially trusts no one. There is no trustworthy way to authenticate anyone. What is the attackers probability ...

4

An RSA ciphertext won't reveal who it is encrypted to, but it might reveal some information about who it isn't. We'll assume that everyone has an RSA key of the same length (e.g. 2048 bits). Now, a public key consists of a large modulus N (and an exponent, that's not important for this discussion); a ciphertext consists of a value C between 0 and N-1. ...

3

After reading your question again, I think that a MIX net with at least two mixes may solve your problem. Onion routing (in particular Tor as an implementation of its second generation) is designed for low latency services, such as web browsing. Another approach for services which tolerate high latency (such as email) is for instance mixminion. Typically, it ...

3

I'd like to refer you to the other answer in the original question. Suppose your laptop and Snowden's laptop are both capable of quantum communication. Suppose there is also a quantum phone book, or a quantum DNS service. When his passport got revoked, Snowden's address is also removed from the phone book (makes sense right?). Assuming you managed to grab a ...

3

The first google-entry brought up this paper. To answer your questions: An anonymous signature is a signature that is unforgeable in the classic sense. But without the message no informations about the signer can be extracted from the signature even if brute-force of all public keys is possible. If I'm understanding things correctly, a blind signature hides ...

3

Encryption based voting will always suffer for a different reason. As a human, I cannot look at a numeric token to know if the value is "Yes" or "No". I have to 100% trust that the voting system is telling me this number is a vote for my candidate or not. It doesn't matter if there's a solidly convincing mathematical proof. As an ordinary voter, I ...

3

You could cheat and use different keys for each recipient. That would work assuming the recipients don't know each other (and cannot compare keys). Mix networks are by design hard to trace so it depends on the network. EDIT: Sending a message to Bob implies Alice knows how to find Bob in the first place, or knows someone who knows where Bob is, without Bob ...

3

You can use blind signatures: "Blind signatures can also be used to provide unlinkability, which prevents the signer from linking the blinded message it signs to a later un-blinded version that it may be called upon to verify. In this case, the signer's response is first "un-blinded" prior to verification in such a way that the signature remains valid for ...

3

You can use Oblivious transfer protocol for the answers: https://en.wikipedia.org/wiki/Oblivious_transfer Here is an example with only 2 answers ($m0$ and $m1$) and uses RSA ($e,d,N$) : In your case Alice would have to send $x_0 \ldots x_9$ and Bob would have to pick $b \in \{0,\ldots,9\}$ where $b$ is the number of his question. The operation $m + k$ can ...

3

Ok, here's a simple method that appears to address your requirements. It uses two signature methods; the first one (the "inner signature") is conventional; the second one (the "outer signature") is anonymized. When Alice generates a message $m$, she either generates a public/private key pair $Pub_a, Priv_a$ for the inner one, or reuses a $Pub_a, Priv_a$ ...

3

As a short answer, yes you can have a transaction that does not allow others to trace who the money was paid. Zcash supports four kinds of transactions that are categorized as follows, Public-address to Public-address (like as the ones in Bitcoin) Public-address to Private-address (they call it shielded transactions) Private-address to Public-address (...

3

From Wikipedia, an EdDSA signature is a pair $(R, s)$ of a point $R \in E(k)$ and scalar $s \in \mathbb Z$ satisfying the verification equation $$[2^c s] B = [2^c] R + [2^c H(R, A, M)] A,$$ where $E/k$ is the underlying curve over a field $k$, $B \in E(k)$ is the standard $k$-rational base point of large prime order and cofactor $2^c$, and $A \in E(k)$ is ...

3

I'll try to give some high-level intuition of the used construction paradigms in my answer below. First, note that we distinguish between one-show and multi-show anonymous credential schemes. For one-show credential schemes, you essentially have that multiple showings of the same credential can be linked to each other, while showings are unlinkable to the ...

2

Something along these lines could be accomplished with zero-knowledge proofs. The voter proves that each one of the ballots is in the set $\{0,1\}$ and that the sum of the ballots is $1$. Prove this to each of the $n$ trusted third parties. Each of the third parties signs the ballots once the proof is done. Then the voter casts the ballots. Signatures can ...

2

If the buyer is selecting proxies to use as trusted third parties, presumably the buyer needs to trust that at least one of them is honest and not colluding with the other three. Therefore, if you need to be sure that they're not colluding, the answer is that the buyer should choose the three proxies to ensure that they're not colluding. Precisely how to ...

2

What you are describing is an anonymous credential system. There are two different ways to go about making these and two actual systems that use those techniques: Microsoft's U-prove and IBM's Idemix. If you're interested in smart card usage, you'd probably prefer U-prove as it tends to work better with smart cards. It's described by its original ...

2

I found a few for shuffles. The papers below will be good pointers for recent results. Stephanie Bayer and Jens Groth: Efficient Zero-Knowledge Argument for Correctness of a Shuffle. EUROCRYPT 2012. Melissa Chase and Markulf Kohlweiss and Anna Lysyanskaya and Sarah Meiklejohn: Verifiable Elections That Scale for Free. PKC 2013. Melissa Chase and Markulf ...

2

If Alice didn't know who Bob was before, she still doesn't. All she knows is that she communicated with someone who has the private key corresponding with that public key, which presumably is the reason Bob has a public key.

2

It may be an interesting avenue to explore. I've read the highlight reel of the digital cash literature but I do not know it well enough to know how well these issues have been addressed. A few things to consider for #2: In a quick read of Lucre, it seems that the payee does no verification before passing the coin onto the mint. It seems, if the mint has ...

2

As @DrLecter commented, the property you refer is captured by "key privacy." There are more tricky ways to achieve key privacy (against chosen-ciphertext attacks) based on the RSA encryption scheme. Let us assume $2^{k-1} < N < 2^{k}$. Repeating Repeating to generate a ciphertext $y$ until the result is in the common domain, say, $[0,2^{k-1})$. See ...

2

Your aim is to have a number $y' = y + rn$ that gives an uniform distribution over any valid key modulus $n'$, so that no keys can be ruled out. For that, you need $y'$ to be uniformly distributed modulo a larger number. How large is the question. If you have uniform samples from $[0, 2^l-1]$, according to this (pdf, page 20 talking about key generation, ...

2

YES. What mix-networks provide is anonymous routing. Using a chain of proxies, incoming messages are shuffled and then they are sent in random order. So, the sender remains anonymous. Similarly the Bitmessage protocol mixes all encrypted messages of a given user with all other encrypted messages of the network. As a result, the sender remains invisible. Here,...

2

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national. A person may well have multiple identities. ...

Only top voted, non community-wiki answers of a minimum length are eligible