4 votes

Providing tokens for anonymous survey

Blind signatures One easy way to let users swap tokens is to let them request the authority re-issue tokens blindly. This is how e-cash works but here instead of issued notes being redeemable for ...
Richard Thiessen's user avatar
3 votes

Providing tokens for anonymous survey

Since this is a survey, I assume that the submissions do not need to be publicly verifiable. A simple approach you can use is Verifiable Oblivious Pseudorandom Functions (VOPRF). This is the technique ...
knaccc's user avatar
  • 4,732
3 votes
Accepted

How could you disclose what you like and have someone respond with what you want without revealing who you are?

All Bob needs is to generate an Ephemeral key: just make (say) an RSA key, use it to initiate and proceed with communications with Alice, then delete it when he's done, taking care never to use it to ...
JamesTheAwesomeDude's user avatar
3 votes

Check if two anonymously signed messages have the same author

Ok, here's a simple method that appears to address your requirements. It uses two signature methods; the first one (the "inner signature") is conventional; the second one (the "outer signature") is ...
poncho's user avatar
  • 147k
3 votes
Accepted

Understanding the big picture with regard to how anonymous credentials work

I'll try to give some high-level intuition of the used construction paradigms in my answer below. First, note that we distinguish between one-show and multi-show anonymous credential schemes. For one-...
dade's user avatar
  • 1,323
3 votes
Accepted

Is it possible to derive an Ed25519-public-key from an Ed25519-signature?

From Wikipedia, an EdDSA signature is a pair $(R, s)$ of a point $R \in E(k)$ and scalar $s \in \mathbb Z$ satisfying the verification equation $$[2^c s] B = [2^c] R + [2^c H(R, A, M)] A,$$ where $E/k$...
Squeamish Ossifrage's user avatar
3 votes

What are the actual anonymity features of ZCash?

As a short answer, yes you can have a transaction that does not allow others to trace who the money was paid. Zcash supports four kinds of transactions that are categorized as follows, Public-...
K.Baghery's user avatar
  • 291
2 votes
Accepted

How CL-signature can act as positive & additive accumulator?

Any signature scheme can work as an accumulator: when elements are signed with the manager's secret key, signature works as a system membership witness (positive acc). It is also additive because you ...
io_k's user avatar
  • 36
2 votes

Is it possible to anonymously distribute a set of secret keys among individuals

You can use some sort of message flooding protocol to hide the origin. Everyone establishes peer-to-peer communication with everyone else and starts forwarding received messages to everyone else. ...
Rainer P.'s user avatar
  • 121
2 votes

Advantages of group signature schemes without encryption over with encryption

Usually the schemes without encryption are more efficient in terms of computational and size complexity. This owes to the fact that encrypting a membership certificate and proving the consistency is ...
dade's user avatar
  • 1,323
2 votes

Does an anonymous signature hide the sender's identity from the receiver?

It is perhaps more complicated. Signer anonymity for anonymous signatures means anyone who has the signature but not the message (or does not know enough about the message) cannot reveal the identity ...
Changyu Dong's user avatar
  • 4,178
2 votes
Accepted

A method to receive payments at obscured addresses

Your algorithm should be secure since it's basicly the same as the "one-time-address"-algorithm in the CryptoNote protocol, which is described as following: Alice generates two secret keys $a$ and $b$...
VincBreaker's user avatar
  • 1,484
2 votes
Accepted

What is an "anonymous admissible timestamp"?

What he meant is quite unclear. It could be that he's referring to a Timestamping Authority (TA) (See related RFC like 3161). What they do is basically sign a document/hash with the current time and ...
M'vy's user avatar
  • 376
2 votes
Accepted

Anonymous Group Signature

Ring signatures are similar to group signatures, but do not have group managers. Another key difference is that a "ring" can be formed at signing time with whoever's keys you like - you don'...
meshcollider's user avatar
  • 1,573
2 votes
Accepted

Deterministic EC key derivation with anonymity and proofs

Alice has a master private key scalar $a$, with corresponding public key $A=aG$. $G$ is a well-known base point on the curve. Alice deterministically creates a new identity associated with a ...
knaccc's user avatar
  • 4,732
2 votes
Accepted

Is there a TLS cipher suite with perfect forward secrecy (PFS) but without authentication, i.e. anonymous, ephemeral key exchange?

Yes, this is possible in TLS 1.2 and before. (TLS 1.3 removed anonymous key exchange.) All of the anonymous key exchanges are actually ephemeral as well, so the cipher suites you've already ...
bk2204's user avatar
  • 3,361
1 vote
Accepted

How can I distribute a set of anonymous tokens digitally among a known limited population to do anonymous voting?

Each voter generates their own EC key pair. Each voter registers to vote by submitting their public key along with their real-world identity. The set of all public keys registered to vote is shared ...
knaccc's user avatar
  • 4,732
1 vote
Accepted

What is the best way to pseudonymise IP addresses while retaining the ability to identify those that share a subnet?

After some more searching (thanks for the pointer in the comments) I came across the Crypto-PAn scheme (often spelled without the hyphen as CryptoPAn), which was described/developed for precisely this ...
Inkling's user avatar
  • 161
1 vote
Accepted

l-Diversity logarithm

Entropy and other measures of information can be defined to any base and so should always be quoted with units (bits/shannons for base 2, nats for base e, and bans/harts for base 10). The most common ...
Daniel S's user avatar
  • 23.8k
1 vote
Accepted

Anonymity of Paillier cryptosystem in e-voting system

You've discovered some of the challenges of secure electronic voting. As you can see, merely having a cipher that allows you to confidentially tally numbers is not sufficient to conduct a secure ...
Ella Rose's user avatar
  • 19.6k
1 vote

IS zk-SNARK not suitable for constructing anonymous authentication scheme?

For now, I have gradually understood why the zk-SNARK cannot be suitable for constructing anonymous authentication scheme. That is the performance issue. According to some references: [1]Succinct Non-...
X.H. Yue's user avatar
  • 368
1 vote
Accepted

Algorithm for anonymous but associated communications from a set of verified communicants?

You are describing linkable ring signatures. Here's a paper from ICCSA that goes into the model and proposes some schemes.
Daniel S's user avatar
  • 23.8k
1 vote

Crypto scheme to map data to users in a way that is anonymous to database server

I'm not sure this threat model is realistic, since I would expect an adversary to want to shutdown the entire site, instead of just censoring specific "contributors" :-). To protect from ...
ambiso's user avatar
  • 706
1 vote
Accepted

How to achieve identity authentication without revealing credentials

The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of ...
Geoffroy Couteau's user avatar
1 vote

To what extent would Bitcoin be private without address reuse?

This would not help, and would actually make things worse. Bitcoin transactions are public, the input and output addresses are known. This can therefore be traced. Simply tracking the transaction from ...
SAI Peregrinus's user avatar
1 vote

Faster Shuffling for a Simple Application

The obvious way is to use two oblivious transfers. In case you need reminding: an Oblivious Transfer is a protocol where one party (Alice) has a number of secrets (in this case, two), and the other ...
poncho's user avatar
  • 147k
1 vote

What is the difference between an anonymous-encryption scheme and an authenticated-encryption scheme?

authenticated-encryption scheme This one takes the sender's public key $g^a$ and the recipients public key $g^b$ and using the currently available secret key ($a$ or $b$) computes $g^{ab}$ and ...
SEJPM's user avatar
  • 46k
1 vote

Is there any way to check signed documents in a group of people without knowing who signed which?

It is possible with a group signature scheme. The idea of group signature was proposed by David Chaum and Eugene van Heyst exactly for the scenario you described. Citing from the abstract: In ...
Changyu Dong's user avatar
  • 4,178
1 vote
Accepted

Is there any way to check signed documents in a group of people without knowing who signed which?

There is more than 1 way to do it. You can use Group signatures or Ring signature which allow anyone in a predefined collection to sign a message on behalf of a group. Group signatures require a ...
lovesh's user avatar
  • 512
1 vote
Accepted

What is the difference between "Linkable" and "Traceable" Ring Signatures?

The Wikipedia Article on Ring Signatures, though, suggests Linkable Ring Signatures can't be used for that purpose. The Wikipedia article doesn't say or imply that. It lists possible applications: ...
tylo's user avatar
  • 12.7k

Only top scored, non community-wiki answers of a minimum length are eligible