21

Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such as XOR. Purchase a plane ticket for an international flight connecting through Sheremetyevo airport. ...


11

First up, I think your question is less something for crypto.SE and would fit better in the security.SE corner. Nevertheless, here goes: ...except his name or identity... That's in itself already describes your problems when it comes to security and cryptography. Problem due to lack of verification options. Currently, world news outlets (example: ...


5

Sorry for my boring and stolen answer (from https://crypto.stackexchange.com/a/9026/6961) : Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such ...


5

The other answers cover it quite elaborately, but in short: No. But let's consider this to be a game, with the following assumptions: There is a person called "Snowden". Somewhere. In the world. And he has no way to authenticate himself. Snowden initially trusts no one. There is no trustworthy way to authenticate anyone. What is the attackers probability ...


3

Ok, here's a simple method that appears to address your requirements. It uses two signature methods; the first one (the "inner signature") is conventional; the second one (the "outer signature") is anonymized. When Alice generates a message $m$, she either generates a public/private key pair $Pub_a, Priv_a$ for the inner one, or reuses a $Pub_a, Priv_a$ ...


3

I'll try to give some high-level intuition of the used construction paradigms in my answer below. First, note that we distinguish between one-show and multi-show anonymous credential schemes. For one-show credential schemes, you essentially have that multiple showings of the same credential can be linked to each other, while showings are unlinkable to the ...


3

From Wikipedia, an EdDSA signature is a pair $(R, s)$ of a point $R \in E(k)$ and scalar $s \in \mathbb Z$ satisfying the verification equation $$[2^c s] B = [2^c] R + [2^c H(R, A, M)] A,$$ where $E/k$ is the underlying curve over a field $k$, $B \in E(k)$ is the standard $k$-rational base point of large prime order and cofactor $2^c$, and $A \in E(k)$ is ...


3

As a short answer, yes you can have a transaction that does not allow others to trace who the money was paid. Zcash supports four kinds of transactions that are categorized as follows, Public-address to Public-address (like as the ones in Bitcoin) Public-address to Private-address (they call it shielded transactions) Private-address to Public-address (...


3

You can use Oblivious transfer protocol for the answers: https://en.wikipedia.org/wiki/Oblivious_transfer Here is an example with only 2 answers ($m0$ and $m1$) and uses RSA ($e,d,N$) : In your case Alice would have to send $x_0 \ldots x_9$ and Bob would have to pick $b \in \{0,\ldots,9\}$ where $b$ is the number of his question. The operation $m + k$ can ...


3

The first google-entry brought up this paper. To answer your questions: An anonymous signature is a signature that is unforgeable in the classic sense. But without the message no informations about the signer can be extracted from the signature even if brute-force of all public keys is possible. If I'm understanding things correctly, a blind signature hides ...


3

After reading your question again, I think that a MIX net with at least two mixes may solve your problem. Onion routing (in particular Tor as an implementation of its second generation) is designed for low latency services, such as web browsing. Another approach for services which tolerate high latency (such as email) is for instance mixminion. Typically, it ...


3

I'd like to refer you to the other answer in the original question. Suppose your laptop and Snowden's laptop are both capable of quantum communication. Suppose there is also a quantum phone book, or a quantum DNS service. When his passport got revoked, Snowden's address is also removed from the phone book (makes sense right?). Assuming you managed to grab a ...


3

All Bob needs is to generate an Ephemeral key: just make (say) an RSA key, use it to initiate and proceed with communications with Alice, then delete it when he's done, taking care never to use it to process any personally-identifying information. In fact, this is what web browsers do every time you connect to a website: by default, only the server has a ...


2

As @DrLecter commented, the property you refer is captured by "key privacy." There are more tricky ways to achieve key privacy (against chosen-ciphertext attacks) based on the RSA encryption scheme. Let us assume $2^{k-1} < N < 2^{k}$. Repeating Repeating to generate a ciphertext $y$ until the result is in the common domain, say, $[0,2^{k-1})$. See ...


2

Your aim is to have a number $y' = y + rn$ that gives an uniform distribution over any valid key modulus $n'$, so that no keys can be ruled out. For that, you need $y'$ to be uniformly distributed modulo a larger number. How large is the question. If you have uniform samples from $[0, 2^l-1]$, according to this (pdf, page 20 talking about key generation, ...


2

YES. What mix-networks provide is anonymous routing. Using a chain of proxies, incoming messages are shuffled and then they are sent in random order. So, the sender remains anonymous. Similarly the Bitmessage protocol mixes all encrypted messages of a given user with all other encrypted messages of the network. As a result, the sender remains invisible. Here,...


2

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national. A person may well have multiple identities. ...


2

Any signature scheme can work as an accumulator: when elements are signed with the manager's secret key, signature works as a system membership witness (positive acc). It is also additive because you can only add elements in the system by signing them, you cannot cancel a signature in the future (to delete them).


2

Usually the schemes without encryption are more efficient in terms of computational and size complexity. This owes to the fact that encrypting a membership certificate and proving the consistency is typically more expensive than simply randomising some signature and proving a simpler statement. It should be noted, however, that some schemes following the ...


2

It is perhaps more complicated. Signer anonymity for anonymous signatures means anyone who has the signature but not the message (or does not know enough about the message) cannot reveal the identity of the signer. Thus it really depends on, in your model, what the receiver or eavesdropper knows. For example, if one sends the signature and the message (in ...


2

Your algorithm should be secure since it's basicly the same as the "one-time-address"-algorithm in the CryptoNote protocol, which is described as following: Alice generates two secret keys $a$ and $b$ and publishes $A = aG$ and $B=bG$. Bob, who wants to send a coin to Alice generates a random $r$ and publishes $R = rG$ and $P = H(rA)G+B$. Alice (or any ...


2

What he meant is quite unclear. It could be that he's referring to a Timestamping Authority (TA) (See related RFC like 3161). What they do is basically sign a document/hash with the current time and date and sequential transaction id (IIRC). Ideally, the TA is public and anonymous, allowing anyone to submit any hash and get a signed timestamp for it, the ...


1

It is possible with a group signature scheme. The idea of group signature was proposed by David Chaum and Eugene van Heyst exactly for the scenario you described. Citing from the abstract: In this paper we present a new type of signature for a group of persons, called a group signature, which has the following properties: only members of the ...


1

There is more than 1 way to do it. You can use Group signatures or Ring signature which allow anyone in a predefined collection to sign a message on behalf of a group. Group signatures require a group manager who creates the group and can de-anonymise the signer. Ring signatures do not have such an entity and the signer cannot be de-anonymised. There are ...


1

You've discovered some of the challenges of secure electronic voting. As you can see, merely having a cipher that allows you to confidentially tally numbers is not sufficient to conduct a secure election. Now if each vote is not signed (or identifiable in some way) how can I exclude that Trudy has not forged a huge amount of fake votes? For that reason I ...


1

The Wikipedia Article on Ring Signatures, though, suggests Linkable Ring Signatures can't be used for that purpose. The Wikipedia article doesn't say or imply that. It lists possible applications: Linkable Ring Signatures: "... One of the possible applications can be an offline e-cash system." Tracable Ring Signatures: "... An e-voting system can be ...


1

If you want to try a scheme that is already being used in the industry, you may try EPID. A paper describing it is on IACR eprint 2009-095.


1

Bitcoin was designed to be decentralized, but was not designed to be anonymous. How you use (earn or spend) Bitcoin cannot (in general) be made anonymous because the protocol was not designed to support that. In fact, the design of Bitcoin, being decentralized, requires all participants to be able to confirm all transactions. You can use Tor to add to ...


Only top voted, non community-wiki answers of a minimum length are eligible