OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Crypto Archives: Re: Electronic envelopes

Re: Electronic envelopes

dmolnar (dmolnarhcs.harvard.edu)
Sun, 26 Sep 1999 19:13:05 -0400 (EDT)

On Sun, 26 Sep 1999, Mok-Kong Shen wrote:

> I haven't yet studied the references you gave, but it would be very
> nice of you if you would kindly comment a bit more. The secret document
> which I deposit will never be changed.

This is acheived by sending the commitment to everyone. A commitment could
be something like an encrypted form of the document. Broadcast this to
absolutely everyone, or place on Usenet, or in secure archives, or
whatever.

Now changing the document requires finding every copy of the commitment
and changing it. At the same time, no one learns what the document is from
the commitment.

> guarantee is that no one ever sees it before a precise moment,
> say 00:00:00 of 2020, and then it is disclosed simultaneously at
> several geographical locations. Do you mean that different processes
> running at different sites devoted to solve the puzzle you
> mentioned (I suppose the secret is somehow embedded in the puzzle
> -- or have I misunderstood you?) can be synchronized to that precision?

I mean that you can have two approaches :

* a computational "puzzle", like trying to finish a very long computation.
The end of the computation gives the key to open the commitment and reveal
the message, just as you've said. The puzzle is made hard enough so that
it will take at least so much time to crack.

        The plus to this is that everyone can see the puzzle, so there's
        no need for special notaries. The downside is that the precision
        you want can't be acheived, since everyone has different amounts
        of computing power. :-(

* have a trusted third party or parties (contacted at the setup, when the
  commitment is broadcast to everyone) release the answer to the puzzle at
  exactly 00:00:00 2000 , or whenever.

        Because the parties are not releasing the document itself, they
   do *not* have the power to change what documment everyone sees after
   the time passes. They *do* have the power to change *when* they release
   their information, either on their own or after being told.

   You can make the release time very precise, however, since the parties
   can get access to a clock. The two papers I mentioned discuss this
   scenario at length, trying to make it very hard for an adversary to
   get the document just by hacking one or two of these third parties.

-David

This archive was generated by hypermail 2.0b3 on Sun Sep 26 1999 - 20:47:32 CDT