3

I know the question is rather unusual, but let me clarify what I'm searching for:

There is one person, lets call her $Alice$. $Alice$ has $n$ plaintexts $t_1..t_n$ and $n$ public keys $pk_1..pk_n$ of other persons.

Now $Alice$ has to encrypt one $t_i$ with a $pk_j$ for arbitrary $i,j$. Each key and plaintext should only be used exactly once. After everything has been encryptied $Alice$ should not have any means to determine which $t_i$ was used to generate one of the outputs. There are $n$ other players to which the keys $pk_1..pk_n$ belong. The other players all can see the encrypted results of $Alice$s encryption operation and nothing else. Obviously every one of them can only decrypt the plaintext encrypted with his or her private key.

Alice should be able to prove to every other player, that she does not know which plaintext got encrypted with which key.

Is that possible at all? I possibly left something out one needs to know to hint me to a proper solution, in that case please leave a comment and i try to provide the Information.

(Sorry for my mediocre english)

WeGi
  • 193
  • 8

3 Answers3

2

What you're describing sounds a lot like mental poker. That is, your Alice has a number of messages ("cards") that she wants to shuffle and deal to the other players, in such a way that she can prove to the other players that she does not know who got which cards.

Various protocols have been proposed for mental poker; see the linked Wikipedia article for some examples. Apparently, there currently exists at least one practical and secure implementation of such a protocol.

Community
  • 1
Ilmari Karonen
  • 46,700
  • 5
  • 112
  • 189
0

No, sorry, this is the bad case in zero knowledge proofs. Can it be done? Yes. Can it be proven to another party? No.

Joshua
  • 461
  • 4
  • 16
0

I suppose you will need another party, Bob. Bob generates a pair of keys, encrypts all messages with the public key and discloses the encrypted messages to everyone, including Alice, sorted alphabetically, so that Alice cannot guess which one is t1,...tn.

Alice shuffles the messages at will and encrypts them with pk1...pkn. Then Bob releases his private key and everyone discovers which message they got.

As long as Bob and Alice don't collaborate, there is no way for Alice to cheat. In case there is no Bob who is trusted by everyone, each participant will have to do the same procedure as Bob, so that messages are encrypted and sorted n times before they get to Alice, and Alice will need everyone's cooperation to find out which message is which.

Dmitry Grigoryev
  • 244
  • 3
  • 11