3 ms·

Yea ok I get your scenario now. > In fact, the only thing he can prove to the world is that, at some point, Alice wrote some message to somebody, but neither t

Yea ok I get your scenario now. > In fact, the only thing he can prove to the world is that, at some point, Alice wrote some message to somebody, but neither that that somebody was him, nor what that message might have contained. If he can decrypt it he can show the message to the world. And he can then use the approach from the article to show the world Alice signed the MAC key, hence she has communicated with him. But yeah, I forgot to consider MACs (I blame bedtime). I agree Bob can't prove which message Alice sent if that key is reused, or reuse can't be reliably rejected by third parties.

lxgr 2y ago
The MAC key is just a random byte string though, not inherently tied to either Bob or the particular message Alice signed with it! In particular, Bob can forge any message and authenticate it using the same MAC key, so no third party will accept an authentication tag as proof that Alice was the author of some message. It's not just a matter of reuse. The only thing Bob could potentially prove to the world about it is that he was somehow the first to obtain this particular Alice-signed MAC (e.g. by immediately publicly timestamping it upon receiving it), which could indeed serve as (weak) evidence that Alice attempted to communicate with him at least once.
- magicalhippo 2y ago
  Her signature can be tied to her (that's the point of the article after all), and Bob can supply the evidence for that by decrypting it. If there are no other ways for Bob to have received that signature, then that's sufficient to establish communication. If Bob could have gotten it from Charlie because Alice did the same dance with him, then indeed Bob can't prove anything. But then Alice can't be sure Charlie isn't forging messages to Bob, and Bob can't trust Alice sent them in the first place. But as I said I agree which message can't be reliably determined based on your scheme.

lxgr 2y ago

The MAC key is just a random byte string though, not inherently tied to either Bob or the particular message Alice signed with it! In particular, Bob can forge any message and authenticate it using the same MAC key, so no third party will accept an authentication tag as proof that Alice was the author of some message. It's not just a matter of reuse. The only thing Bob could potentially prove to the world about it is that he was somehow the first to obtain this particular Alice-signed MAC (e.g. by immediately publicly timestamping it upon receiving it), which could indeed serve as (weak) evidence that Alice attempted to communicate with him at least once.

magicalhippo 2y ago
Her signature can be tied to her (that's the point of the article after all), and Bob can supply the evidence for that by decrypting it. If there are no other ways for Bob to have received that signature, then that's sufficient to establish communication. If Bob could have gotten it from Charlie because Alice did the same dance with him, then indeed Bob can't prove anything. But then Alice can't be sure Charlie isn't forging messages to Bob, and Bob can't trust Alice sent them in the first place. But as I said I agree which message can't be reliably determined based on your scheme.