🚀 go-pugleaf

In article <1992Nov14.153536.9930@infodev.cam.ac.uk> rja14@cl.cam.ac.uk (Ross Anderson) writes:

>Call a public key cryptosystem coercion-resistant if an opponent who 
>monitors the channel between two parties, and some time thereafter 
>obtains the cooperation of one of these parties, cannot recover the 
>session key.
>
>If you have an online system, coercion-free designs are easy. Use 
>Diffie-Hellman to set up a session key, and delete it once you're 
>finished. 


>However it's a bit more difficult to make a store-and-forward system,
>such as electronic mail, coercion-resistant.

You can still do it, at least with regular communication partners.

For each partner, you generate as many rannos as you expect to have
messages in transit, times 2 (one batch for each direction).

You exponentiate each.

Each gets an ID and is sent ahead to the partner.

The partner has done the same.  You save the partner's (ID,a^s) and your
own (ID',s').  When you want to send a message, you choose one of your
and one of your partner's IDs -- use a^s^s' as your session key and
identify the message with (ID,ID').  You delete your memory of a^s, s'
and a^s^s' before releasing the encrypted message.

This has the disadvantage that it works only for regular communicating
partners and, worse, that it requires storing future key pieces where they
might be compromised.

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488