1

I need some serious suggestions on my protocol, specifically for decryption.

So the scenario is Organizations A and B encrypt their employees' records with their respective public keys and store them in a distributed blockchain.

When a User from Organization A sends a record access request to Organization B, Organization B can decrypt the user's record with their own secret Key. The point is I don't want the interaction of organizations to share keys so they can decrypt each other's records because if one organization is malicious, the records of the other organization may be compromised. I tried multi-key homomorphic encryption, which supports encryption with multiple keys. However, the scenario is still the same for decryption, as each owner needs to collaborate to generate partial decryption keys.

Please suggest what the best way to solve this issue

Thank you

Improve this question

1 Answer 1

Reset to default
0

One possible solution can be following.

Don't store encrypted documents at all. When some user requests some document, this document should be encrypted using public key of this user. Then only this user can decrypt the document. If some other user in the same organization is malicious, this user will not be able to decrypt it. If the user who receives the document is malicious, then again, this user will be able to decrypt only the single requested document, not any other documents.

If you need blockchain as a proof that two or more users have the same document, you can sign all documents and store in the blockchain only signatures. When users become a document, they can compare the signature with the one in the blockchain and will be sure that they have same document.

Improve this answer
1
  • So, basically, the encrypted data of each owner will be stored on the blockchain with the purpose of processing risk assessments. For example, suppose organization A sends an access request to organization B. In that case, organization B will query the blockchain to see if the requested user is legitimate or not. Smart contracts will perform some risk assessment based on the user history, such as smart contracts returning the result login attempt three times failed or successful, and so on. so now the main thing is decryption i want Organization B to be able to decrypt that result with his SK.
    – Laila Tul Badar
    Oct 13, 2022 at 11:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .