I need to prevent Mallory from blindly matching encryption and signing keys to messages
- A user creates a public key
- An encrypted or signed payload exists.
- With only public key, and a signed or encrypted payload, Mallory wants to find out who signed the data. We want to prevent Mallory from associating an encrypted payload to the public key.
I assume that most modern encryption primitives (GCM, AES, RSA, Blowfish) allow for this type of association, however, it's possible that some protocols (GSM?, SMIME? PGP?) might disclose the signing key in the payload, even if the spec allows its omission.
Can someone either tell me which crypto allows for plausible deniability, or conversely which ones do not?*
*I ask in this way to prevent a too broad close reason, because I'm not sure which is greater
- Mallory has the public key, so CPA attacks might be possible, but the data should be random.
- It is acceptable that the original signer, and intended recipient can verify the key.
- If Mallory somehow MITMs the connection, and passes her key to the signer, plausible deniability doesn't have to apply.