Pay to Decrypt
sCrypt scryptplatform.medium.com
Alice has an encrypted message, i.e., a ciphertext. Bob has the original message, the plaintext. Alice wants to pay Bob bitcoin in exchange for the plaintext. If Alice pays Bob first, Bob may not…
https://miro.medium.com/v2/5d8de952517e8160e40ef9841c781cdc14a5db313057fa3c3de41c6f5b494b19
Medium
Alice has an encrypted message, i.e., a ciphertext. Bob has the original message, the plaintext. Alice wants to pay Bob bitcoin in exchange for the plaintext. If Alice pays Bob first, Bob may not give her the plaintext. Conversely, if Bob tells Alice the plaintext first, Alice may refuse to pay.

We design a smart contract, called pay to decrypt, that makes the exchange atomic and trustless, ensuring only a correct plaintext can redeem the locked fund¹.

Diffie–Hellman Key Exchange

Diffie–Hellman key exchange (DHKE) is a key agreement protocol that allows two parties to establish a shared secret over an insecure channel.

This diagram below shows DHKE over an elliptic curve. At the beginning, Alice and Bob each has a public–private key pair. After the exchange, they generate a shared key.

ElGamal Encryption

ElGamal encryption is an asymmetric key encryption algorithm based on the Diffie–Hellman key exchange, named after Taher Elgamal². Alice encrypts a message to Bob with his public key, which can only be decrypted by Bob’s private key.

The following diagram shows how it works over an elliptic curve, such as secp256k1 in Bitcoin. As in a standard DHKE, the following shared secret is established.

S = k * A = a * K = k * a * P

a is Alice’s secret key and k can be regarded as Bob’s.

To encrypt a message M, Bob simply adds it to S:

C = S + M

Bob sends the ciphertext, the pair (K, C), to Alice.

To decrypt, Alice can simply subtract to recover M:

M = C - S

Note Alice knows S from K:

S = a * K

Pay to Decrypt

Alice locks fund in the following contract, with given K and C. Bob can only redeem it if he provides the correct plaintext and decryption key. We use the previous elliptic curve library for point arithmetic.

Acknowledgements

This is an implementation of nChain whitepaper 1611.