Provably encrypting to Mishti, and setting custom decryption conditions.

For provable encryption, the user can interact with Mishti Network via the DecryptBabyJubJub method. This works via ElGamal decryption. ElGamal decryption only requires a scalar multiplication from the network, so it is compatible with the Mishti Network architecture.

How ElGamal encryption works

When Alice wants to encrypt message M represented as a point to Bob's public key B, she generates an ephemeral (private, public) keypair:

$$(a, A = a * G)$$

where G is the curve's generator.

The encrypted ciphertext is

$$(A, aB+M)$$

To decrypt, Bob can perform Diffie Hellman to find the shared secret aB

$$aB = bA$$

since Bob knows his own secret b and now knows A from the ciphertext

and decrypt the message from the ciphertext:

$$M = aB + M - bA$$

Decentralizing Bob with Mishti Network

Notice the only operation Bob had to do with his secret key was a scalar multiplication by Alice's ephemeral public key. Because it's scalar multiplication, it can be done in a decentralized way with Mishti network.

The final step of recovering M by subtracting bA does not have to be done by Mishti network. In fact, there is more privacy if Mishti network never sees M.

As a result, ciphertext itself is never touched by Mishti network. It can be stored on a blockchain or, for GDPR protection and security, by an Observer node. Mishti network simply computes bA and never decrypts the message -- the ciphertext is needed to decrypt the actual message. This makes Mishti simpler and more secure: even if the secret key of Mishti Network were to be compromised, nobody can learn the message without also learning the ciphertext.

Now, the only question is:

How does Mishti Network know when it should assist in decryption? It would not protect user privacy if it were to help decrypt all data anyone ever asks it to help decrypt.

Limiting Decryption

Mishti network limits decryption rights by adding programmable privacy: When Alice encrypts a message, she also uses her ephemeral private key a to sign the address of an Ethereum contract. This contract should have the following ABI:

function decryptionCredits(address decryptor) external view returns (uint)

decryptionCredits says how many times a particular decryptor is allowed to decrypt. You may expect this contract bool makes more sense, but returning a uint enables simple implementation of other potentially common cases. E.g. limiting an allowlisted decryptor to a certain number of decryptions per day.

Mishti Network will perform scalar multiplication (returning bA) if A has signed a smart contract where the decryptor is has made fewer requests than the minimum of

• Decryption credits returned by the smart contract

• Mishti credits purchased

So how do we actually use this? See

Decrypting Provably Encrypted Data Over BabyJubJub Curve

For examples, see

Undercollateralized DeFi LendingTornado Cash With Compliance