# Provably encrypting to Mishti, and setting custom decryption conditions.

For provable encryption, the user can interact with Mishti Network via the DecryptBabyJubJub method. This works via ElGamal decryption. ElGamal decryption only requires a scalar multiplication from the network, so it is compatible with the Mishti Network architecture.

## How ElGamal encryption works

When Alice wants to encrypt message *M* represented as a point to Bob's public key *B,* she generates an ephemeral (private, public) keypair:

where *G* is the curve's generator.

The encrypted ciphertext is

To decrypt, Bob can perform Diffie Hellman to find the shared secret *aB*

since Bob knows his own secret *b* and now knows *A* from the ciphertext

and decrypt the message from the ciphertext:

## Decentralizing Bob with Mishti Network

Notice the only operation Bob had to do with his secret key was a *scalar multiplication* by Alice's ephemeral public key. Because it's scalar multiplication, it can be done in a decentralized way with Mishti network.

The final step of recovering *M* by subtracting *bA* does not have to be done by Mishti network. In fact, there is more privacy if Mishti network never sees *M*.

As a result, ciphertext itself is never touched by Mishti network. It can be stored on a blockchain or, for GDPR protection and security, by an Observer node. Mishti network simply computes *bA *and never decrypts the message -- the ciphertext is needed to decrypt the actual message. This makes Mishti simpler and more secure: even if the secret key of Mishti Network were to be compromised, nobody can learn the message without also learning the ciphertext.

Now, the only question is:

How does Mishti Network know when it should assist in decryption? It would not protect user privacy if it were to help decryptalldata anyone ever asks it to help decrypt.

## Limiting Decryption

Mishti network limits decryption rights by adding programmable privacy: When Alice encrypts a message, she also uses her ephemeral private key *a* to sign the address of an Ethereum contract. This contract should have the following ABI:

`decryptionCredits`

says how many times a particular `decryptor`

is allowed to decrypt. You may expect this contract `bool`

makes more sense, but returning a `uint`

enables simple implementation of other potentially common cases. E.g. limiting an allowlisted decryptor to a certain number of decryptions per day.

Mishti Network will perform scalar multiplication (returning *bA*) if *A *has signed a smart contract where the decryptor is has made fewer requests than the minimum of

Decryption credits returned by the smart contract

Mishti credits purchased

*So how do we actually use this? See *

## Decryption Sequence Diagram

Last updated