Cryptography without Numbers

Date: 12/07/2003 at 21:29:40
From: Jay
Subject: Sending a valuable object to a friend privately

You want to send a valuable object to a friend. You have a box which 
is more than large enough to contain the object. You have several 
locks with keys. The box has a locking ring which is more than large 
enough to have a lock attached. But your friend does not have the key 
to any lock that you have. How do you do it? Note that you cannot 
send a key in an unlocked box, since it might be copied.

Date: 12/08/2003 at 03:45:00
From: Doctor Jacques
Subject: Re: Sending a valuable object to a friend privately

Hi Jay,

We have to make some assuptions about locks and keys:

* Given a lock (without its key), it is not possible to make 
  a key for that lock.

* Your friend has a lock (and key) available.

* Given an open lock, you can close it without needing the key.

Now, assume you have a lock A and its key, and your friend owns a 
lock B and its key.

1. Send the box and lock A (open). Do not send key A. The box need
   not be locked.

2. You friend puts lock B (open, and without the key) inside the box,
   locks the box with your lock (A), and sends the box back to you.

3. (I'll let you find the final step...)

Note that there is still a potential problem. Once you receive the 
lock, you need to be sure that it was indeed sent by your friend. 
Someone else might have intercepted the box and sent it back with his 
own key. You would need to confirm this otherwise (for example, by  
calling your friend on the phone--this is better than having your 
friend call you, since someone could impersonate him).

This kind of reasoning is used in today's cryptographic techniques. 
It allows you to send "public keys" to other people, so that those 
people can send you encrypted e-mails that only you can read. The same 
question of authenticity must be addressed--the other people must be 
sure that the key you sent them was genuinely from you.

You can read more about these issues in:

  How PGP (Pretty Good Privacy) Works
    http://www.pgpi.org/doc/pgpintro/ 

Does this help?  Write back if you'd like to talk about this some 
more, or if you have any other questions.

- Doctor Jacques, The Math Forum
  http://mathforum.org/dr.math/