[danShumway]

So, sort of like a secret generating linked list, where one node (you) are a bad actor?

What prevents the participant right before you from simply circumventing you or secretly passing to the next participant directly?

It also seems that once someone receives the correct answer for their step in the chain, they no longer need anyone beneath them?

(A) -> (B) -> (C) -> (you) -> (D)

Once C has participated in this one time, why do they need A or B?

[XR0CSWV3h3kZWg]

Good point. You'd likely want to also encode something that opaque to who exactly has participated, only really show whether this is the last step and a way for individuals to tell if they have already added their secret.

The really bad part would be that if the poisoner happens to be the last step then the final step would produce the secret before handing it to be poisoned.

[girvo]

I built exactly what you’ve described, using semi-homomorphic encryption (addition of integers, used plainly as we were under the noise threshold of participants). Luckily for me though, I got to punt on some of the really hard questions of trust — the nodes that were communicating are adversarial, but the outside “organising” network was the government and “us” (company I worked for). It’s a really fun problem. I highly recommend taking a crack at it, or even just reading the literature regarding digital voting — you need to prove that one vote was cast for a given person, and no more, without ever tying back any specific vote to said person, and with a huge range of attack vectors!

[carver]

Was this a traceable ring signature[1], or something different?

[1] https://en.wikipedia.org/wiki/Ring_signature#Applications_an...

[XR0CSWV3h3kZWg]

Neat! Thanks for sharing.