Defining Purpose-Limited Secrets
A cryptographic framework makes a secret's intended purpose enforceable via confinement, mediation, or accountability.
The paper argues deployed systems state a secret's purpose in policy but enforce only a broader capability. It defines three regimes: confinement makes out-of-scope operations infeasible, mediation has a trusted component refuse them, and accountability attributes excess use to the holder. A payment-token example uses all three; attenuation unforgeability reduces to signatures and collision-resistant hashing, and no new primitive is claimed.
- Purpose is modeled as an admissible set of operations.
- Confinement, mediation, and accountability are the three regimes.
- Games relate to functional signatures, constrained PRFs, and functional encryption.
- A payment token caps a charge and traces double spending.
- Authors claim no new primitive or composition theorem.
Full article272 words · extracted from arxiv.org · click to collapse
A cryptographic secret is issued for a purpose but grants a capability, and the capability is usually larger: a decryption key meant for computing aggregates can read every record, and a token meant to pay one invoice can drain the account. Deployed systems state the purpose in policy and enforce only the capability. We make the purpose a property of the secret. A mechanism sees operations, not reasons, so a scheme enforces an admissible set $A(P)$ of operations that stands in for a declared intended use $I$; whether $I$ captures the human purpose is a modeling obligation that marks where policy takes over. Against the same $I$ we define three regimes: under confinement an operation outside the intended use is infeasible, under mediation a trusted component refuses it, and under accountability use beyond a stated bound is possible but attributed to the holder. The confinement games, for unpredictability and indistinguishability, coincide with the key-query forms of functional-signature unforgeability and constrained-PRF pseudorandomness and correspond to simulation-secure functional encryption within its feasibility boundary; stated against $I$, they also register a predicate that permits too much. A payment token uses all three regimes on one secret: it pays one capped charge at one merchant, can be narrowed but not widened, is checked by the merchant, and identifies the withdrawing account if spent twice. Attenuation unforgeability reduces to unforgeable signatures and a collision-resistant hash without random oracles; traceability and non-frameability hold under discrete log and unforgeable signatures in the random-oracle model. We claim no new primitive, hardness assumption, or general composition theorem; the framework is a common specification against which such primitives are stated and compared.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.10010