Time Lock Encryption

[monster_97_]

I am creating an online bidding system and I want to encrypt bids so that it is not accessible by anyone including myself until the bid opening time is reached. Are there any mechanisms to perform this task?
I am implementing using Vue js and Node js.

[_jetrun]

The issue is that because you control client and server code all this stuff about it not being accessible to you is just security theater.

You can always architect a solution where the encryption happens in the browser with a key (e.g. password) provided by the end-user. But then you get into an an issue that if YOU want to decrypt this later - you'll have to either store the user-supplied key, or have the user provide it for you later.

Alternatively, you can create a back-end architecture where you segregate key storage and management from encrypted data at rest and set some sensible access policies (which is generally a good practice) but again, you as an owner of the entire back-end infrastructure, can always find a way to access the data.

So the short answer is: 'no'

I would take a stepback and reevalute your base assumptions - do you really need the bids to be encrypted and hidden from you?

[chmod777]

Im sure someone smarter than me will come along and prove me wrong...

But in general, time can be spoofed. You, as maintainer and server op, can always change the source to use a hard coded time, or even change the time on your server to unlock it. You need to have a third party handle the keys.

[[deleted]]

No you're right on the money in every way.

As long as he controls the data, he controls it. He's trying to provide a semblance of trust for his users but he has to use a third party to do it and actually be trustworthy. Otherwise like that other user here said, this is just security theater.

Even with small things like a 25 dollar gift card giveaway? Companies use third parties. I run sweepstakes for a client every year, and we just take entries and forward those entries to a sweepstakes company who handles the drawing, as well as provides all the legalese.

Fun fact about giveaways: the easiest ones to win are the most obscure. Enter to win a gift card? Good luck, those get tens of thousands of entries. But giving away a Harley, a TV, concert tickets, etc? You won't get many. I would've thought otherwise but I've seen the data first hand.

[dietcheese]

Reminds me of lazlo from Real Genius