Pen-and-paper one-way function for externally-anonymous survey

Question

When conducting surveys, an Administrator might send an Enumerator to survey a Respondent. For "sensitive" questions (e.g. about embarrassing behavior), the Respondent may be fine with the truth being revealed to the Administrator but not to the Enumerator.

Is there a way to create a one-way function/process using simple (small and cheap) physical objects such as pen and paper that isn't too time-consuming or involves complex math? Inverting the function would be too hard for the Enumerator during, or just after the survey, but the Administrator could do it later. Assume that the Enumerator can do anything quickly to uncover the answer (e.g. "accidentally" open a sealed envelope or claim non-random data is random) so long as the Administrator gets the truthful answer in the end. Assume that this is the only interaction with the survey, so no secret information has been passed among the Administrator and the Respondent. FYI: Previous questions include ones about non-computer/manual full cryptosystems and ciphers, but answers to both involve a long time to execute.

Answer 1

There are techniques for doing online surveys on sensitive subjects. They don't follow the approach you outlined, but here's a sketch of how they work.

Suppose we want to survey people to determine how many people have ever seriously considered suicide (say), but we suspect many people might be unwilling to answer honestly because of the stigma associated with answering yes. Here's what we do. We give the respondent an ordinary 6-sided die. We ask the respondent to secretly roll the die (where the enumerator can't see it). If the die comes up 1-4, we ask them to answer honestly; if it comes up 5 or 6, we ask them to reverse their answer (tell us the opposite of their true answer).

This provides plausible deniability for respondents. If they answer "yes", it might be that they have seriously considered suicide; or it might just be that they got a 5 or 6.

It also gives us a way to estimate the fraction of people who have seriously considered suicide. Suppose a fraction $q$ of respondents answer yes. Then we can estimate that about $p=3q-1$ of the population of respondents have seriously considered suicide. We can't identify any specific individual who did or didn't seriously consider suicide, because we only have a noisy view of the truth for any one individual, but we can still compute aggregate statistics.

(Do you see why the formula $p=3q-1$ works? Suppose a fraction $p$ of the population has seriously considered suicide. What fraction of people will answer yes, given this procedure? Well, of the $p$ fraction who have seriously considered suicide, $4/6$ of them will answer yes; of the $1-p$ fraction who have not seriously considered suicide, $2/6$ of them will answer yes; so in total, $4p/6 + 2(1-p)/6$ of the population will answer yes. A bit of simplification shows that this is equal to $(p+1)/3$. Of course, we cannot observe $p$ directly, but we can observe this fraction; this fraction is exactly $q$. So, setting $q=(p+1)/3$ and solving for $p$, we find that $p=3q-1$.)

Answer 2

Merkle Puzzles!

The Administrator constructs 676 unique captchas overlayed with random letters, like this:

The bottom pictures are actually cubs, not kittens. In real life, the Administrator would use a more challenging captcha. And he'd use one picture per key letter.

The Enumerator hands the Respondent a bag of the captchas. While the Enumerator is not looking, the Respondent grabs a random captcha and solves it by writing down all the letters overlaying the correct blocks, and ignoring the letters on the incorrect blocks.

This string is the Respondent's key.

The Respondent then calculates a two-character checksum of the key using a tabula recta. The Administrator has to have ensured that each key has a unique checksum.

Again using the tabula recta, the Respondent encrypts their sensitive answer to the survey with their key, and labels their ciphertext with the checksum of the key.

They then toss their captcha back into the bag, and hand it along with their encrypted response to the Enumerator.

The Enumerator delivers the encrypted messages (which are labeled with key checksums) to the Administrator. The Administrator has a secret checksum-key lookup table, which enables him to quickly look up the correct key for any ciphertext labeled with a given checksum.

The only way for the Enumerator to decrypt all the respondents' sensitive replies in a relatively short amount of time would be to get a team of people working on the captchas. Which he won't be able to do, unless he's well-connected or has a lot of money to spend.

Answer 3

You could probably post the Administrator's public key and some random nonce on the questionnaire. The cipher should be easy enough to compute with a calculator. Does running specialized decryption software count as quick action on the Enumerator's part? If no then the cipher could be really simple.

Another way to go about it is to conceal the identity of the participants from the Enumerator (eg. assign a unique ID to each questionnaire).