Protocol analysis is the detailed analysis of the security of an abstract or concrete cryptographic protocol.

learn more… | top users | synonyms

3
votes
1answer
147 views

In HMQV, can one use multiple identities with one public key?

The HMQV protocol has 2 "identity" fields $\hat{A}, \hat{B}$ that are used in the dual signature - and it tries to guarantee that any properly-generated session key is only shared by a single $(A, B, \...
4
votes
2answers
426 views

Key recovery when AES ECB is used for short but repeated messages

My question is based on the specification of the protocol LoRaWAN and especially on the part 6.2.5 Join-accept message. It is said that the join-accept message is encrypted using AES ECB. This is (...
4
votes
0answers
43 views

Security proof in (Ciphertext-Policy) Attribute-Based Encryption

I am having hard time understanding the security proof in Attribute-Based Encryption, especially in Ciphertext-Policy Attribute-Based Encryption. To do reduction in CP-ABE scheme, how do I check that ...
1
vote
0answers
28 views

Freely available softwares for simulating/implementing MPC protocols [closed]

I have been designing multiparty computation (MPC) protocols for functions that interest me. Although theoretically I am able to deduce the asymptotic complexity of the protocol, I wish to know as to ...
1
vote
1answer
53 views

Encoding an element in $r=r'||h(r')$ way

We consider a finite field $\mathbb{F}_p$, where $p$ is a large prime e.g. 256-bit. We have $b$ a fixed element of the field. We encode it as $b'=b||h(b)$, where $h(.)$ is a cryptographic hash ...
34
votes
2answers
3k views

Signal vs Telegram in terms of protocols?

Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective ...
3
votes
2answers
107 views

Importance of round complexity in determining the efficiency of an MPC protocol

Literature has different ways of specifying complexity of an MPC protocol: computation complexity that measures the number of (assumed primitive) operations performed by all the parties; ...
4
votes
0answers
83 views

Security of Fernet Construction (wrt non self delimiting tokens and HMAC short key size)

Fernet is a described as a "high level symmetric encryption recipe" (source) that seems to be the default high level encryption scheme in the cryptography python ...
1
vote
0answers
39 views

Key Distribution Center Key Protocol Analysis

As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture From my understanding, Notation B in ...
1
vote
0answers
33 views

cumulative secrets

Imagine a server with an authentication scheme that utilizes an element of randomness in new sessions (i.e. one that uses the secure remote password protocol). At the end of a successful ...
0
votes
1answer
35 views

How robust is my coded output?

I create codes and ciphers and as a hobby and I was wondering if there was any outfit that would 'test' your output to see how resilient it is. Is there a group anywhere that will accept code, try to ...
1
vote
0answers
18 views

Sigma protocol: witness hiding

I am working on an assignment and I am stuck with the last part of proving witness hiding for the protocol. I have previously proved it is witness indistinguishable, and it has q (primer number ...
1
vote
1answer
74 views

A simple client/server authentication protocol

Some days ago I asked for a help to find and correct the problems of an authentication protocol. I closed the post because I was convinced I can correct it but, unfortunately I'm having some troubles. ...
1
vote
0answers
46 views

Security of a lightweight heartbeat protocol

I am implementing a heartbeat protocol so that a server can send notifications to clients. The notifications are not occurring so often, so I don't want to keep an open TCP+TLS session for each client,...
3
votes
1answer
77 views

How can I formally verify fuzzy commitment scheme based security protocol?

I am currently working on designing a security protocol which involves usage of fuzzy commitment schemes, for. eg Reed-Solomon codes which allows us to tolerate a certain level of error. I was ...
1
vote
1answer
81 views

When we turn Random shuffle to Pseudorandom Shuffle

It's well known that a simple but efficient random shuffle algorithm can permute a vector of $n$ elements in $O(n)$ time. In the algorithm, we need to pick a value $U$ uniformly at random where $0\...
5
votes
1answer
143 views

Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve

During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice ...
0
votes
0answers
29 views

Permuted Hash Table

Suppose we have a hash table, $HT$, consisting of $100$ bins.The hash table uses a hash function $H$ that is public. We all know that given value $a$ we can compute the address in the hash by $H(a)=j$...
3
votes
1answer
43 views

Updating values authenticated by Merkle Tree

Assume we have 4 values: $v_1,v_2,v_3$ and $v_4$. We construct a Merkle tree on top of them such that the values are leaves of the tree. I send the values and the tree to an untrusted server. But I ...
0
votes
1answer
70 views

Secure blinding factor switching at malicious server-side (Switching in One Time pad)

Suppose all the values and operations are defined over a finite field $\mathbb{F}_p$ where $p$ is a large prime number. Assume all values are non-zero. Here $(z)^{-1}$ denotes multiplicative inverse ...
1
vote
0answers
67 views

When we use one time pad TWICE in two different ways

Assumption and Notations: All the values defined over the field $\mathbb{F}_p$, where $p$ is a large prime number. We denote multiplicative inverse of value $v$ by $v^{-1}$. All values are non-zero ...
7
votes
2answers
154 views

Is TLS secure against VM reset attacks?

Is the TLS protocol secure against VM reset attacks? Background: Imagine running cryptographic software inside a virtual machine (VM). A VM reset attack is one where the the state of the software is ...
0
votes
0answers
39 views

When we use permutation and random long sting to hide a message

This question is modified version of this: Can we use merely permutation to hide a message? I have an English name $m=m_1 || m_2 ||..||m_{30}$. I pick a random string $d=d_1 ||..||d_{70}$ I mix ...
1
vote
0answers
19 views

Security issues with self encryption? [duplicate]

I'm thinking about the scenario of using a set of (potentially untrusted) hosts to store (potentially private) files. Think something like distributed backup where you contribute some disk space and ...
7
votes
5answers
315 views

Does frequent key change weaken encryption?

Following scenario: We are using OTR for communication between Alice and Bob which means after each successfull message exchange a re-keying happens for both parties leading to new AES-keys for the ...
8
votes
2answers
1k views

Why do we implement a protocol?

In general, after we design a secure cryptographic protocol and make sure that it is efficient (e.g. through complexity analysis) we implement it. Questions: Do we implement it for proof of ...
5
votes
0answers
34 views

OTR AKE protocol implementations security

While looking at the different versions of OTR protocol I discovered a strange thing: there is no trace of the patch for the weaknesses that were noted in “Finite-State Security Analysis of OTR ...
3
votes
1answer
38 views

What is PCT_SSL_CIPHER_TYPE_1ST_HALF?

I'm writing a tool to do security posture assessments of SSL/TLS services, and ran into an interesting result. I ran through all defined cipher suites to test which could be negotiated (like sslscan ...
0
votes
1answer
100 views

Comparing messages given only the ciphertext

Under RSA protocol I was wondering how a message sent could be verified under the following scenario Alice has a private (encryption key) and public key (decryption key) If Bob sends Alice cipher-...
3
votes
2answers
58 views

Problem with this authentication protocol

Consider such authentication protocol: Alice and Bob share a key. Bob sends alice a nonce. Alice encrypts it with shared key and sends to bob. Now assume Alice was successfully authenticated. ...
3
votes
2answers
64 views

Re-sending captured encrypted data

Let’s assume Bob is some algorithmic stock trading machine. Bob takes commands from Alice, who sends messages to Bob. For example: Alice could be sending a message to Bob to stop trading. But if ...
2
votes
1answer
2k views

Does IKEv2 protocol have two modes like IKE

IKE Protocol have 2 modes, that modes have different structure. Does IKEv2 protocol have two modes like IKE.
19
votes
3answers
1k views

Cryptographic Challenge: How to Say Something Confidentially to Snowden?

The Snowden situation raises an intereting cryptograpic problem. At present, how can something be sent confidentially to Snowden? Claim: I have no particular political orientation. The above ...
3
votes
0answers
52 views

authentication protocol questions/security

Disclaimer: I am the only person that uses my software. This is just experimental fun. I previously wrote a server/client that used the secure remote password protocol authentication. I had an idea ...
8
votes
1answer
332 views

Simulation-based proofs and universal composability proofs

I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says The stand-alone ...
3
votes
1answer
78 views

Improving security of (authentication) protocol

I have a basic protocol which tries to authenticate messages going from client to server. Basically it is like this: Imagine I want to send message M to server. Client computes a MAC over the message....
1
vote
0answers
43 views

Is this ECC based messaging method secure?

I developing an encrypted messaging for ZeroNet (aP2P file-based network, website: zeronet.io) and would like to have some guidelines if any of this could work. My first idea: In ZeroNet every user ...
4
votes
1answer
238 views

Consequence of a change on the Guillou-Quisquater Protocol

In the Guillou-Quisquater Protocol, the prover convinces the verifier that he knows an $e$-th root of an element $y \in \mathbb{Z}^*_n$ ($p, q, e$ are primes, $n = pq$ and $e$ is coprime with $\varphi(...
1
vote
0answers
22 views

Proving for a single input vs several inputs. Is there any difference?

I am working on a new protocol for pattern matching. While defining the ideal functionality, it is possible to say: Alice sends $p$ and Bob sends $T$ to the ideal functionality. i.e. searching for ...
1
vote
0answers
114 views

Simplest way for strong cryptography in chat

I am a beginner in cryptography and I am interested for several weeks on this for my chat application. Basically, it is a centralized model. All messages are stored and potentially visible by ...
5
votes
1answer
115 views

Coin flipping with limited communication between participants

Alice and Bob want to play a coin flipping game. Alice wins if the coin flips head. They choose to trust a independent third party that generates a random beacon (such as NIST). There is no ...
1
vote
1answer
172 views

Proving security of TLS handshake with ProVerif

Background For my dissertation I am working on an application protocol for which I require a TLS session. I am looking to achieve Perfect Forward Secrecy, which means I have selected ephemeral Diffie-...
1
vote
1answer
185 views

Key Confirmation Attack [Key Distribution Center (KDC)]

Okay this is how I understood it according to this: Alice $A$ establishes a connection to $KDC$ and prepares for session key Exchange $k_{ses}$ $A$ encrypts the request with her key $k_A(A, B)$ ...
2
votes
2answers
67 views

Privacy and Integrity in Public Cryptography

I'm trying to figure out which is the best way to get privacy and integrity together in public cryptography. Alice needs to send multiple files $f$ (may be big) to Bob. I've thought: Alice computes ...
8
votes
1answer
119 views

Can RSA be securely used for “blind decryption”?

Assume we have the following setup: A client with trusted storage and computing capabilities (e.g. a smartcard) A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
1
vote
0answers
67 views

Understanding a faulty Needam-Schroeder protocol

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses $N$ (nonce) and sends to C (trusted ...
3
votes
1answer
69 views

Is authenticated encryption basically a lockable box?

I recently used a custom construction as a commitment scheme, which was taken from the standard picture you give people while explaining commitment schemes. Basically commitment schemes can be ...
2
votes
1answer
112 views

What's the principle to design the functionality under UC framework?

Though I can get the basic idea of UC Framework, namely let the environment cannot distinguish the real protocol with the real adversary and the functionality with the simulator, I am still puzzled in ...
16
votes
3answers
11k views

Why hash the message before signing it with RSA?

The diagram below illustrates the process of digitally signing a message with RSA: As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the ...