Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

1
vote
0answers
55 views

ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know. I am trying to set up a system where a user can receive a temporary license key over the phone, put it into ...
0
votes
1answer
36 views

Detect desynchronization in HOTP authentication [duplicate]

In HOTP authentication, is there a way for a system to detect that the token has been desynchronized? If so how does it know that the OTP was generated from a desynchronized (but valid) token and is ...
5
votes
2answers
189 views

What does well-typed mean?

I am currently studying Cryptography and I don't really understand what does 'well-typed' mean when talking about secure cryptographic protocols. I can't find any reasonable explanation on the ...
4
votes
1answer
61 views

Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve

During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice ...
2
votes
2answers
79 views

Skein or Keccak stream cipher construction

I am wondering if using Skein or the Keccak hash algorithm in this construction (as a stream cipher) is secure: $H$ = Keccak or Skein hash with a 256 bit output $K$ = The main 256 bit random key, ...
2
votes
1answer
55 views

Secure MultiParty Computation with secret inputs for secret outputs

I want to know if it’s possible to use a SMPC (Secure Multi-Party Computation) to have $N$ entities compute the outcome of a known mathematical operation with two or more secret inputs, where each ...
2
votes
1answer
41 views

Symmetric-key login protocol

I'm trying to analyze a login protocol based on symmetric key cryptography. I'm just starting out, so this may very likely be a very bad idea, but nonetheless I'd like to hear your thoughts on it. ...
4
votes
1answer
77 views

OTT service using FPE

Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an ...
4
votes
1answer
117 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
5
votes
2answers
511 views

How does a rolling code work?

I have general questions regarding rolling codes. Basically there is a sender and a receiver. Both have a sequence generator. The receiver checks if the received sequence matches the newly generated. ...
3
votes
0answers
107 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
4
votes
2answers
109 views

Allowing multiple password reset tokens, and a question on random number predictability

I have a few requirements for a password reset system, along with some questions at the end as to its security. Requirements The aim is to provide a password reset mechanism satisfying the following ...
-3
votes
2answers
126 views

pairing-based schemes

some authors claimed that computational performance of a pairing-fee scheme (based on scalar multiplication over an elliptic curve group) is about 1000% more efficient than a pairing based one I would ...
1
vote
0answers
52 views

A question or few about Mental Poker

I have spent some time studying the "Mental Poker" protocol (sometimes called SRA), initially proposed by Shamir, Rivest, and Adleman -- ...
2
votes
1answer
96 views

Does this protocol provide Perfect Forward Secrecy / are there potential security flaws?

We have a HMAC key (128 bit/16 bytes) an AES key (128 bit/16 bytes) an AES IV (128 bit/16 bytes) a random salt (128 bit/16 bytes) Each packet is signed with a HMAC (SHA256) After each packet is ...
2
votes
0answers
150 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
5
votes
2answers
184 views

Obfuscate an “I'll reveal if you do” function

Is there any cryptographic obfuscation scheme that will let me obfuscate a program that reveals my secret, if you reveal yours? Formalization. Let $C(\cdot),V(\cdot)$ be a secure commitment scheme. ...
1
vote
2answers
72 views

Sender and receiver having different moduli conflicts with encryption and signing in RSA

I should implement a security protocol as a part of which I need to: Encrypt the message with receiver public key. Sign it with my private key. Send it to receiver. Suppose that the system uses a ...
5
votes
1answer
96 views

Universal Circuits in Indistinguishability Obfuscation Candidate Construction

I am currently working on an implementation of the candidate construction for an indistinguishability obfuscator that was recently proposed by Garg et al. The relevant paper can be found here. ...
1
vote
1answer
85 views

Are formal methods used for cryptographic protocol design?

I decided to learn more about the application of formal methods to cryptographic protocols and found this interesting talk by Cathy Meadows at YouTube. After doing research about how people are using ...
1
vote
1answer
82 views

Use additional keys to thwart key compromise?

Is it good or bad practice to design crypto protocols for key compromise by using additional keys? Argument for bad practice would be: When you have a key you should trust it and not throw more keys ...
5
votes
1answer
288 views

Is it a requirement to understand mathematics when implementing (or breaking) cryptography?

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology In the context of putting crypto into ...
2
votes
0answers
32 views

Common pitfalls of session key activation?

Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly ...
11
votes
4answers
1k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
3
votes
1answer
92 views

Need to generate new DH keys for every message in OTR

Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it ...
3
votes
3answers
163 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
1
vote
2answers
105 views

What are the major flaws and limitations of this hash-based stream cipher design?

K is a 224-bit key. C is a 32-bit counter; it is publicly known. the same value is never used twice. ...
1
vote
1answer
95 views

How does this SSL-related flaw work?

I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked. First how HTTPS works… to be sure I’m on the same page: Server ...
1
vote
1answer
73 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...
1
vote
0answers
49 views

Is container format relevant to security of encrypted message inside?

Still trying to design a fully binary cryptography container format for my mobile app, I am here asking if container is ever relevant. Thanks to Apple, I cannot use GPG directly because I can neither ...
1
vote
1answer
95 views

Zero-knowledge proof of a product

I have non-negative integers $x,y,z$. I'm going to give you commitments $C(x),C(y),C(z)$ to them. Then, I would like to prove in zero knowledge that $xy=z$. I can choose the commitment scheme to ...
0
votes
1answer
121 views

Burn after read algorythm. Software verification on compromised environment. Software smart card

please help me pick right design of software I have to design client-server software, where server should verify that client runs software from exact source code. And where software doesn't simulate ...
5
votes
3answers
317 views

Leak-proof protocol: is such a thing possible?

Is it possible to design a protocol that by itself guarantees that a malicious implementation cannot leak secret data without breaking the protocol? Setting: Alice and Bob have a pre-shared secret ...
1
vote
0answers
49 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
3
votes
1answer
123 views

Zero-knowledge proof for committing a choice?

Let's say there are 100 choices (which are publicly known), each represented as a different string, and today you have to choose one of them. You need not reveal what that choice is right now, though. ...
1
vote
1answer
207 views

SHA256-based stream cipher

Can anyone comment if the stream cipher described here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced ...
4
votes
2answers
256 views

Is it possible to create a “proof-of-upload” system for BitTorrent ratio tracking?

One issue that private BitTorrent trackers that track users' share ratios often run into is how to keep track of people who are screwing with their upload statistics, something known as ...
2
votes
2answers
138 views

Is there a point using GCM block chiper with Authenticated DH?

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher ...
2
votes
1answer
78 views

Generating shared secret random permutation

There are three blind card game players. Each player does not trust any other, even prejudicing other two players may not be blind, or there may be others in the room, peeking at their cards. In ...
3
votes
3answers
289 views

Third-party security issues with Shamir's secret sharing scheme

In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial. How can we ensure security here when we are involving a third party?
1
vote
1answer
99 views

Rock-paper-scissors over network, how to protect from cheating server?

I'm trying to design cryptographic protocol to play Rock-Paper-Scissors with two parties, neither trusting each other, nor trusting server they use for communication, so game is 'provably fair'. So ...
2
votes
2answers
83 views

Proving a decision was randomly made [duplicate]

Alice and Bob want to agree on a bit $0$ or $1$. Both know it would be fair to pick that at random, but there's no way they could meet to throw a dice and no third party they could trust. Are there ...
5
votes
1answer
147 views

What functions allow for practical indistinguishability obfuscation?

Recently, there has been a major theoretical breakthrough in program obfuscation, in the area of indistinguishability obfuscation. Background: Indistinguishability obfuscation is a form of program ...
2
votes
0answers
59 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
1
vote
1answer
138 views

Traitor-tracing PRF

I'm looking for a pseudorandom function (PRF) with "traitor-tracing" properties. More specifically, I'd like there to be multiple equivalent keys, so I can give different parties different keys, but ...
3
votes
2answers
69 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
4
votes
1answer
105 views

Private set intersection, using a semi-trusted server

Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
2
votes
0answers
87 views

encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
1
vote
0answers
72 views

Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
2
votes
0answers
102 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...