Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

-2
votes
0answers
21 views

The Massey-Omura Cryptosystem (1983) [closed]

disadvantages and advantages of The Massey-Omura Cryptosystem (1983)
0
votes
0answers
41 views

Role of trusted party in the Ideal model in Malicious case

Imagine there is a protocol supporting outosurced multi party computation. There are three parties involved in the protocol: client $A$, client $B$ and a server. Client $A$ and $B$ send their private ...
1
vote
0answers
37 views

Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
1
vote
1answer
42 views

Malicious party security model: When one party is corrupted at a time

Consider we have three parties,namely client $A$, client $B$ and a server. Client $B$ and the server can be malicious, but we do not allow the adversary to simultaneously corrupt the server and ...
0
votes
2answers
19 views

Why does spiped use both nonces and ephemeral keys?

Colin Percival's spiped utility uses a pre-shared key and Diffie-Hellman with ephemeral keys to provide forward secrecy. The protocol is summarized in the ...
-1
votes
0answers
15 views

SSL-connection between client and server: how can one make this connection secure?

Suppose a browser C is setting up a SSL-connection with a server S. Then after C has initiated the connection with S by sending a "hello"-message and nonce, S sends back a nonce and a certificate ...
2
votes
2answers
69 views

Is it safe to use a secret salted hash of a public id for client to prove ownership of id to a server that knows salt but does not store ids?

I am writing a peering server - the server assigns randomly generated public IDs to users, and I want users to be able to reclaim their ids in the future, but only to be able to claim ids that they ...
7
votes
4answers
250 views

Alice and Bob's crush

Suppose Alice and Bob both want to determine whether the other has a crush on him/her, but they only wish to share the information if the crush is mutual. Is there a cryptographic protocol that makes ...
1
vote
1answer
56 views

Image sharing without data overhead

The idea is to share n images among n persons so that all images can be reconstructed by someone in possession of all shares. However, there must not be any data overhead (which means the shares sent ...
0
votes
0answers
33 views

How to Exchange Random Coin Flips between Two Untrusted Parties [duplicate]

I'm not sure if this belongs here, but my friend and I were wondering if there was a good algorithm to exchange random coin flips to make some random decision between two untrusted parties without the ...
0
votes
0answers
36 views

Protocols with deliberate errors

This question is motivated by discussion cocerning “The Two Sheriffs” puzzle, see (1) and (2). Are there any public key protocols where Alice and Bob intentionally insert errors in their messages? ...
0
votes
1answer
45 views

Rationale of “r” AES key use in OTR version 3 AKE protocol?

I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here , and aiming to achieve Perfect Forward Secrecy I am a ...
1
vote
0answers
58 views

Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate ...
3
votes
2answers
107 views

Coding of unsigned int to prevent guessing next ID

Suppose we are assigning records an unsigned integer ID from a N-bit space (say 32-bit) in a sequential manner. Is there a way we can code this ID before showing it to the public such that someone ...
0
votes
1answer
71 views

What practical uses can random hash collisions be put to?

Using magic, I've built a machine that instantly generates hash collisions. To try it out, I set the dial to SHA256 and typed in "e7cf3ef4f17c3999a94f2c6f612e8a888e5b1026878e4e19398b23bd38ec221a". I ...
1
vote
0answers
45 views

Encryption with a known plaintext

I'm building an application where users can be a part of groups, and can obtain and distribute URLs from the group page that allow anyone who clicks on them to join said group. Groups should not ...
1
vote
1answer
111 views

Is creating a own protocol safe or should TLS always be used?

The more I start to learn about cryptography the more I hear it is unsafe to 'create' your own cryptographic protocol. With this I mean combining cryptographic primitives like HMAC, AES and RSA ...
2
votes
1answer
117 views

What is the advantage of using the socialist millionaire protocol to authenticate vs HMACing some random number?

Say Alice and Bob have a shared secret $s$. Alice and Bob establish an encrypted channel and verify that it hasn't been MitM'ed by exchanging $r_1$ and $r_2$, where $r_1$ and $r_2$ are randomly ...
1
vote
0answers
75 views

What are the well known protocols that offer perfect forward secrecy? [closed]

As far as I know these are the well known protocols that offer PFS TLS/SSL (with DHE-RSA, DHE-DSS, ECDHE-RSA or ECDHE-ECDSA) SSH (RFC4253) OTR (Protocol Version 3 Spec) IPsec (with IKEv1 and IKEv2) ...
0
votes
0answers
56 views

How does double-encryption work with a client server model

With mobile applications like Accompli (now the base for the Android Outlook application), credentials are stored. Reading from the Accompli website: Each user’s credentials are double-encrypted ...
0
votes
1answer
63 views

Non-repudiation and digital signature of a dishonest participant

Let's assume a dishonest Alice who sends, encrypts & digital signs a message to Bob. Bob stores the decrypted message and the digital signature in a database. However Alice is a bad girl and ...
1
vote
2answers
167 views

What cryptanalysis is possible against two independent keystreams XORed against plaintext?

If a wise person was unsure about which commercial cryptography standards are truly secure from the fascist powers that be, it would seem the obvious option for companies and individuals is to now use ...
0
votes
2answers
120 views

Where are the ChaCha20 test vectors/examples?

I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work ...
3
votes
2answers
109 views

Encryption for a short packet size

I have an 8051 microcontroller with a radio that can send packets with up to 32 bytes and I want to have the messages encrypted. It is a sensor network so I really only want to send one packet per ...
1
vote
0answers
58 views

Obliviously computing the Least common multiple of two poylnomials

Consider I have two polynomials $f_1$ and $f_2$ of the same degree. I want to secure them (using any kind of encryption except FHE) and outsource them to an untrusted server. I want him to compute the ...
3
votes
1answer
87 views

Secure multiparty computation of conjunction

Suppose Alice and Bob each have bits a and b, respectively. How can Alice and Bob compute the function ...
0
votes
2answers
139 views

Voting system validation

I'm developing an application to run elections. A voting system. I would like to give the ability to the voters to check later if their vote were correct computed/casted. assumptions: each user has ...
1
vote
1answer
81 views

Why is proving “parties' views are simulatable” enough in semi-honest model?

To prove a protocol is secure in semi-honest model, we have to prove: the view of each party, on each possible pair of inputs, can be efficiently simulated based solely on its own input and and ...
0
votes
1answer
65 views

Oblivious transfer variation question

Now I am doing a variation of the oblivious transfer, I have to use 2 people, pebbles, and boxes. I need to find out if who has a larger number between Alice and Bob (variation of Yao's Millionaires' ...
1
vote
3answers
138 views

In cryptographic protocols, what protects against an attacker dropping messages?

In some cryptographic protocols I have seen messages protected for confidentiality, authenticity, replaying attacks, reordering attacks, etc. What protects a protocol from an attacker in a ...
3
votes
3answers
166 views

Verifying DER encoded DSA/ECDSA signature with extra content?

Having a DSA/ECDSA signature which is supposed to be DER encoded as an ASN.1 sequence of $r$ and $s$ (as described in the RFC), and being given some bytes which are ...
1
vote
0answers
57 views

Efficient proof of knowledge using Wegman-Carter hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
1
vote
0answers
33 views

Hybrid fair exchange protocol

A gradual fair exchange (layman term) is a form of fair exchange protocol where Alice will transfer 1 bit to Bob then Bob will transfer 1 bit to Alice. The flaw with this protocol is that the party ...
0
votes
0answers
47 views

Is Paillier cryptosystem commutative?

Is Paillier cryptosystem commutative? If not, how can we construct an oblivious decryption protocol based on Paillier?
1
vote
1answer
58 views

Where is defined the fact of having a “learning” and “challenge” phase in cryptography proofs?

I've read Bellare and Rogaway 2004 and Shoup 2004 about game-based cryptography proofs, but I lack precisions about how should be built the "learning" and "challenge" phases, since my games will ...
2
votes
1answer
109 views

Encrypted read-only message queue

I'm creating a prototype for a messaging queue with some custom logic (can't re-use any existing solution). One requirement is to have all messages encrypted. There are three classes of nodes ...
0
votes
1answer
122 views

Key management protocol for end-to-end security on Advanced Metering Infrastructure

I am currently working on a research on end-to-end security implementation for Advanced Metering Infrastructure (AMI). Pardon me if I a bit off topic or not asking the right question as I am ...
0
votes
1answer
128 views

Is this chat protocol safe?

I am in the design phase of a secure chat application at the moment. I am trying to make this as secure as possible. The Serverprovider should not have access to the messagedata. So my idea was the ...
1
vote
1answer
84 views

Basic question about design of program with data encryption

I need to store encrypted files on a hard disk. The actual code side is not important for me now (I plan to use C# and AES-GCM encryption from Bouncy Castle library, please tell me if you think that's ...
0
votes
1answer
105 views

Is it possible to hand-negotiate an SSL/TLS session?

I'm interested in trying to hand-negotiate an SSL/TLS session. Similar to how one would use telnet to port 80 and type GET / HTTP/1.1. I know there's a lot of steps ...
3
votes
2answers
186 views

Ways to make a “doomsday” cryptocurrency which becomes untradable

As a social experiment (not a money-making scheme), I'm interested in developing a crazy cryptocurrency which, by its very design, will become worthless and untradable after a certain point. Ideally, ...
-1
votes
1answer
77 views

How Could the Music Industry Go About Implementing Crypto? [closed]

So I'm currently doing the Dan Boneh online Crypto course. In the last problem set there was a question on AACS for DVDs and wondered if a similar method could be used for music. Have the music ...
1
vote
1answer
102 views

How often do I need to rotate AES 256 keys

I'm trying to design a protocol for a resource constrained environment. The device has to communicate with a server through an insecure node. My plan is to use AES 256 end to end for all ...
0
votes
0answers
44 views

Is there a practical succinct interactive argument for fortress draws in chess endgames?

(In theory, it is known that collision-resistant hashing suffices for the type of protocol that I'm asking about: page 3.) Is there a known practical candidate protocol for succinctly (and ...
1
vote
2answers
256 views

Are SSL/TLS used for maintaining data confidentiality?

In SSL/TLS, we use symmetric and asymmetric keys to encrypt the data. Does that mean that the keys are used to encrypt the data (preserve the integrity) or provide a secure channel for the data to be ...
3
votes
3answers
170 views

Asymmetric algorithm for one time signing of small cleartext

I want to generate a key pair such that the private key can be used once to sign a small message (1024 bytes) at some indeterminate point in the future and the public key can be used to verify that ...
3
votes
1answer
119 views

Secure Deduplication and Encryption in a data store

Assume: We have a centralized data store that can store whatever we need Every user is online Function $f : File \to Key$ gets access to the store, and is the same for all users. $g : Key \to File$ ...
1
vote
0answers
90 views

ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know. I am trying to set up a system where a user can receive a temporary license key over the phone, put it into ...
5
votes
2answers
385 views

What does well-typed mean?

I am currently studying Cryptography and I don't really understand what does 'well-typed' mean when talking about secure cryptographic protocols. I can't find any reasonable explanation on the ...
4
votes
1answer
86 views

Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve

During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice ...