Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

5
votes
1answer
143 views

Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve

During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice ...
3
votes
1answer
43 views

Updating values authenticated by Merkle Tree

Assume we have 4 values: $v_1,v_2,v_3$ and $v_4$. We construct a Merkle tree on top of them such that the values are leaves of the tree. I send the values and the tree to an untrusted server. But I ...
3
votes
1answer
270 views

Key exchange and man in the middle issue. Secure solution

I am trying to design MiTM protected key exchange algorithm. For instance I am using RSA asymmetric keys. Alice and Bob respectively have each their own pair of keys. And they should be able to ...
1
vote
0answers
67 views

When we use one time pad TWICE in two different ways

Assumption and Notations: All the values defined over the field $\mathbb{F}_p$, where $p$ is a large prime number. We denote multiplicative inverse of value $v$ by $v^{-1}$. All values are non-zero ...
1
vote
0answers
23 views

Shamir SS: To associate shares to the public values $x_i$, when the shares are permuted [duplicate]

Suppose we use $(t,n)$ Shamir secret sharing as follows: We share the secret $\beta$ as $S=[s_1,..., s_n]$, where $X=[x_1,...,x_n]$ are the public values. For the sake of simplicity, lets assume ...
3
votes
1answer
736 views

Is this DIY remote lock protocol secure?

I need your advice on following scheme of exchange protocol between remote lock and key. I'm planning to use following algorithm: Key generates unique value that never repeats (in reality it's just ...
3
votes
1answer
56 views

Is it okay to send an encrypted key using XSalsa20-Poly1305, and send subsequent messages using ChaCha20-Poly1305?

I am looking at a cryptographic protocol in a somewhat unusual environment: the communicating parties can share arbitrarily long secret keys over a secure channel. If forward secrecy is not required, ...
1
vote
0answers
19 views

Security issues with self encryption? [duplicate]

I'm thinking about the scenario of using a set of (potentially untrusted) hosts to store (potentially private) files. Think something like distributed backup where you contribute some disk space and ...
6
votes
2answers
651 views

When would you increment a nonce and when not?

K is the shared key for encryption known by _Alice and _Bob. $N_A$ is a nonce created by Alice. The function f is the increment by 1 function. (1) Alice -> Bob: $E_K(N_A)$ So Alice encrypts a nonce ...
8
votes
2answers
1k views

Why do we implement a protocol?

In general, after we design a secure cryptographic protocol and make sure that it is efficient (e.g. through complexity analysis) we implement it. Questions: Do we implement it for proof of ...
1
vote
2answers
164 views

Recommendation for lightweight algorithm for partial message encryption

I have designed a specific client and server program, which sends a file from client to server in 32k chunks. I want to encrypt only part of the data. More specifically: in each 32k chunk passing ...
5
votes
0answers
34 views

OTR AKE protocol implementations security

While looking at the different versions of OTR protocol I discovered a strange thing: there is no trace of the patch for the weaknesses that were noted in “Finite-State Security Analysis of OTR ...
5
votes
2answers
64 views

Protocol to identify zone of potential agreement without revealing reservation prices and having to trust third parties?

A wants to buy a company from B. Before A and B enter negotiations, they want to make sure that there actually is a zone of potential agreement. Obviously, they don't want to communicate their ...
5
votes
1answer
254 views

Zero knowledge proof of shared secret

Alice holds a secret $a \in X$. Bob holds a secret $b \in X$. Is there a protocol that lets them compute $f(a, b) = \begin{cases} 1 & \textrm{if } a = b \\ 0 & \textrm{else} \end{cases}$ If $...
2
votes
1answer
366 views

Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
3
votes
1answer
105 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...
4
votes
1answer
69 views

Is it wise to use HOTP (raw bytes) as a key for HMAC?

Assume I have client and server applications with a shared master secret KEY_SECRET already in place. Also assume that the client and server have an implicit shared ...
3
votes
1answer
199 views

end-to-end encrypted chat app with symmetric + public key encryption, TLS and cert pinning

A big drawback of end-to-end encrypted messaging services is that, as soon as you lose your device, you lose all your messages. Your private key is gone after all. I was wondering though, wouldn't it ...
7
votes
4answers
766 views

Exchanging encrypted messages, and decrypting without a public key?

I know very little about encryption, but I was hoping someone could shed light on this cipher text exchange scheme I worked out in my head this morning: Bob wants to send Alice a message but doesn't ...
5
votes
1answer
64 views

Information theoretical security of an inefficient Shamir based access structure

I have studied Sharmir's scheme as well as the multiple assignment scheme proposed by M. Ito. My question is if anyone can tell me if the following scheme is theoretically secure: Terms: P = set of ...
27
votes
2answers
2k views

Prevent double-spending with decentralized digital currencies without all transactions being public?

A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
3
votes
2answers
58 views

Problem with this authentication protocol

Consider such authentication protocol: Alice and Bob share a key. Bob sends alice a nonce. Alice encrypts it with shared key and sends to bob. Now assume Alice was successfully authenticated. ...
1
vote
1answer
87 views

What libraries do people use to implement and evaluate cryptography protocols?

I want to implement this credential system: “Anonymous Credentials Light” (PDF). The implementation would involve some zero-knowledge proof and some exponentiation. For some basic group computations ...
3
votes
2answers
64 views

Re-sending captured encrypted data

Let’s assume Bob is some algorithmic stock trading machine. Bob takes commands from Alice, who sends messages to Bob. For example: Alice could be sending a message to Bob to stop trading. But if ...
5
votes
1answer
307 views

Zero-Knowledge Proof of a polynomial

I have two secret values $L_1$, $L_2$, and two Pedersen commitments $C_1 = C(L_1)$, $C_2=C(L_2)$. The commitments $C_1$, $C_2$ are public. Given a challenge $c$, I want to output $d = c*L_1+L_2$ and ...
4
votes
1answer
79 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
5
votes
0answers
123 views

Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
6
votes
1answer
116 views

Non-deniability of data sent over TLS

Andy is going to connect to a server Selma over TLS. Later, Andy would like to be able to publish everything (the ciphertexts, the plaintexts, all his keys) and prove to a mediator what data he sent ...
3
votes
2answers
140 views

Security analysis of this one time password based scheme for copy protection

Imagine such protocol. Client and server initially share secret K[0]. When client wants to contact server she sends server K[0] and her ID. Server accepts request, and generated new random K[1] and ...
5
votes
2answers
124 views

Data Leakage and Data Switching

I have two secret values $a$ and $b$ (i.e. they are arbitrary values). I mask them as follow: $v_1=r_1a+r_2$ $v_2=r_1(b-a)$ where $r_1$ and $r_2$ are uniformly random values. I send $v_1$ and $v_2$ ...
21
votes
2answers
1k views

Selective format-compliant JPEG encryption?

I am working towards building a format-compliant encryption system for pictures. The aim of it is to be able to obscure specific areas of a picture (i.e. faces, car license numbers...) while keeping ...
19
votes
3answers
1k views

Cryptographic Challenge: How to Say Something Confidentially to Snowden?

The Snowden situation raises an intereting cryptograpic problem. At present, how can something be sent confidentially to Snowden? Claim: I have no particular political orientation. The above ...
3
votes
0answers
52 views

authentication protocol questions/security

Disclaimer: I am the only person that uses my software. This is just experimental fun. I previously wrote a server/client that used the secure remote password protocol authentication. I had an idea ...
1
vote
3answers
90 views

RSA message integrity

I wish to send some small data that RSA alone can encrypt, and I send a shared secret along with it. ...
6
votes
2answers
844 views

What does well-typed mean?

I am currently studying Cryptography and I don't really understand what does 'well-typed' mean when talking about secure cryptographic protocols. I can't find any reasonable explanation on the ...
2
votes
1answer
111 views

Message security and also program copy detection

Imagine I have client and server running on different machines, each as a separate software. I want to ensure: message authenticity, integrity and confidentiality at least of messages coming from ...
2
votes
1answer
61 views

Perfect Forward Secrecy in PGP/asynchronous email

Looking at the RFC for PGP email/asynchronous chat with PFS here https://tools.ietf.org/html/draft-brown-pgp-pfs-03 can anyone tell me why the following scheme is no good? Alice and Bob retrieve each ...
2
votes
0answers
51 views

How to force an adversary to call a certain oracle?

Consider there is a protocol in real world, which uses a random oracle $\mathcal{H}$. In the ideal world, after the calling of $\mathcal{H}$ by some parties, intuitively I want the simulator gets some ...
3
votes
1answer
44 views

May I use Random Oracle for Inversed Look-up?

Consider there is a protocol in real world calling a random oracle $\mathcal{H}$ for a priavte input $k$. Then in the ideal world, after the calling of $r \leftarrow \mathcal{H}(k)$ by a honest party, ...
4
votes
0answers
68 views

How to use a stream cipher to sign a message?

Are there known constructions which allow to sign a message M (let's say it will be sent as clear text) using a stream cipher C and a symmetric secret key K? So, we have M, C, K and we want to send M|...
5
votes
1answer
89 views

Do low-entropy fingerprints actually make any sense?

I'm thinking of ZRTP and OTR in particular here. From my understanding, after a Diffie-Hellman session is initiated, the shared secret is then hashed into a 4-digit number, which the two parties can ...
3
votes
1answer
78 views

Improving security of (authentication) protocol

I have a basic protocol which tries to authenticate messages going from client to server. Basically it is like this: Imagine I want to send message M to server. Client computes a MAC over the message....
1
vote
0answers
40 views

Is this ECC based messaging method secure?

I developing an encrypted messaging for ZeroNet (aP2P file-based network, website: zeronet.io) and would like to have some guidelines if any of this could work. My first idea: In ZeroNet every user ...
4
votes
1answer
235 views

Consequence of a change on the Guillou-Quisquater Protocol

In the Guillou-Quisquater Protocol, the prover convinces the verifier that he knows an $e$-th root of an element $y \in \mathbb{Z}^*_n$ ($p, q, e$ are primes, $n = pq$ and $e$ is coprime with $\varphi(...
2
votes
3answers
615 views

Prevent replay attack without storage

I am designing a set of low-power sensing motes. Each mote will communicate to a central base over RF. I want the mote to be able to authenticate itself with the base, and send its data without being ...
3
votes
1answer
65 views

Forcing participants to be honest in Secure Multiparty Communication

Alice and Bob engage to compute a secure function f(a,b) where a and b must be present in a ...
2
votes
3answers
108 views

Three party coin flipping protocol with only 2 active participants

Is there a coin flipping protocol where: Alice, Bob and Carol don't trust each other, and The coin is flipped only by Alice and Bob, and The result must be trusted by all three participants.
3
votes
2answers
235 views

HMAC key storage for a web app?

If one is going to use an HMAC, I.E: http://php.net/manual/en/function.hash-hmac.php, where exactly are they storing the key? Without some sort of secure storage (i.e not in a local file or code), I ...
1
vote
1answer
90 views

Could eVoting on the bitcoin blockchain be done?

I'm basically a crypto noob (and not an english native), so please be indulgent :) I thought about if you could realize an eVoting system with bitcoin. I see 2 major requirements: each citizen ...
3
votes
3answers
697 views

Is it usual for a signed message to contain the public key of the signer?

In protocols/systems which use ECDSA, is it common for the message to contain the public key of the message signer? If not, how do recipients know that the message has been signed by the correct ...