Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...
2
votes
1answer
152 views
Exact mathematical definition of simulation based security?
I've been trying to understand cryptographic protocols and how to define their security. The problem is that while I can understand what the intuitive definition says, I have trouble understanding how ...
2
votes
1answer
78 views
Data-validating protocol
I have to implement protocol of secure data transfer that can be described as
Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table)
Alice ...
5
votes
2answers
181 views
What is a “rewinding argument”?
I've been reading a bit about cryptographic protocols and I keep seeing the phrase "rewinding argument". I've been unable to find a good source that would explain what is meant by this. It seems like ...
1
vote
1answer
140 views
Is it possible take a piece of data in secret?
I want something like this, but in a digital sense:
You and others walk into a room. Everyone knows who each of you are and everyone is doing their best to figure out what piece of paper each ...
-1
votes
1answer
182 views
Recommended Books for Cryptography : Theory and Implementation [closed]
It is a great idea if experts in Cryptography from mathematicians to security engineers introduce books and textbooks which they think is helpful or instructive for all people interested in the ...
2
votes
3answers
218 views
Existing works on pre-computing ElGamal ephermal keys
I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
5
votes
1answer
216 views
Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
1
vote
1answer
133 views
Deniability of OTR messaging
I've been looking at the off-the-record messaging protocol, and there is something about its deniability property that seems strange to me.
Consider the following scenario:
In the course of an ...
5
votes
1answer
216 views
How do process calculi, CSP, Promela, … compare?
In protocol analysis, formal verification is a very important tool.
What are the major differences between ...
4
votes
3answers
355 views
Is this a secure implementation of password reset email?
I am redesigning a password reset email mechanism because the existing implementation scares the hell out of me. My goal is to generate reset codes that are:
Expired
Tamper Resistant
Single Use
...
0
votes
3answers
109 views
Is it possible to ensure security with zero pre-shared information?
Is it possible to secure a communications channel against both passive (sniffing) and active (injecting / MitM) attackers without either legitimate party knowing any pre-shared information?
I know ...
0
votes
1answer
92 views
Combatting traffic shape analysis with spurious packets
I was reading a question about combatting traffic analysis, and a thought occured. If I send random junk messages periodically, would that defeat traffic analysis?
The messages would contain some ...
2
votes
2answers
132 views
Untraceable communication protocol
I am doing a research about secure communication protocols.
I would be interested to know whether a protocol exists such that it grants that the two end-points taking part to the communication cannot ...
2
votes
1answer
415 views
Is this design of client side encryption secure?
I want to build a secure file storage web application. Users should be sure that server doesn't know how to decrypt files so encryption should take place at client side (i.e. in Javascript) and TLS ...
1
vote
0answers
92 views
Setting protocol parameters to achieve concrete security
Background
One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
13
votes
1answer
389 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
1
vote
1answer
653 views
Use of nonces in Kerberos and Needham–Schroeder protocols
Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport.
In particular :
Can you explain me the use of $N_A$?
And ...
0
votes
2answers
92 views
Distinguishing Encryption Methods from the Output
Suppose that you see all IP communication packets between two computers for a day, as they pass through a connecting router, and this amounts to 10MB. You additionally know that all data transmission ...
2
votes
1answer
202 views
Verilog simulation & synthesis of Diffie-Hellman key exchange
Is there any freely available verilog implementaion of Diffie-Hellman key exchange?
I couldn't find anything using google. So, assuming its not there I started implementing on my own.
The code is ...
1
vote
2answers
84 views
How can I protect against the failure of a block or symmetric cipher?
Can I protect against the failure of a block or symmetric cipher by chaining different techniques together? If so what implementation details should I be aware of?
Are some combination of ciphers ...
2
votes
1answer
255 views
Replay attack prevention under strict conditions
Say I have a request-response protocol and the task to make it immune to replay attacks. The requirements are as follows:
The defense mechanism cannot rely on the clocks of the parties.
The defense ...
1
vote
1answer
58 views
Cryptographic Algorithm/Protocol needed
I am trying to achieve the following:
Encrypted files are stored on users filesystem. The user uses my client to authenticate against a server. Once he is authenticated successfully he gets a token ...
3
votes
0answers
216 views
Why do new versions of TLS use an explicit IV for CBC suites?
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: They used the last part of the previous record, a value that can be predicted by the attacker. ...
1
vote
8answers
460 views
Does a public key absolutely need to be used to initiate an encrypted session?
I am a software developer working on an application with the .NET platform. This application needs to provide a secure connection and encrypt all data between the client and the server. It is a ...
6
votes
1answer
205 views
A fair peer-based coin-flipping protocol?
I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight.
This is how my idea ...
16
votes
4answers
650 views
How to fairly select a random number for a game without trusting a third party?
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)
Can this be done such that each player has the power to be ...
1
vote
1answer
118 views
synchronization of counters in HOTP
How is synchronization of counter values achieved in the HOTP protocol?
As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
6
votes
1answer
545 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
7
votes
3answers
758 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
3
votes
1answer
200 views
Blind signature with openssl
I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
1
vote
1answer
160 views
ID-Secret Scheme
I have an ID-Secret scheme and I'd like to hear if there are any vulnerabilities present.
Party 1 and Party 2 hold some credentials, an ID and a Secret.
Party 1 Creates this message:
...
2
votes
1answer
185 views
Is this authenticated one-way communication protocol secure?
I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
1
vote
1answer
51 views
Proving item association without revealing one of the associated items
I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category.
I have two associated pieces of information:
tag — known by both parties. Unique per ...
1
vote
1answer
58 views
Distributed knowledge problem
I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
3
votes
1answer
331 views
Efficient and stateless anti-forgery method
One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
3
votes
2answers
153 views
What challenge should I use in a challenge-response proof-of-work?
In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them.
Client connects
Server ...
17
votes
1answer
1k views
Could one prevent double spending in decentralized digital currencies (like Bitcoin) without all transactions being public?
A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
1
vote
1answer
102 views
Secure Remote Protocol - Are these 2 equations equivalent?
I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret.
...
2
votes
1answer
59 views
Are there any signature schemes that protect against collusion by multiple parties?
Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
4
votes
2answers
1k views
What advantage does facebook's new encrypted access_token have?
When a user on facebook grants an app access to their account, an API key is issued to the app. This key is app and user-specific. This process is described in Facebook's developer documentation.
...
2
votes
2answers
238 views
How do public key rings work in cryptographic applications?
I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
1
vote
2answers
107 views
Combating traffic analysis over request-response protocols
Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions:
Contribute a ...
3
votes
1answer
183 views
Undecrypt using the OpenSSL EVP API?
I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation.
When using AES-256-CBC on the two sides, it's important ...
4
votes
2answers
202 views
Provable Encryption
Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key?
Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
7
votes
8answers
367 views
Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?
I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
2
votes
2answers
127 views
How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?
I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this...
I want another entity, lets call them the Auditor, to ...
5
votes
1answer
181 views
How does one design a traffic analysis resistant protocol?
I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
3
votes
1answer
446 views
RSA-based authentication and key-agreement protocol
An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications.
To that ...
2
votes
2answers
146 views
Protocol to generate Client Certificates at the start of a SSL session automatically?
A more secure form of 'cookie' could be created for SSL communications through the following method.
The client generates and requests the server to sign a certificate.
Then the client authenticates ...
3
votes
1answer
91 views
Is there any serious discussion about using blinding intermediaries in digital currency scenarios?
A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function.
...
