Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

2
votes
1answer
87 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...
1
vote
0answers
50 views

Is container format relevant to security of encrypted message inside?

Still trying to design a fully binary cryptography container format for my mobile app, I am here asking if container is ever relevant. Thanks to Apple, I cannot use GPG directly because I can neither ...
0
votes
3answers
356 views

Would it be possible to create a game where one would need to decrypt a simple encryption?

This might sound pretty weird, but I was thinking of a game a person could play alone with a pen and paper. I got this idea where the person would write a random four letter string on a paper, and ...
3
votes
2answers
70 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
1
vote
1answer
96 views

Zero-knowledge proof of a product

I have non-negative integers $x,y,z$. I'm going to give you commitments $C(x),C(y),C(z)$ to them. Then, I would like to prove in zero knowledge that $xy=z$. I can choose the commitment scheme to ...
2
votes
0answers
88 views

encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
10
votes
4answers
878 views

Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
3
votes
1answer
127 views

Zero-knowledge proof for committing a choice?

Let's say there are 100 choices (which are publicly known), each represented as a different string, and today you have to choose one of them. You need not reveal what that choice is right now, though. ...
1
vote
1answer
97 views

Is there a method to combine encryption and ring signing?

There's the well-known question on whether to sign or encrypt first. However, if instead a message is to be ring-signed such that either recipient could be the actual signer, is there any scheme that ...
1
vote
0answers
52 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
1
vote
1answer
216 views

SHA256-based stream cipher

Can anyone comment if the stream cipher described here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced ...
4
votes
2answers
259 views

Is it possible to create a “proof-of-upload” system for BitTorrent ratio tracking?

One issue that private BitTorrent trackers that track users' share ratios often run into is how to keep track of people who are screwing with their upload statistics, something known as ...
107
votes
6answers
18k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
1
vote
1answer
144 views

Traitor-tracing PRF

I'm looking for a pseudorandom function (PRF) with "traitor-tracing" properties. More specifically, I'd like there to be multiple equivalent keys, so I can give different parties different keys, but ...
2
votes
2answers
143 views

Is there a point using GCM block chiper with Authenticated DH?

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher ...
2
votes
1answer
78 views

Generating shared secret random permutation

There are three blind card game players. Each player does not trust any other, even prejudicing other two players may not be blind, or there may be others in the room, peeking at their cards. In ...
-2
votes
1answer
360 views

Encrypting with private key in Public Key InfraStructure [closed]

In Public key infrastructure, the MD5 of a piece of data is encrypted with the private key of a sender and this encrypted MD5 – along with the data – is again encrypted using an algorithm like AES or ...
4
votes
4answers
330 views

Efficient Symmetric Mutual Entity Authentication Protocol

I am looking for an Authentication protocol for access control. Let's say both the client and server would share a symmetric secret (256 bit key) and the client wants to access the server. Access ...
1
vote
1answer
103 views

Rock-paper-scissors over network, how to protect from cheating server?

I'm trying to design cryptographic protocol to play Rock-Paper-Scissors with two parties, neither trusting each other, nor trusting server they use for communication, so game is 'provably fair'. So ...
2
votes
2answers
83 views

Proving a decision was randomly made [duplicate]

Alice and Bob want to agree on a bit $0$ or $1$. Both know it would be fair to pick that at random, but there's no way they could meet to throw a dice and no third party they could trust. Are there ...
1
vote
1answer
80 views

Modular protocol design

What does modular protocol design mean? Why does TLS not have modular protocol design? What protocols have modular design? (IPSec, SSH)
2
votes
0answers
59 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
4
votes
1answer
107 views

Private set intersection, using a semi-trusted server

Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
5
votes
2answers
564 views

NTRU crypto from unseen.is; myth busting help

I am always on the look out for privacy enhancing technologies. I stumbled upon the service from unseen.is. I had a look at their site (specifically here) and even though I lack knowledge there are a ...
1
vote
1answer
106 views

Which data to share in CTR mode?

Suppose I've got two clients $A$ and $B$. Client $A$ encrypts data in CTR (Counter) mode to get a ciphertext. What information will client $B$ have to receive from $A$ to decrypt the ciphertext? Just ...
2
votes
0answers
112 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
1
vote
2answers
439 views

Tools for modelling and analysis of cryptographic protocols

I am designing some cryptographic protocols and I am new to it. Are there any well-known tools that can be used to model and design these protocols? And also verify or analyze their validity? If not ...
1
vote
1answer
131 views

Designing a secure IM protocol

I haven't been programming much lately, so I figured I would make an encrypted instant-messaging program (read: Skype clone) with groups to hone my skills. That's not important though, I can do that. ...
2
votes
0answers
965 views

Cryptographic Protocol using NaCl

Why? I wanted to add some security and privacy to a chat-type server for playing various games (with a few things that are done on the server to limit cheating). Going by the "Don't implement ...
4
votes
2answers
284 views

Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
5
votes
2answers
416 views

Computationaly hard detokenization algorithm for credit card numbers

I am designing a vault that tokenizes credit card numbers (a plaintext that consists of 16 decimal digits), with the following requirements: Given some plaintext, the vault returns an index. If ...
1
vote
0answers
75 views

Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
0
votes
0answers
117 views

Going Blind, Group or Ring?

I have several problems approaching the following problem: Let's assume that we have Alice, Bob and Cathy. Alice wants to present a message to Cathy, showing her that someone else has signed it (Bob), ...
3
votes
3answers
205 views

Is the following authentication protocol insecure?

I am a student taking cryptography this semester. I was just wondering why can't we use this simple protocol? Alice → Open Connection → Bob Alice ← Cert$_b$ ← Bob Alice → {K$_{AB}$}$_{Bob}$ → Bob ...
2
votes
1answer
69 views

Can you explain the counter in the Key derivation function of PACE?

I try to understand the PACE-Protocol, especially the Key Derivation Function in ECDH on page 33. Can someone explain me, what the Counter is good for? Often there are iteration counters in KDF - but ...
2
votes
3answers
141 views

Combating traffic analysis over request-response protocols

Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions: Contribute a ...
3
votes
2answers
172 views

What was the problem in the SSL version 2.0?

What is the main reason (attacks) the appearance of the protocol SSL version 2.0 to replace version 3.0?
2
votes
1answer
196 views

Is this new server API authentication protocol secure?

I need a secure protocol to authenticate client side users with my server which has an API. I am devising something more secure particularly to resist active MITM attacks where an attacker may modify ...
8
votes
1answer
2k views

Is Truecrypt's multiple/cascading encryption safe?

Is Truecrypt use of cascading encryption safe? Is it useful? Truecrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very ...
2
votes
1answer
98 views

What kind of Quantum cryptography technology(protocols) can be used for Mobile Ad hoc networks(MANETS)?

Typically ad hoc networks do not have a proper infrastructure and the routing is done only through the base stations which are connecting a wired and wireless network. Does quantum cryptography ...
1
vote
1answer
301 views

What's wrong with my security model - or how can it be attacked?

I'm working on a little personal project where security is very important, and I've thought for a while about the best way to do this. Now I am looking for a little outside help on good practices. The ...
4
votes
1answer
210 views

EC ElGamal versus static+ephemeral ECDH

A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. ...
4
votes
1answer
134 views

Private Messaging

Suppose Alice and Bob wants to send messages through Sue without revealing to Eve that the exchange took place. Slightly more formally, I don't want Eve to have any advantage telling if Alice is ...
3
votes
1answer
316 views

Should new applications still use RSA? Is it worth going down the ECDH route for protocols?

I am currently designing an application for communication between two and more users. At the moment I am trying to figure out what methods to use for the asymmetric cryptology. With the recent ...
2
votes
1answer
122 views

Bit commitment with 1-out-of-2 oblivious transfer

I know a protocol for bit commitment using regular OT (Bob has 1/2 chance of learning the bit Alice transferred to him) which goes like this: COMMITMENT PHASE Alice chooses a bit $b$ For ...
0
votes
0answers
34 views

Correlated or biased coin protocols?

There are a number of papers in the literature describing secure/fair coin flipping protocols. Unfortunately in my case, I am looking for coins that are epsilon-biased or epsilon-correlated. I am ...
2
votes
1answer
121 views

What does this step in this protocol for the Yao's Millionaire Problem mean?

I was reading “An Efficient Protocol for Yao’s Millionaires’ Problem” (Ioannidis and Grama 2003). In the proposed protocol in section three, it is written: (Step 4) For every $i$, $1 \le i \le d$, ...
1
vote
0answers
178 views

What would make it impossible to deny that decryption of a package has taken place?

I'm part of a team designing a system where a user have to be able to read a certain package, if he has preformed an action or series of actions that makes it legal for him to do so. The tricky part ...
4
votes
2answers
209 views

Is the following symmetric design secure?

Assume: $O$ be a reversible random permutation oracle on a finite set and $O^{-1}$ the inverse permutation (pretty much equivalent to a random permutation: What is the difference between a bijective ...
1
vote
1answer
133 views

Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which ...