Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...
1
vote
1answer
342 views
Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm?
For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to increase security?
Note: I just want more secure output and CPU cycles does not ...
-1
votes
1answer
191 views
Recommended Books for Cryptography : Theory and Implementation [closed]
It is a great idea if experts in Cryptography from mathematicians to security engineers introduce books and textbooks which they think is helpful or instructive for all people interested in the ...
5
votes
1answer
223 views
Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
2
votes
3answers
222 views
Existing works on pre-computing ElGamal ephermal keys
I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
1
vote
1answer
141 views
Deniability of OTR messaging
I've been looking at the off-the-record messaging protocol, and there is something about its deniability property that seems strange to me.
Consider the following scenario:
In the course of an ...
4
votes
3answers
374 views
Is this a secure implementation of password reset email?
I am redesigning a password reset email mechanism because the existing implementation scares the hell out of me. My goal is to generate reset codes that are:
Expired
Tamper Resistant
Single Use
...
0
votes
3answers
109 views
Is it possible to ensure security with zero pre-shared information?
Is it possible to secure a communications channel against both passive (sniffing) and active (injecting / MitM) attackers without either legitimate party knowing any pre-shared information?
I know ...
0
votes
1answer
93 views
Combatting traffic shape analysis with spurious packets
I was reading a question about combatting traffic analysis, and a thought occured. If I send random junk messages periodically, would that defeat traffic analysis?
The messages would contain some ...
2
votes
2answers
143 views
Untraceable communication protocol
I am doing a research about secure communication protocols.
I would be interested to know whether a protocol exists such that it grants that the two end-points taking part to the communication cannot ...
2
votes
1answer
444 views
Is this design of client side encryption secure?
I want to build a secure file storage web application. Users should be sure that server doesn't know how to decrypt files so encryption should take place at client side (i.e. in Javascript) and TLS ...
1
vote
0answers
94 views
Setting protocol parameters to achieve concrete security
Background
One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
1
vote
1answer
674 views
Use of nonces in Kerberos and Needham–Schroeder protocols
Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport.
In particular :
Can you explain me the use of $N_A$?
And ...
0
votes
2answers
96 views
Distinguishing Encryption Methods from the Output
Suppose that you see all IP communication packets between two computers for a day, as they pass through a connecting router, and this amounts to 10MB. You additionally know that all data transmission ...
13
votes
1answer
401 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
1
vote
2answers
84 views
How can I protect against the failure of a block or symmetric cipher?
Can I protect against the failure of a block or symmetric cipher by chaining different techniques together? If so what implementation details should I be aware of?
Are some combination of ciphers ...
2
votes
1answer
276 views
Replay attack prevention under strict conditions
Say I have a request-response protocol and the task to make it immune to replay attacks. The requirements are as follows:
The defense mechanism cannot rely on the clocks of the parties.
The defense ...
1
vote
1answer
58 views
Cryptographic Algorithm/Protocol needed
I am trying to achieve the following:
Encrypted files are stored on users filesystem. The user uses my client to authenticate against a server. Once he is authenticated successfully he gets a token ...
4
votes
0answers
235 views
Why do new versions of TLS use an explicit IV for CBC suites?
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: They used the last part of the previous record, a value that can be predicted by the attacker. ...
1
vote
1answer
140 views
Is it possible take a piece of data in secret?
I want something like this, but in a digital sense:
You and others walk into a room. Everyone knows who each of you are and everyone is doing their best to figure out what piece of paper each ...
6
votes
1answer
213 views
A fair peer-based coin-flipping protocol?
I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight.
This is how my idea ...
6
votes
1answer
553 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
2
votes
1answer
196 views
Is this authenticated one-way communication protocol secure?
I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
1
vote
1answer
59 views
Distributed knowledge problem
I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
1
vote
1answer
51 views
Proving item association without revealing one of the associated items
I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category.
I have two associated pieces of information:
tag — known by both parties. Unique per ...
3
votes
1answer
205 views
Blind signature with openssl
I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
2
votes
1answer
206 views
Verilog simulation & synthesis of Diffie-Hellman key exchange
Is there any freely available verilog implementaion of Diffie-Hellman key exchange?
I couldn't find anything using google. So, assuming its not there I started implementing on my own.
The code is ...
3
votes
1answer
345 views
Efficient and stateless anti-forgery method
One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
3
votes
2answers
157 views
What challenge should I use in a challenge-response proof-of-work?
In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them.
Client connects
Server ...
1
vote
1answer
102 views
Secure Remote Protocol - Are these 2 equations equivalent?
I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret.
...
2
votes
1answer
60 views
Are there any signature schemes that protect against collusion by multiple parties?
Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
1
vote
8answers
468 views
Does a public key absolutely need to be used to initiate an encrypted session?
I am a software developer working on an application with the .NET platform. This application needs to provide a secure connection and encrypt all data between the client and the server. It is a ...
1
vote
1answer
126 views
synchronization of counters in HOTP
How is synchronization of counter values achieved in the HOTP protocol?
As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
2
votes
2answers
248 views
How do public key rings work in cryptographic applications?
I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
1
vote
2answers
107 views
Combating traffic analysis over request-response protocols
Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions:
Contribute a ...
3
votes
1answer
190 views
Undecrypt using the OpenSSL EVP API?
I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation.
When using AES-256-CBC on the two sides, it's important ...
4
votes
2answers
206 views
Provable Encryption
Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key?
Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
2
votes
2answers
130 views
How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?
I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this...
I want another entity, lets call them the Auditor, to ...
5
votes
1answer
217 views
How do process calculi, CSP, Promela, … compare?
In protocol analysis, formal verification is a very important tool.
What are the major differences between ...
7
votes
8answers
374 views
Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?
I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
5
votes
1answer
183 views
How does one design a traffic analysis resistant protocol?
I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
3
votes
1answer
468 views
RSA-based authentication and key-agreement protocol
An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications.
To that ...
3
votes
1answer
91 views
Is there any serious discussion about using blinding intermediaries in digital currency scenarios?
A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function.
...
2
votes
2answers
191 views
How can I encrypt more than 64 bit with the Data Encryption Standard?
The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key.
If my data is more than 64 bits, (suppose 66 or 67 bits), will ...
4
votes
2answers
138 views
Generating non-repeating N-bit IVs, which are indistinguishable from randomness
I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
8
votes
1answer
426 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
16
votes
4answers
668 views
How to fairly select a random number for a game without trusting a third party?
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)
Can this be done such that each player has the power to be ...
9
votes
2answers
304 views
How should one implement a delegated shared trust protocol?
Consider the following (probably naive) scenario.
Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
5
votes
4answers
175 views
Changing algorithms during encryption
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.
For ...
4
votes
2answers
1k views
What advantage does facebook's new encrypted access_token have?
When a user on facebook grants an app access to their account, an API key is issued to the app. This key is app and user-specific. This process is described in Facebook's developer documentation.
...
1
vote
1answer
122 views
How to collect, process, and transmit data securely?
In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
