Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

3
votes
1answer
95 views

Need to generate new DH keys for every message in OTR

Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it ...
3
votes
3answers
204 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
1
vote
2answers
135 views

What are the major flaws and limitations of this hash-based stream cipher design?

K is a 224-bit key. C is a 32-bit counter; it is publicly known. the same value is never used twice. ...
1
vote
1answer
102 views

How does this SSL-related flaw work?

I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked. First how HTTPS works… to be sure I’m on the same page: Server ...
2
votes
1answer
167 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...
1
vote
0answers
55 views

Is container format relevant to security of encrypted message inside?

Still trying to design a fully binary cryptography container format for my mobile app, I am here asking if container is ever relevant. Thanks to Apple, I cannot use GPG directly because I can neither ...
2
votes
2answers
173 views

Zero-knowledge proof of a product

I have non-negative integers $x,y,z$. I'm going to give you commitments $C(x),C(y),C(z)$ to them. Then, I would like to prove in zero knowledge that $xy=z$. I can choose the commitment scheme to ...
5
votes
3answers
330 views

Leak-proof protocol: is such a thing possible?

Is it possible to design a protocol that by itself guarantees that a malicious implementation cannot leak secret data without breaking the protocol? Setting: Alice and Bob have a pre-shared secret ...
2
votes
0answers
64 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
3
votes
1answer
136 views

Zero-knowledge proof for committing a choice?

Let's say there are 100 choices (which are publicly known), each represented as a different string, and today you have to choose one of them. You need not reveal what that choice is right now, though. ...
2
votes
1answer
266 views

SHA256-based stream cipher

Can anyone comment if the stream cipher described here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced ...
4
votes
2answers
290 views

Is it possible to create a “proof-of-upload” system for BitTorrent ratio tracking?

One issue that private BitTorrent trackers that track users' share ratios often run into is how to keep track of people who are screwing with their upload statistics, something known as ...
2
votes
2answers
162 views

Is there a point using GCM block chiper with Authenticated DH?

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher ...
2
votes
1answer
84 views

Generating shared secret random permutation

There are three blind card game players. Each player does not trust any other, even prejudicing other two players may not be blind, or there may be others in the room, peeking at their cards. In ...
3
votes
3answers
308 views

Third-party security issues with Shamir's secret sharing scheme

In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial. How can we ensure security here when we are involving a third party?
1
vote
1answer
190 views

Rock-paper-scissors over network, how to protect from cheating server?

I'm trying to design cryptographic protocol to play Rock-Paper-Scissors with two parties, neither trusting each other, nor trusting server they use for communication, so game is 'provably fair'. So ...
2
votes
2answers
92 views

Proving a decision was randomly made [duplicate]

Alice and Bob want to agree on a bit $0$ or $1$. Both know it would be fair to pick that at random, but there's no way they could meet to throw a dice and no third party they could trust. Are there ...
5
votes
1answer
163 views

What functions allow for practical indistinguishability obfuscation?

Recently, there has been a major theoretical breakthrough in program obfuscation, in the area of indistinguishability obfuscation. Background: Indistinguishability obfuscation is a form of program ...
2
votes
0answers
70 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
1
vote
1answer
177 views

Traitor-tracing PRF

I'm looking for a pseudorandom function (PRF) with "traitor-tracing" properties. More specifically, I'd like there to be multiple equivalent keys, so I can give different parties different keys, but ...
3
votes
2answers
75 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
4
votes
1answer
146 views

Private set intersection, using a semi-trusted server

Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
2
votes
0answers
101 views

encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
1
vote
0answers
101 views

Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
2
votes
0answers
127 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
5
votes
2answers
1k views

NTRU crypto from unseen.is; myth busting help

I am always on the look out for privacy enhancing technologies. I stumbled upon the service from unseen.is. I had a look at their site (specifically here) and even though I lack knowledge there are a ...