Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

4
votes
1answer
209 views

EC ElGamal versus static+ephemeral ECDH

A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. ...
4
votes
1answer
65 views

Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve

During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice ...
4
votes
2answers
284 views

Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
4
votes
3answers
302 views

What crypto system allows for 3 parties: Party 1 who makes an assertion, Party 2 mutates the assertion, Party 3 validates it

I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows ...
4
votes
1answer
727 views

Efficient and stateless anti-forgery method

One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
4
votes
1answer
79 views

OTT service using FPE

Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an ...
4
votes
1answer
123 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
4
votes
1answer
107 views

Private set intersection, using a semi-trusted server

Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
4
votes
1answer
259 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
4
votes
2answers
467 views

Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
4
votes
1answer
543 views

Is this authenticated one-way communication protocol secure?

I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
4
votes
2answers
160 views

Generating non-repeating N-bit IVs, which are indistinguishable from randomness

I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
4
votes
1answer
134 views

Private Messaging

Suppose Alice and Bob wants to send messages through Sue without revealing to Eve that the exchange took place. Slightly more formally, I don't want Eve to have any advantage telling if Alice is ...
4
votes
1answer
241 views

Why does the SRP-6 calculation of B include a multiplier k = 3?

In SRP-6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$? (In SRP-6a, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP-6.)
4
votes
4answers
330 views

Efficient Symmetric Mutual Entity Authentication Protocol

I am looking for an Authentication protocol for access control. Let's say both the client and server would share a symmetric secret (256 bit key) and the client wants to access the server. Access ...
4
votes
1answer
1k views

Is this design of client side encryption secure?

I want to build a secure file storage web application. Users should be sure that server doesn't know how to decrypt files so encryption should take place at client side (i.e. in Javascript) and TLS ...
4
votes
1answer
250 views

Undecrypt using the OpenSSL EVP API?

I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation. When using AES-256-CBC on the two sides, it's important ...
4
votes
1answer
95 views

Is there any serious discussion about using blinding intermediaries in digital currency scenarios?

A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ...
4
votes
2answers
110 views

Allowing multiple password reset tokens, and a question on random number predictability

I have a few requirements for a password reset system, along with some questions at the end as to its security. Requirements The aim is to provide a password reset mechanism satisfying the following ...
3
votes
8answers
603 views

Does a public key absolutely need to be used to initiate an encrypted session?

I am a software developer working on an application with the .NET platform. This application needs to provide a secure connection and encrypt all data between the client and the server. It is a ...
3
votes
4answers
768 views

Increased CRC collision probability when adding bits to input message

The Scenario I have a message string I need to transport over a wireless network that may be unreliable. This message string is about 100 bits long, and is packaged with an 8-bit CRC. When the ...
3
votes
3answers
420 views

How to avoid a chicken and egg scenario with encrypting passwords?

I am working on application that allows users to upload files containing company data and then share those files with a list of other users that have specific roles within the system. I want to ...
3
votes
4answers
429 views

Is there a symmetric-key cryptography based on key establishment techniques?

Most of the current key exchange techniques are based on public-key cryptography. Are there any key exchange/establishment techniques based on symmetric-key cryptography too? In my setup primary ...
3
votes
2answers
334 views

How can I encrypt more than 64 bit with the Data Encryption Standard?

The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key. If my data is more than 64 bits, (suppose 66 or 67 bits), will ...
3
votes
2answers
181 views

Protocol to generate Client Certificates at the start of a SSL session automatically?

A more secure form of 'cookie' could be created for SSL communications through the following method. The client generates and requests the server to sign a certificate. Then the client authenticates ...
3
votes
2answers
171 views

What was the problem in the SSL version 2.0?

What is the main reason (attacks) the appearance of the protocol SSL version 2.0 to replace version 3.0?
3
votes
3answers
511 views

A proof-of-work random number generation system for Pokémon [closed]

(The original question that was here was considered too confusing, unclear, and rambling. You can still view it in the edit history, but the content is no longer useful by itself, and cannot be ...
3
votes
2answers
681 views

How do public key rings work in cryptographic applications?

I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
3
votes
3answers
289 views

Third-party security issues with Shamir's secret sharing scheme

In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial. How can we ensure security here when we are involving a third party?
3
votes
3answers
532 views

Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
3
votes
2answers
235 views

What challenge should I use in a challenge-response proof-of-work?

In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them. Client connects Server ...
3
votes
3answers
166 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
3
votes
2answers
331 views

Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
3
votes
1answer
122 views

How can two (or more) parties share and agree upon a common random seed?

I really don't know how to call this simple problem: Two (or more) parties need to establish a common (non-secret) value to be used as a seed for a deterministic RNG. The only requirement is that each ...
3
votes
1answer
208 views

Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about ...
3
votes
3answers
271 views

Existing works on pre-computing ElGamal ephermal keys

I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
3
votes
3answers
204 views

Is the following authentication protocol insecure?

I am a student taking cryptography this semester. I was just wondering why can't we use this simple protocol? Alice → Open Connection → Bob Alice ← Cert$_b$ ← Bob Alice → {K$_{AB}$}$_{Bob}$ → Bob ...
3
votes
1answer
95 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But ...
3
votes
2answers
118 views

Ways to make a “doomsday” cryptocurrency which becomes untradable

As a social experiment (not a money-making scheme), I'm interested in developing a crazy cryptocurrency which, by its very design, will become worthless and untradable after a certain point. Ideally, ...
3
votes
1answer
127 views

Zero-knowledge proof for committing a choice?

Let's say there are 100 choices (which are publicly known), each represented as a different string, and today you have to choose one of them. You need not reveal what that choice is right now, though. ...
3
votes
3answers
139 views

Asymmetric algorithm for one time signing of small cleartext

I want to generate a key pair such that the private key can be used once to sign a small message (1024 bytes) at some indeterminate point in the future and the public key can be used to verify that ...
3
votes
1answer
92 views

Need to generate new DH keys for every message in OTR

Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it ...
3
votes
1answer
316 views

Should new applications still use RSA? Is it worth going down the ECDH route for protocols?

I am currently designing an application for communication between two and more users. At the moment I am trying to figure out what methods to use for the asymmetric cryptology. With the recent ...
3
votes
1answer
87 views

Data-validating protocol

I have to implement protocol of secure data transfer that can be described as Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table) Alice ...
3
votes
1answer
335 views

Blind signature with openssl

I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
3
votes
1answer
362 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...
3
votes
1answer
91 views

Secure Deduplication and Encryption in a data store

Assume: We have a centralized data store that can store whatever we need Every user is online Function $f : File \to Key$ gets access to the store, and is the same for all users. $g : Key \to File$ ...
3
votes
0answers
109 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
3
votes
2answers
70 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
3
votes
0answers
121 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...