Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

2
votes
1answer
193 views

Transparent cipher

I'm trying to implement this protocol: Alice has her permanent key $K_1$. She computes $E(K_1, P)$. She wants to share $P$ with Bob, Carol and Dave. For each of them she: 2.1. Generates $K_2$. ...
1
vote
1answer
106 views

How to design a secure data container?

I want to design a secure data container that can be used to transfer encrypted data over a public network that can defeat common attacks. Data is already encrypted before entering this container so ...
2
votes
2answers
205 views

Alice's forgetful banking

Alice has a bank account number, but has forgotten which bank it is for. There are 4 banks, run by Bob, Carlos, David, and Eve. She could find out by going to all of the banks and asking if they have ...
45
votes
7answers
4k views

Guarding against cryptanalytic breakthroughs: combining multiple hash functions

Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
2
votes
1answer
193 views

ID-based key exchange protocol with PFS

The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the ...
1
vote
1answer
513 views

If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
1
vote
2answers
152 views

Can you distinguish encryption methods from the output?

Suppose that you see all IP communication packets between two computers for a day, as they pass through a connecting router, and this amounts to 10MB. You additionally know that all data transmission ...
1
vote
1answer
114 views

Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$?

The definition of $e$ can be seen here. I want to know the accurate comparison of efficiency between $e(\cdot,\cdot)$ and $g^a \pmod{p}$. If computing $e(P,Q)$ is less efficient than computing $g^a ...
3
votes
1answer
208 views

Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about ...
2
votes
1answer
133 views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
1
vote
0answers
112 views

Cryptanalysis not based on method used to encrypt? [closed]

When doing cryptanalysis on RSA or something number theory based, there are various attacks that all seem to involve number theory (Wikipedia: RSA_(algorithm) ~ Attacks_against_plain_RSA). Similarly, ...
2
votes
1answer
306 views

How do TLS 1.1 and 1.2 generate IVs (initialization vectors) for each record?

According to RFC 4346 Explicit IVs [CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC ...
1
vote
1answer
187 views

how to mathematically prove a key exchange algorithm [closed]

I want to know the basic methodology that can be used to prove that a key exchange algorithm is secure. I am not asking about any specific algorithm. I want to know what should be proven and how to ...
4
votes
3answers
301 views

What crypto system allows for 3 parties: Party 1 who makes an assertion, Party 2 mutates the assertion, Party 3 validates it

I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows ...
4
votes
2answers
351 views

Provable Encryption

Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key? Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
5
votes
3answers
334 views

Can we design a public-key infrastructure without certificate authorities?

In a recent essay, Bruce Schneier tasks the engineering community with redesigning and rebuilding the vulnerable parts of the Internet's backbone. We need to figure out how to re-engineer the ...
4
votes
1answer
252 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
1
vote
1answer
151 views

General-purpose non-interactive multi-party computation protocol

Most of general purpose multi-party computation protocols are highly interactive. Especially the ones with Shamir's secret scheme, as there is a degree reduction step in multiplication that needs the ...
2
votes
1answer
64 views

Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?

Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every ...
16
votes
3answers
1k views

Is using slow password hashing on the client side easier attackable than on the server side?

As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
8
votes
1answer
151 views

Any problems with this secure time synchronization scheme?

I have a time authority and I want to securely set a client's time to this authority's time/date within a precision of $\delta$ seconds. The authority's public key is known to the client. This was my ...
1
vote
1answer
112 views

The “Square Root” Solution of Oblivious RAM Simulation

I am reading the paper Software Protection and Simulation on Oblivious RAMs by Oded Goldreich and Rafail Ostrovsky. And I wonder about the description of the "Square Root" solution of oblivious RAM ...
6
votes
1answer
140 views

How to construct a yes/no election protocol, such that only the result is revealed?

Can we use a threshold scheme to construct a (yes/no)-election protocol, such that every voter can give a positive or negative vote or he can abstain, and such that only the result of the election is ...
3
votes
1answer
95 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But ...
1
vote
2answers
300 views

Derive a key from public data using a secret master key

Users in my system will be given a device that contains a 128-bit AES user key. The user key will be derived from 64 bits of public data related to the user, which is unique but very predictable (i.e. ...
5
votes
3answers
217 views

Secret sharing scheme with possibility to change the secret

Here's a scenario I want to handle with a secret sharing scheme: Alice wants to share the secret $S$ with Bob, Charlie and Dave. Alice generates private shares based on $S$ for Bob, Charlie and ...
1
vote
2answers
244 views

How can Alice prove that a message has not been tampered with?

In terms of the usual suspects. The problem I have is that Alice wants to send Bob a message M, which gives Bob permission to perform some actions. However Alice wants to verify, from time to ...
2
votes
1answer
222 views

Is the SILC protocol still used?

I'm looking into implementing a private SILC server for friends (and possibly their friends). And after visiting the Wikipedia entry for SILC protocol, it seems all the official pages linked at the ...
1
vote
1answer
120 views

Tor's integrity verification system?

I am trying to understand the design of Tor(onion router). I am reading the original paper on the 2nd generation onion routing system. Where, under integrity checking on streams, they say, "When Alice ...
4
votes
2answers
462 views

Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
3
votes
0answers
120 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...
3
votes
3answers
507 views

Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
2
votes
1answer
189 views

synchronization of counters in HOTP

How is synchronization of counter values achieved in the HOTP protocol? As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
1
vote
1answer
146 views

Is this a sensible cryptographic protocol intending to reduce the impact of compromised security?

I'm in the process of designing a cryptographic protocol which will reduce the impact an attacker will have if they gained root access to a server storing data. The basic crux of it is that keys ...
3
votes
2answers
325 views

Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
3
votes
4answers
740 views

Increased CRC collision probability when adding bits to input message

The Scenario I have a message string I need to transport over a wireless network that may be unreliable. This message string is about 100 bits long, and is packaged with an 8-bit CRC. When the ...
1
vote
1answer
258 views

Designing a security system from scratch with a custom protocol, suggestions needed

For the reasons I cannot go into details, I need to design my own protocol and overall security system which will be used to establish secure data exchange between various devices (most notably ...
5
votes
3answers
344 views

What kind of adversary is the cloud?

I just started some work on computation over encrypted data in the cloud. We're still in the early planning stages, and to really understand the kind of security we can offer I need to determine what ...
0
votes
1answer
75 views

How to hash a structure that needs to include that hash's outcome?

so I am busy writing a TCP protocol in which I send a "packet header" with each packet of data. This packet header is a structure that contains information about the data that was sent. I want to ...
6
votes
2answers
408 views

Have I understood pedersen commitment correctly?

I want to do a one-sided integer commitment scheme. I.e. the whole process must be non-interactive where I at one point first publicly reveal some data and then at a later time reveal the committed ...
0
votes
1answer
301 views

Is this scheme a provably fair random number generation?

I have thought up a method for generating random numbers between a client and a server which I hope is fair: The client and server decide on a range in advance, $0$ trough $n-1$. The server ...
2
votes
0answers
73 views

Relaxed trust criterion for mental poker server?

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
2
votes
0answers
27 views

Encryption with Deduplication [duplicate]

Suppose I have a file server running ZFS with file deduplication enabled, and I have two users that are sharing files: Alice and Carol. If Alice uploads huge_file.tgz to her www/ directory, and Carol ...
-1
votes
2answers
872 views

Where to store the private key and the public key in a communication protocol

I want to create a simple secured connection protocol over TCP/IP. I just want to connect from my mobile device to a server securely. Firstly I thought to use an SSL connection, but I changed my ...
1
vote
1answer
131 views

Selecting a large NUMS Safe prime

Suppose I want to use the following simple hash function. For a mesage $m$, take some public $a$ and prime $p$ and raise $a^m \bmod p$ (never mind the computational expense of this operation). This ...
0
votes
1answer
202 views

How to secure a mental poker protocol? [closed]

I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
2
votes
1answer
278 views

Digital signatures in SSL/TLS-like protocols

The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ...
1
vote
0answers
57 views

How can I validate generated session keys in SRP-6a protocol

I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys. On the client I generated a SHA1 ...
1
vote
2answers
231 views

AES encryption with shared IV

Sorry about the horrible title, didn't now what to say. I'm trying to avoid having to send an IV with every message purely to keep packet sizes down, so I thought of a method to establish a "IV ...
1
vote
0answers
117 views

SRP6a client server exchanged message order

In SRP6a, the public key of server is send after receiving the public key of client A. Its that okay that B send along together with s right after client send the username, and then later on client ...