Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

1
vote
1answer
110 views

Which data to share in CTR mode?

Suppose I've got two clients $A$ and $B$. Client $A$ encrypts data in CTR (Counter) mode to get a ciphertext. What information will client $B$ have to receive from $A$ to decrypt the ciphertext? Just ...
0
votes
3answers
369 views

Would it be possible to create a game where one would need to decrypt a simple encryption?

This might sound pretty weird, but I was thinking of a game a person could play alone with a pen and paper. I got this idea where the person would write a random four letter string on a paper, and ...
2
votes
1answer
131 views

What kind of Quantum cryptography technology(protocols) can be used for Mobile Ad hoc networks(MANETS)?

Typically ad hoc networks do not have a proper infrastructure and the routing is done only through the base stations which are connecting a wired and wireless network. Does quantum cryptography ...
0
votes
0answers
35 views

Correlated or biased coin protocols?

There are a number of papers in the literature describing secure/fair coin flipping protocols. Unfortunately in my case, I am looking for coins that are epsilon-biased or epsilon-correlated. I am ...
2
votes
1answer
146 views

What does this step in this protocol for the Yao's Millionaire Problem mean?

I was reading “An Efficient Protocol for Yao’s Millionaires’ Problem” (Ioannidis and Grama 2003). In the proposed protocol in section three, it is written: (Step 4) For every $i$, $1 \le i \le d$, ...
1
vote
0answers
184 views

What would make it impossible to deny that decryption of a package has taken place?

I'm part of a team designing a system where a user have to be able to read a certain package, if he has preformed an action or series of actions that makes it legal for him to do so. The tricky part ...
2
votes
1answer
215 views

Is this new server API authentication protocol secure?

I need a secure protocol to authenticate client side users with my server which has an API. I am devising something more secure particularly to resist active MITM attacks where an attacker may modify ...
2
votes
1answer
147 views

Bit commitment with 1-out-of-2 oblivious transfer

I know a protocol for bit commitment using regular OT (Bob has 1/2 chance of learning the bit Alice transferred to him) which goes like this: COMMITMENT PHASE Alice chooses a bit $b$ For ...
4
votes
2answers
227 views

Is the following symmetric design secure?

Assume: $O$ be a reversible random permutation oracle on a finite set and $O^{-1}$ the inverse permutation (pretty much equivalent to a random permutation: What is the difference between a bijective ...
1
vote
1answer
149 views

Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which ...
1
vote
0answers
97 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...
3
votes
1answer
133 views

How can two (or more) parties share and agree upon a common random seed?

I really don't know how to call this simple problem: Two (or more) parties need to establish a common (non-secret) value to be used as a seed for a deterministic RNG. The only requirement is that each ...
1
vote
1answer
119 views

How to design a secure data container?

I want to design a secure data container that can be used to transfer encrypted data over a public network that can defeat common attacks. Data is already encrypted before entering this container so ...
7
votes
1answer
257 views

Are there any differences in operation between existing Diffie-Hellman specifications?

Are there any differences in operation between existing Diffie-Hellman specifications, especially those within the RSA PKCS#3, ANSI X9.42 and RFC 2631 standards?
1
vote
1answer
118 views

Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$?

The definition of $e$ can be seen here. I want to know the accurate comparison of efficiency between $e(\cdot,\cdot)$ and $g^a \pmod{p}$. If computing $e(P,Q)$ is less efficient than computing $g^a ...
2
votes
1answer
230 views

ID-based key exchange protocol with PFS

The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the ...
1
vote
0answers
113 views

Cryptanalysis not based on method used to encrypt? [closed]

When doing cryptanalysis on RSA or something number theory based, there are various attacks that all seem to involve number theory (Wikipedia: RSA_(algorithm) ~ Attacks_against_plain_RSA). Similarly, ...
2
votes
1answer
437 views

How do TLS 1.1 and 1.2 generate IVs (initialization vectors) for each record?

According to RFC 4346 Explicit IVs [CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC ...
1
vote
1answer
228 views

how to mathematically prove a key exchange algorithm [closed]

I want to know the basic methodology that can be used to prove that a key exchange algorithm is secure. I am not asking about any specific algorithm. I want to know what should be proven and how to ...
10
votes
2answers
5k views

Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
4
votes
3answers
381 views

Can we design a public-key infrastructure without certificate authorities?

In a recent essay, Bruce Schneier tasks the engineering community with redesigning and rebuilding the vulnerable parts of the Internet's backbone. We need to figure out how to re-engineer the ...
4
votes
1answer
382 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
3
votes
1answer
360 views

Should new applications still use RSA? Is it worth going down the ECDH route for protocols?

I am currently designing an application for communication between two and more users. At the moment I am trying to figure out what methods to use for the asymmetric cryptology. With the recent ...
1
vote
1answer
183 views

General-purpose non-interactive multi-party computation protocol

Most of general purpose multi-party computation protocols are highly interactive. Especially the ones with Shamir's secret scheme, as there is a degree reduction step in multiplication that needs the ...
3
votes
1answer
73 views

Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?

Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every ...
1
vote
1answer
315 views

What's wrong with my security model - or how can it be attacked?

I'm working on a little personal project where security is very important, and I've thought for a while about the best way to do this. Now I am looking for a little outside help on good practices. The ...
2
votes
1answer
171 views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
1
vote
1answer
139 views

The “Square Root” Solution of Oblivious RAM Simulation

I am reading the paper Software Protection and Simulation on Oblivious RAMs by Oded Goldreich and Rafail Ostrovsky. And I wonder about the description of the "Square Root" solution of oblivious RAM ...
2
votes
2answers
215 views

Alice's forgetful banking

Alice has a bank account number, but has forgotten which bank it is for. There are 4 banks, run by Bob, Carlos, David, and Eve. She could find out by going to all of the banks and asking if they have ...
8
votes
1answer
164 views

Any problems with this secure time synchronization scheme?

I have a time authority and I want to securely set a client's time to this authority's time/date within a precision of $\delta$ seconds. The authority's public key is known to the client. This was my ...
10
votes
5answers
1k views

Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
3
votes
1answer
111 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But ...
1
vote
2answers
461 views

Derive a key from public data using a secret master key

Users in my system will be given a device that contains a 128-bit AES user key. The user key will be derived from 64 bits of public data related to the user, which is unique but very predictable (i.e. ...
-2
votes
1answer
218 views

Security of RSA-substitution-RSA

Following on from here, I am unconvinced that encrypting twice with RSA is a waste of time: doesn't it depend on what is placed in-between the two encryptions?. What would happen if a permutation was ...
5
votes
3answers
305 views

Secret sharing scheme with possibility to change the secret

Here's a scenario I want to handle with a secret sharing scheme: Alice wants to share the secret $S$ with Bob, Charlie and Dave. Alice generates private shares based on $S$ for Bob, Charlie and ...
1
vote
2answers
342 views

How can Alice prove that a message has not been tampered with?

In terms of the usual suspects. The problem I have is that Alice wants to send Bob a message M, which gives Bob permission to perform some actions. However Alice wants to verify, from time to ...
8
votes
2answers
365 views

What current authenticated key exchange standards exist?

If neither of the 'big two' of TLS Handshake and IKE are appropriate in a given situation, what alternative Authenticated Key Exchange (AKE) standards exist and are recommended? Many protocols have ...
1
vote
1answer
172 views

Tor's integrity verification system?

I am trying to understand the design of Tor(onion router). I am reading the original paper on the 2nd generation onion routing system. Where, under integrity checking on streams, they say, "When Alice ...
3
votes
0answers
128 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...
3
votes
3answers
747 views

Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
1
vote
1answer
154 views

Is this a sensible cryptographic protocol intending to reduce the impact of compromised security?

I'm in the process of designing a cryptographic protocol which will reduce the impact an attacker will have if they gained root access to a server storing data. The basic crux of it is that keys ...
3
votes
2answers
412 views

Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
1
vote
1answer
301 views

Designing a security system from scratch with a custom protocol, suggestions needed

For the reasons I cannot go into details, I need to design my own protocol and overall security system which will be used to establish secure data exchange between various devices (most notably ...
6
votes
3answers
379 views

What kind of adversary is the cloud?

I just started some work on computation over encrypted data in the cloud. We're still in the early planning stages, and to really understand the kind of security we can offer I need to determine what ...
3
votes
4answers
977 views

Increased CRC collision probability when adding bits to input message

The Scenario I have a message string I need to transport over a wireless network that may be unreliable. This message string is about 100 bits long, and is packaged with an 8-bit CRC. When the ...
0
votes
1answer
78 views

How to hash a structure that needs to include that hash's outcome?

so I am busy writing a TCP protocol in which I send a "packet header" with each packet of data. This packet header is a structure that contains information about the data that was sent. I want to ...
6
votes
2answers
611 views

Have I understood pedersen commitment correctly?

I want to do a one-sided integer commitment scheme. I.e. the whole process must be non-interactive where I at one point first publicly reveal some data and then at a later time reveal the committed ...
0
votes
1answer
414 views

Is this scheme a provably fair random number generation?

I have thought up a method for generating random numbers between a client and a server which I hope is fair: The client and server decide on a range in advance, $0$ trough $n-1$. The server ...
2
votes
0answers
83 views

Relaxed trust criterion for mental poker server?

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
2
votes
0answers
27 views

Encryption with Deduplication [duplicate]

Suppose I have a file server running ZFS with file deduplication enabled, and I have two users that are sharing files: Alice and Carol. If Alice uploads huge_file.tgz to her www/ directory, and Carol ...