Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

4
votes
1answer
762 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
4
votes
2answers
698 views

Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
4
votes
1answer
415 views

Why does the SRP-6 calculation of B include a multiplier k = 3?

In SRP-6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$? (In SRP-6a, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP-6.)
4
votes
2answers
407 views

Why must we generate the signature before any compression being done at PGP?

I have done some research on PGP and I found out there are of two reasons why we must generate the signature before doing any compression. Yet, I am not sure I really understand them both. One ...
4
votes
1answer
145 views

Private Messaging

Suppose Alice and Bob wants to send messages through Sue without revealing to Eve that the exchange took place. Slightly more formally, I don't want Eve to have any advantage telling if Alice is ...
4
votes
1answer
191 views

Changing SRP-6a message order

In SRP-6a, the public key $B$ of the server is normally sent after receiving the public key of the client $A$. Is it okay to send $B$ and $s$ after the client sends its username $I$, but before the ...
4
votes
2answers
581 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...
4
votes
1answer
305 views

Undecrypt using the OpenSSL EVP API?

I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation. When using AES-256-CBC on the two sides, it's important ...
4
votes
1answer
110 views

Is there any serious discussion about using blinding intermediaries in digital currency scenarios?

A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ...
4
votes
1answer
239 views

Consequence of a change on the Guillou-Quisquater Protocol

In the Guillou-Quisquater Protocol, the prover convinces the verifier that he knows an $e$-th root of an element $y \in \mathbb{Z}^*_n$ ($p, q, e$ are primes, $n = pq$ and $e$ is coprime with $\varphi(...
4
votes
1answer
69 views

Is it wise to use HOTP (raw bytes) as a key for HMAC?

Assume I have client and server applications with a shared master secret KEY_SECRET already in place. Also assume that the client and server have an implicit shared ...
4
votes
1answer
72 views

Is there a cryptographic protocol that let's me prove someone has a large binary?

I'm working on a system that has a P2P component. When an individual downloads a binary and decides to mirror it, they advertise themselves in a providers set. The binaries can range from 1-1000MB. I ...
4
votes
2answers
232 views

Allowing multiple password reset tokens, and a question on random number predictability

I have a few requirements for a password reset system, along with some questions at the end as to its security. Requirements The aim is to provide a password reset mechanism satisfying the following ...
4
votes
1answer
526 views

Blind signature with openssl

I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
4
votes
0answers
174 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
4
votes
0answers
68 views

How to use a stream cipher to sign a message?

Are there known constructions which allow to sign a message M (let's say it will be sent as clear text) using a stream cipher C and a symmetric secret key K? So, we have M, C, K and we want to send M|...
4
votes
0answers
111 views

Efficient proof of knowledge using Wegman-Carter hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
4
votes
2answers
379 views

AES-CTR with ephemeral keys vs IV

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several ...
3
votes
8answers
838 views

Does a public key absolutely need to be used to initiate an encrypted session?

I am a software developer working on an application with the .NET platform. This application needs to provide a secure connection and encrypt all data between the client and the server. It is a ...
3
votes
2answers
1k views

Tools for modelling and analysis of cryptographic protocols

I am designing some cryptographic protocols and I am new to it. Are there any well-known tools that can be used to model and design these protocols? And also verify or analyze their validity? If not ...
3
votes
3answers
676 views

How to avoid a chicken and egg scenario with encrypting passwords?

I am working on application that allows users to upload files containing company data and then share those files with a list of other users that have specific roles within the system. I want to ...
3
votes
3answers
2k views

How do public key rings work in cryptographic applications?

I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might (...
3
votes
3answers
699 views

Is it usual for a signed message to contain the public key of the signer?

In protocols/systems which use ECDSA, is it common for the message to contain the public key of the message signer? If not, how do recipients know that the message has been signed by the correct ...
3
votes
4answers
781 views

Is there a symmetric-key cryptography based on key establishment techniques?

Most of the current key exchange techniques are based on public-key cryptography. Are there any key exchange/establishment techniques based on symmetric-key cryptography too? In my setup primary ...
3
votes
2answers
600 views

How can I encrypt more than 64 bit with the Data Encryption Standard?

The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key. If my data is more than 64 bits, (suppose 66 or 67 bits), will ...
3
votes
2answers
870 views

What was the problem in the SSL version 2.0?

What is the main reason (attacks) the appearance of the protocol SSL version 2.0 to replace version 3.0?
3
votes
3answers
573 views

A proof-of-work random number generation system for Pokémon [closed]

(The original question that was here was considered too confusing, unclear, and rambling. You can still view it in the edit history, but the content is no longer useful by itself, and cannot be ...
3
votes
3answers
383 views

Third-party security issues with Shamir's secret sharing scheme

In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial. How can we ensure security here when we are involving a third party?
3
votes
3answers
1k views

Proper Way to Encrypt Data with Two Keys?

I'm going to develop a system that will have two keys. One supplied and generated by the system that's specific to an individual user and one from the user. I plan on using AES. Does it make sense ...
3
votes
3answers
109 views

DIY message level security?

This might be in danger of being too elementary a question for this community but I'm hoping for expert help: Assuming that TLS is not enough to protect messages transmitted between a client and a ...
3
votes
1answer
736 views

Is this DIY remote lock protocol secure?

I need your advice on following scheme of exchange protocol between remote lock and key. I'm planning to use following algorithm: Key generates unique value that never repeats (in reality it's just ...
3
votes
2answers
116 views

What practical uses can random hash collisions be put to?

Using magic, I've built a machine that instantly generates hash collisions. To try it out, I set the dial to SHA256 and typed in "e7cf3ef4f17c3999a94f2c6f612e8a888e5b1026878e4e19398b23bd38ec221a". I ...
3
votes
3answers
313 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
3
votes
1answer
148 views

How can two (or more) parties share and agree upon a common random seed?

I really don't know how to call this simple problem: Two (or more) parties need to establish a common (non-secret) value to be used as a seed for a deterministic RNG. The only requirement is that each ...
3
votes
2answers
525 views

Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
3
votes
2answers
470 views

Untraceable communication protocol

I am doing a research about secure communication protocols. I would be interested to know whether a protocol exists such that it grants that the two end-points taking part to the communication cannot ...
3
votes
1answer
62 views

Does encryption of data/information take place in peer to peer networks like Gnutella, Bittorrent?

Do peer to peer networks like Gnutella, Bittorrent have any encryption system to secure the users privacy or encrypt the file/data being shared? Elaborate please.
3
votes
2answers
651 views

Encryption for a short packet size

I have an 8051 microcontroller with a radio that can send packets with up to 32 bytes and I want to have the messages encrypted. It is a sensor network so I really only want to send one packet per ...
3
votes
1answer
1k views

How do TLS 1.1 and 1.2 generate IVs (initialization vectors) for each record?

According to RFC 4346 Explicit IVs [CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC ...
3
votes
1answer
170 views

Does there exist a two-pass AKE protocol that is secure in eCK model and also has PFS?

As we can know that the best two-pass AKE protocols with DH message can achieve is the weak form of perfect forward security (wPFS) which guarantees security against the passive adversary. But "...
3
votes
1answer
569 views

Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
3
votes
2answers
64 views

Re-sending captured encrypted data

Let’s assume Bob is some algorithmic stock trading machine. Bob takes commands from Alice, who sends messages to Bob. For example: Alice could be sending a message to Bob to stop trading. But if ...
3
votes
2answers
142 views

Coding of unsigned int to prevent guessing next ID

Suppose we are assigning records an unsigned integer ID from a N-bit space (say 32-bit) in a sequential manner. Is there a way we can code this ID before showing it to the public such that someone can'...
3
votes
3answers
204 views

Verifying DER encoded DSA/ECDSA signature with extra content?

Having a DSA/ECDSA signature which is supposed to be DER encoded as an ASN.1 sequence of $r$ and $s$ (as described in the RFC), and being given some bytes which are ...
3
votes
3answers
302 views

Existing works on pre-computing ElGamal ephermal keys

I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
3
votes
1answer
77 views

How can I formally verify fuzzy commitment scheme based security protocol?

I am currently working on designing a security protocol which involves usage of fuzzy commitment schemes, for. eg Reed-Solomon codes which allows us to tolerate a certain level of error. I was ...
3
votes
1answer
106 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...
3
votes
3answers
345 views

How to prove that someone encrypted a specific (large) chunk of data

Alice encrypts her data with HER secret key. Then she sends the encrypted data to Bob who should encrypt it with HIS secret key. Caroline should then eventually get this double encrypted data. ...
3
votes
1answer
166 views

Zero-knowledge proof for committing a choice?

Let's say there are 100 choices (which are publicly known), each represented as a different string, and today you have to choose one of them. You need not reveal what that choice is right now, though. ...
3
votes
3answers
305 views

Is the following authentication protocol insecure?

I am a student taking cryptography this semester. I was just wondering why can't we use this simple protocol? Alice → Open Connection → Bob Alice ← Cert$_b$ ← Bob Alice → {K$_{AB}$}$_{Bob}$ → Bob ...