Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

3
votes
3answers
412 views

How to avoid a chicken and egg scenario with encrypting passwords?

I am working on application that allows users to upload files containing company data and then share those files with a list of other users that have specific roles within the system. I want to ...
2
votes
1answer
250 views

Exact mathematical definition of simulation based security?

I've been trying to understand cryptographic protocols and how to define their security. The problem is that while I can understand what the intuitive definition says, I have trouble understanding how ...
3
votes
1answer
87 views

Data-validating protocol

I have to implement protocol of secure data transfer that can be described as Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table) Alice ...
6
votes
2answers
287 views

What is a “rewinding argument”?

I've been reading a bit about cryptographic protocols and I keep seeing the phrase "rewinding argument". I've been unable to find a good source that would explain what is meant by this. It seems like ...
2
votes
1answer
443 views

Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm?

For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to increase security? Note: I just want more secure output and CPU cycles does not ...
1
vote
1answer
368 views

Recommended Books for Cryptography : Theory and Implementation [closed]

It is a great idea if experts in Cryptography from mathematicians to security engineers introduce books and textbooks which they think is helpful or instructive for all people interested in the ...
7
votes
1answer
391 views

Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
3
votes
3answers
270 views

Existing works on pre-computing ElGamal ephermal keys

I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
1
vote
1answer
349 views

Deniability of OTR messaging

I've been looking at the off-the-record messaging protocol, and there is something about its deniability property that seems strange to me. Consider the following scenario: In the course of an ...
7
votes
3answers
818 views

Is this a secure implementation of password reset email?

I am redesigning a password reset email mechanism because the existing implementation scares the hell out of me. My goal is to generate reset codes that are: Expired Tamper Resistant Single Use ...
2
votes
3answers
143 views

Is it possible to ensure security with zero pre-shared information?

Is it possible to secure a communications channel against both passive (sniffing) and active (injecting / MitM) attackers without either legitimate party knowing any pre-shared information? I know ...
0
votes
1answer
129 views

Combatting traffic shape analysis with spurious packets

I was reading a question about combatting traffic analysis, and a thought occured. If I send random junk messages periodically, would that defeat traffic analysis? The messages would contain some ...
2
votes
2answers
261 views

Untraceable communication protocol

I am doing a research about secure communication protocols. I would be interested to know whether a protocol exists such that it grants that the two end-points taking part to the communication cannot ...
4
votes
1answer
1k views

Is this design of client side encryption secure?

I want to build a secure file storage web application. Users should be sure that server doesn't know how to decrypt files so encryption should take place at client side (i.e. in Javascript) and TLS ...
1
vote
0answers
127 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
1
vote
1answer
1k views

Use of nonces in Kerberos and Needham–Schroeder protocols

Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport. In particular : Can you explain me the use of $N_A$? And ...
1
vote
2answers
152 views

Can you distinguish encryption methods from the output?

Suppose that you see all IP communication packets between two computers for a day, as they pass through a connecting router, and this amounts to 10MB. You additionally know that all data transmission ...
22
votes
3answers
1k views

Is this password migration strategy secure?

I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
2
votes
1answer
193 views

Transparent cipher

I'm trying to implement this protocol: Alice has her permanent key $K_1$. She computes $E(K_1, P)$. She wants to share $P$ with Bob, Carol and Dave. For each of them she: 2.1. Generates $K_2$. ...
1
vote
2answers
113 views

How can I protect against the failure of a block or symmetric cipher?

Can I protect against the failure of a block or symmetric cipher by chaining different techniques together? If so what implementation details should I be aware of? Are some combination of ciphers ...
2
votes
1answer
522 views

Replay attack prevention under strict conditions

Say I have a request-response protocol and the task to make it immune to replay attacks. The requirements are as follows: The defense mechanism cannot rely on the clocks of the parties. The defense ...
1
vote
1answer
70 views

Cryptographic Algorithm/Protocol needed

I am trying to achieve the following: Encrypted files are stored on users filesystem. The user uses my client to authenticate against a server. Once he is authenticated successfully he gets a token ...
13
votes
1answer
817 views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
1
vote
1answer
149 views

Is it possible take a piece of data in secret?

I want something like this, but in a digital sense: You and others walk into a room. Everyone knows who each of you are and everyone is doing their best to figure out what piece of paper each ...
6
votes
1answer
516 views

A fair peer-based coin-flipping protocol?

I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight. This is how my idea ...
7
votes
1answer
770 views

In which situations is a length-extension attack a problem?

A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem? I guess certain naive ...
4
votes
1answer
537 views

Is this authenticated one-way communication protocol secure?

I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
2
votes
1answer
74 views

Distributed knowledge problem

I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
1
vote
1answer
58 views

Proving item association without revealing one of the associated items

I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category. I have two associated pieces of information: tag — known by both parties. Unique per ...
3
votes
1answer
327 views

Blind signature with openssl

I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
3
votes
1answer
354 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...
4
votes
1answer
703 views

Efficient and stateless anti-forgery method

One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
3
votes
2answers
235 views

What challenge should I use in a challenge-response proof-of-work?

In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them. Client connects Server ...
2
votes
1answer
108 views

Secure Remote Protocol - Are these 2 equations equivalent?

I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret. ...
2
votes
1answer
70 views

Are there any signature schemes that protect against collusion by multiple parties?

Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
1
vote
1answer
512 views

If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
3
votes
8answers
603 views

Does a public key absolutely need to be used to initiate an encrypted session?

I am a software developer working on an application with the .NET platform. This application needs to provide a secure connection and encrypt all data between the client and the server. It is a ...
2
votes
1answer
222 views

Is the SILC protocol still used?

I'm looking into implementing a private SILC server for friends (and possibly their friends). And after visiting the Wikipedia entry for SILC protocol, it seems all the official pages linked at the ...
2
votes
1answer
189 views

synchronization of counters in HOTP

How is synchronization of counter values achieved in the HOTP protocol? As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
3
votes
2answers
643 views

How do public key rings work in cryptographic applications?

I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
2
votes
3answers
141 views

Combating traffic analysis over request-response protocols

Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions: Contribute a ...
4
votes
1answer
248 views

Undecrypt using the OpenSSL EVP API?

I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation. When using AES-256-CBC on the two sides, it's important ...
4
votes
2answers
351 views

Provable Encryption

Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key? Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
2
votes
2answers
145 views

How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?

I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this... I want another entity, lets call them the Auditor, to ...
7
votes
8answers
462 views

Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
6
votes
1answer
246 views

How does one design a traffic analysis resistant protocol?

I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
6
votes
2answers
979 views

RSA-based authentication and key-agreement protocol

An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications. To that ...
4
votes
1answer
94 views

Is there any serious discussion about using blinding intermediaries in digital currency scenarios?

A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ...
3
votes
1answer
208 views

Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about ...
3
votes
2answers
331 views

How can I encrypt more than 64 bit with the Data Encryption Standard?

The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key. If my data is more than 64 bits, (suppose 66 or 67 bits), will ...