Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

3
votes
2answers
187 views

HMAC key storage for a web app?

If one is going to use an HMAC, I.E: http://php.net/manual/en/function.hash-hmac.php, where exactly are they storing the key? Without some sort of secure storage (i.e not in a local file or code), I ...
3
votes
1answer
83 views

Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?

Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every ...
3
votes
1answer
39 views

Updating values authenticated by Merkle Tree

Assume we have 4 values: $v_1,v_2,v_3$ and $v_4$. We construct a Merkle tree on top of them such that the values are leaves of the tree. I send the values and the tree to an untrusted server. But I ...
3
votes
1answer
77 views

Improving security of (authentication) protocol

I have a basic protocol which tries to authenticate messages going from client to server. Basically it is like this: Imagine I want to send message M to server. Client computes a MAC over the ...
3
votes
1answer
65 views

Forcing participants to be honest in Secure Multiparty Communication

Alice and Bob engage to compute a secure function f(a,b) where a and b must be present in a ...
3
votes
1answer
203 views

public key cryptography and authentication for cross-platform network application

I'm developing network based application for control and telemetry on Linux based embedded system. I'm using ZMQ network library and Google Protocol Buffers serialization library for communication ...
3
votes
3answers
223 views

Asymmetric algorithm for one time signing of small cleartext

I want to generate a key pair such that the private key can be used once to sign a small message (1024 bytes) at some indeterminate point in the future and the public key can be used to verify that ...
3
votes
1answer
118 views

Need to generate new DH keys for every message in OTR

Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it ...
3
votes
1answer
397 views

Should new applications still use RSA? Is it worth going down the ECDH route for protocols?

I am currently designing an application for communication between two and more users. At the moment I am trying to figure out what methods to use for the asymmetric cryptology. With the recent ...
3
votes
1answer
314 views

Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
3
votes
1answer
96 views

Data-validating protocol

I have to implement protocol of secure data transfer that can be described as Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table) Alice ...
3
votes
0answers
41 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
3
votes
0answers
117 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
3
votes
0answers
28 views

Publishing only items your subscriber previously subscribed to, without you knowing which those items are

Let's say you were given a dump from a security breach. You want to share the email addresses affected by the breach with a separate company who pays you for this service so that they can protect ...
3
votes
0answers
30 views

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme: generate random seed z using ...
3
votes
0answers
102 views

Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
3
votes
1answer
130 views

Secure Deduplication and Encryption in a data store

Assume: We have a centralized data store that can store whatever we need Every user is online Function $f : File \to Key$ gets access to the store, and is the same for all users. $g : Key \to File$ ...
3
votes
0answers
125 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
3
votes
2answers
86 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
3
votes
0answers
141 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...
2
votes
2answers
912 views

Benefit of combining classical substitution ciphers with modern cryptography

I know that a simple monoalphabetic substitution cipher is considered extremely weak, on account of linguistic frequency-analysis attacks. However, assume the following: cleartext is encrypted ...
2
votes
2answers
1k views

AES + CBC encryption for a stream of UDP packets

I am developing an application that is based on UDP, and I need to send a stream of packets. As you can imagine, packets can get lost or corrupted. I need to make sure that the content of those ...
2
votes
1answer
391 views

SHA256-based stream cipher

Can anyone comment if the stream cipher described here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced ...
2
votes
2answers
322 views

Skein or Keccak stream cipher construction

I am wondering if using Skein or the Keccak hash algorithm in this construction (as a stream cipher) is secure: $H$ = Keccak or Skein hash with a 256 bit output $K$ = The main 256 bit random key, ...
2
votes
2answers
356 views

Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?

Encrypt-then-Authenticate (EtA) seems to generally be considered the better option, compared to Authenticate-then-Encrypt (AtE) (see this Crypto.SE question, for example). The people writing the RFC ...
2
votes
1answer
1k views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
2
votes
2answers
231 views

Alice's forgetful banking

Alice has a bank account number, but has forgotten which bank it is for. There are 4 banks, run by Bob, Carlos, David, and Eve. She could find out by going to all of the banks and asking if they have ...
2
votes
3answers
107 views

Three party coin flipping protocol with only 2 active participants

Is there a coin flipping protocol where: Alice, Bob and Carol don't trust each other, and The coin is flipped only by Alice and Bob, and The result must be trusted by all three participants.
2
votes
1answer
196 views

Does this protocol provide Perfect Forward Secrecy / are there potential security flaws?

We have a HMAC key (128 bit/16 bytes) an AES key (128 bit/16 bytes) an AES IV (128 bit/16 bytes) a random salt (128 bit/16 bytes) Each packet is signed with a HMAC (SHA256) After each packet is ...
2
votes
2answers
120 views

Proving a decision was randomly made [duplicate]

Alice and Bob want to agree on a bit $0$ or $1$. Both know it would be fair to pick that at random, but there's no way they could meet to throw a dice and no third party they could trust. Are there ...
2
votes
1answer
164 views

What kind of Quantum cryptography technology(protocols) can be used for Mobile Ad hoc networks(MANETS)?

Typically ad hoc networks do not have a proper infrastructure and the routing is done only through the base stations which are connecting a wired and wireless network. Does quantum cryptography ...
2
votes
1answer
527 views

Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm?

For example, Is possible to combine (Concatenate or Chain or XOR) Skein SHA-3 candidate with Grostl SHA-3 candidate to increase security? Note: I just want more secure output and CPU cycles does not ...
2
votes
2answers
159 views

How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?

I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this... I want another entity, lets call them the Auditor, to ...
2
votes
1answer
145 views

How to collect, process, and transmit data securely?

In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
2
votes
3answers
429 views

Prevent replay attack without storage

I am designing a set of low-power sensing motes. Each mote will communicate to a central base over RF. I want the mote to be able to authenticate itself with the base, and send its data without being ...
2
votes
2answers
223 views

Authenticating code securely and generating a certificate

I'm working on a product with strong security. Essentially there is an App, downloaded from the iTunes App Store. When the App starts up, it generates a strong RSA keypair and stores it in the ...
2
votes
1answer
577 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...
2
votes
2answers
249 views

Is there a point using GCM block chiper with Authenticated DH?

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher ...
2
votes
1answer
181 views

Selecting a large NUMS Safe prime

Suppose I want to use the following simple hash function. For a mesage $m$, take some public $a$ and prime $p$ and raise $a^m \bmod p$ (never mind the computational expense of this operation). This ...
2
votes
3answers
153 views

Public keys and their protocols

I'm having difficulties understanding exactly what this protocol means: $S \to D : \{N_S , S\}K_D$ $D \to S : \{N_S , N_D \}K_S$ $S \to D : \{N_D \}K_D$ "where $S$ represents the supervisor’s ...
2
votes
1answer
851 views

Replay attack prevention under strict conditions

Say I have a request-response protocol and the task to make it immune to replay attacks. The requirements are as follows: The defense mechanism cannot rely on the clocks of the parties. The defense ...
2
votes
1answer
177 views

ID-Secret Scheme

I have an ID-Secret scheme and I'd like to hear if there are any vulnerabilities present. Party 1 and Party 2 hold some credentials, an ID and a Secret. Party 1 Creates this message: ...
2
votes
1answer
175 views

Encrypted read-only message queue

I'm creating a prototype for a messaging queue with some custom logic (can't re-use any existing solution). One requirement is to have all messages encrypted. There are three classes of nodes ...
2
votes
1answer
173 views

What does this step in this protocol for the Yao's Millionaire Problem mean?

I was reading “An Efficient Protocol for Yao’s Millionaires’ Problem” (Ioannidis and Grama 2003). In the proposed protocol in section three, it is written: (Step 4) For every $i$, $1 \le i \le d$, ...
2
votes
2answers
703 views

Derive a key from public data using a secret master key

Users in my system will be given a device that contains a 128-bit AES user key. The user key will be derived from 64 bits of public data related to the user, which is unique but very predictable (i.e. ...
2
votes
1answer
572 views

Digital signatures in SSL/TLS-like protocols

The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ...
2
votes
2answers
284 views

What are the cryptographic assumptions in the Dolev Yao model?

In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox. Does blackbox here mean that the primitive is to be considered CPA ...
2
votes
1answer
3k views

Use of nonces in Kerberos and Needham–Schroeder protocols

Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport. In particular : Can you explain me the use of $N_A$? And ...
2
votes
1answer
218 views

Transparent cipher

I'm trying to implement this protocol: Alice has her permanent key $K_1$. She computes $E(K_1, P)$. She wants to share $P$ with Bob, Carol and Dave. For each of them she: 2.1. Generates $K_2$. ...
2
votes
1answer
85 views

Distributed knowledge problem

I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...