Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

3
votes
1answer
393 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...
4
votes
1answer
778 views

Efficient and stateless anti-forgery method

One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
3
votes
2answers
258 views

What challenge should I use in a challenge-response proof-of-work?

In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them. Client connects Server ...
2
votes
1answer
109 views

Secure Remote Protocol - Are these 2 equations equivalent?

I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret. ...
2
votes
1answer
71 views

Are there any signature schemes that protect against collusion by multiple parties?

Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
3
votes
1answer
636 views

If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
3
votes
8answers
632 views

Does a public key absolutely need to be used to initiate an encrypted session?

I am a software developer working on an application with the .NET platform. This application needs to provide a secure connection and encrypt all data between the client and the server. It is a ...
2
votes
1answer
237 views

Is the SILC protocol still used?

I'm looking into implementing a private SILC server for friends (and possibly their friends). And after visiting the Wikipedia entry for SILC protocol, it seems all the official pages linked at the ...
2
votes
1answer
200 views

synchronization of counters in HOTP

How is synchronization of counter values achieved in the HOTP protocol? As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
3
votes
3answers
904 views

How do public key rings work in cryptographic applications?

I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
2
votes
3answers
143 views

Combating traffic analysis over request-response protocols

Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions: Contribute a ...
4
votes
1answer
254 views

Undecrypt using the OpenSSL EVP API?

I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation. When using AES-256-CBC on the two sides, it's important ...
4
votes
2answers
361 views

Provable Encryption

Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key? Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
2
votes
2answers
147 views

How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?

I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this... I want another entity, lets call them the Auditor, to ...
7
votes
8answers
497 views

Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
6
votes
1answer
259 views

How does one design a traffic analysis resistant protocol?

I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
6
votes
2answers
1k views

RSA-based authentication and key-agreement protocol

An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications. To that ...
4
votes
1answer
96 views

Is there any serious discussion about using blinding intermediaries in digital currency scenarios?

A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ...
3
votes
1answer
228 views

Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about ...
3
votes
2answers
377 views

How can I encrypt more than 64 bit with the Data Encryption Standard?

The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key. If my data is more than 64 bits, (suppose 66 or 67 bits), will ...
4
votes
2answers
167 views

Generating non-repeating N-bit IVs, which are indistinguishable from randomness

I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
13
votes
1answer
937 views

Why choose an authenticated encryption mode instead of a separate MAC?

What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ...
18
votes
4answers
1k views

How to fairly select a random number for a game without trusting a third party?

Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.) Can this be done such that each player has the power to be ...
10
votes
2answers
400 views

How should one implement a delegated shared trust protocol?

Consider the following (probably naive) scenario. Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
6
votes
4answers
219 views

Changing algorithms during encryption

Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption. For ...
8
votes
2answers
2k views

What advantage does facebook's new encrypted access_token have?

When a user on facebook grants an app access to their account, an API key is issued to the app. This key is app and user-specific. This process is described in Facebook's developer documentation. ...
2
votes
1answer
136 views

How to collect, process, and transmit data securely?

In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
6
votes
4answers
185 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
25
votes
1answer
2k views

Prevent double-spending with decentralized digital currencies without all transactions being public?

A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
8
votes
3answers
1k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
1
vote
1answer
169 views

ID-Secret Scheme

I have an ID-Secret scheme and I'd like to hear if there are any vulnerabilities present. Party 1 and Party 2 hold some credentials, an ID and a Secret. Party 1 Creates this message: ...
45
votes
7answers
5k views

Guarding against cryptanalytic breakthroughs: combining multiple hash functions

Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
117
votes
7answers
21k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
17
votes
3answers
1k views

Is using slow password hashing on the client side easier attackable than on the server side?

As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
3
votes
2answers
183 views

Protocol to generate Client Certificates at the start of a SSL session automatically?

A more secure form of 'cookie' could be created for SSL communications through the following method. The client generates and requests the server to sign a certificate. Then the client authenticates ...