Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

learn more… | top users | synonyms

2
votes
1answer
2k views

Use of nonces in Kerberos and Needham–Schroeder protocols

Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport. In particular : Can you explain me the use of $N_A$? And ...
3
votes
1answer
471 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...
1
vote
2answers
125 views

How can I protect against the failure of a block or symmetric cipher?

Can I protect against the failure of a block or symmetric cipher by chaining different techniques together? If so what implementation details should I be aware of? Are some combination of ciphers ...
2
votes
1answer
670 views

Replay attack prevention under strict conditions

Say I have a request-response protocol and the task to make it immune to replay attacks. The requirements are as follows: The defense mechanism cannot rely on the clocks of the parties. The defense ...
1
vote
1answer
77 views

Cryptographic Algorithm/Protocol needed

I am trying to achieve the following: Encrypted files are stored on users filesystem. The user uses my client to authenticate against a server. Once he is authenticated successfully he gets a token ...
3
votes
8answers
692 views

Does a public key absolutely need to be used to initiate an encrypted session?

I am a software developer working on an application with the .NET platform. This application needs to provide a secure connection and encrypt all data between the client and the server. It is a ...
7
votes
1answer
823 views

A fair peer-based coin-flipping protocol?

I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight. This is how my idea ...
19
votes
4answers
2k views

How to fairly select a random number for a game without trusting a third party?

Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.) Can this be done such that each player has the power to be ...
7
votes
1answer
935 views

In which situations is a length-extension attack a problem?

A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem? I guess certain naive ...
9
votes
3answers
1k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
1
vote
1answer
174 views

ID-Secret Scheme

I have an ID-Secret scheme and I'd like to hear if there are any vulnerabilities present. Party 1 and Party 2 hold some credentials, an ID and a Secret. Party 1 Creates this message: ...
4
votes
1answer
861 views

Is this authenticated one-way communication protocol secure?

I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
1
vote
1answer
59 views

Proving item association without revealing one of the associated items

I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category. I have two associated pieces of information: tag — known by both parties. Unique per ...
2
votes
1answer
79 views

Distributed knowledge problem

I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
4
votes
1answer
918 views

Efficient and stateless anti-forgery method

One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
3
votes
2answers
304 views

What challenge should I use in a challenge-response proof-of-work?

In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them. Client connects Server ...
2
votes
1answer
111 views

Secure Remote Protocol - Are these 2 equations equivalent?

I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret. ...
2
votes
1answer
79 views

Are there any signature schemes that protect against collusion by multiple parties?

Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
8
votes
2answers
2k views

What advantage does facebook's new encrypted access_token have?

When a user on facebook grants an app access to their account, an API key is issued to the app. This key is app and user-specific. This process is described in Facebook's developer documentation. ...
4
votes
1answer
286 views

Undecrypt using the OpenSSL EVP API?

I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation. When using AES-256-CBC on the two sides, it's important ...
8
votes
8answers
624 views

Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
2
votes
2answers
155 views

How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?

I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this... I want another entity, lets call them the Auditor, to ...
6
votes
1answer
274 views

How does one design a traffic analysis resistant protocol?

I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
4
votes
2answers
197 views

Protocol to generate Client Certificates at the start of a SSL session automatically?

A more secure form of 'cookie' could be created for SSL communications through the following method. The client generates and requests the server to sign a certificate. Then the client authenticates ...
3
votes
2answers
459 views

How can I encrypt more than 64 bit with the Data Encryption Standard?

The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key. If my data is more than 64 bits, (suppose 66 or 67 bits), will ...
6
votes
4answers
228 views

Changing algorithms during encryption

Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption. For ...
4
votes
2answers
172 views

Generating non-repeating N-bit IVs, which are indistinguishable from randomness

I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
13
votes
1answer
1k views

Why choose an authenticated encryption mode instead of a separate MAC?

What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ...
2
votes
1answer
142 views

How to collect, process, and transmit data securely?

In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...