Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...
53
votes
5answers
6k views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
27
votes
5answers
2k views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
16
votes
4answers
648 views
How to fairly select a random number for a game without trusting a third party?
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)
Can this be done such that each player has the power to be ...
15
votes
3answers
672 views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
13
votes
1answer
386 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
8
votes
1answer
401 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
7
votes
8answers
366 views
Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?
I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
1
vote
1answer
67 views
How to secure a mental poker protocol?
I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
7
votes
3answers
758 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
5
votes
4answers
172 views
Changing algorithms during encryption
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.
For ...
1
vote
2answers
200 views
Are there any tools for modelling and analysis of Cryptographic protocols?
Iam designing few cryptographic protocols and am new to it.
Are there any well known tools that can be used to model/design these protocols ?
And also verify/Analyze their validity ?
If not a tool , ...
6
votes
1answer
205 views
A fair peer-based coin-flipping protocol?
I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight.
This is how my idea ...
5
votes
1answer
215 views
Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
4
votes
2answers
201 views
Provable Encryption
Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key?
Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
3
votes
2answers
183 views
Is there a way to do fair exchange between two parties who don't trust each other?
Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
3
votes
3answers
128 views
Authenticating data generated by a particular build of an open source program
[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.]
My ...
2
votes
1answer
252 views
Is a known plaintext, ciphertext, and public-key a viable attack on RSA?
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.
Alice and Bob each have their public- and private-key pairs ...
1
vote
1answer
51 views
Proving item association without revealing one of the associated items
I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category.
I have two associated pieces of information:
tag — known by both parties. Unique per ...
1
vote
2answers
107 views
Combating traffic analysis over request-response protocols
Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions:
Contribute a ...
