Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...
53
votes
5answers
6k views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
27
votes
5answers
2k views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
17
votes
1answer
1k views
Could one prevent double spending in decentralized digital currencies (like Bitcoin) without all transactions being public?
A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
16
votes
4answers
648 views
How to fairly select a random number for a game without trusting a third party?
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)
Can this be done such that each player has the power to be ...
15
votes
3answers
672 views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
13
votes
1answer
386 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
9
votes
2answers
301 views
How should one implement a delegated shared trust protocol?
Consider the following (probably naive) scenario.
Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
8
votes
1answer
401 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
7
votes
8answers
366 views
Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?
I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
7
votes
3answers
758 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
6
votes
3answers
196 views
What kind of adversary is the cloud?
I just started some work on computation over encrypted data in the cloud. We're still in the early planning stages, and to really understand the kind of security we can offer I need to determine what ...
6
votes
2answers
132 views
Have I understood pedersen commitment correctly?
I want to do a one-sided integer commitment scheme. I.e. the whole process must be non-interactive where I at one point first publicly reveal some data and then at a later time reveal the committed ...
6
votes
1answer
545 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
6
votes
1answer
205 views
A fair peer-based coin-flipping protocol?
I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight.
This is how my idea ...
5
votes
4answers
172 views
Changing algorithms during encryption
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.
For ...
5
votes
1answer
215 views
Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?
I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
5
votes
1answer
181 views
How does one design a traffic analysis resistant protocol?
I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
5
votes
2answers
181 views
What is a “rewinding argument”?
I've been reading a bit about cryptographic protocols and I keep seeing the phrase "rewinding argument". I've been unable to find a good source that would explain what is meant by this. It seems like ...
5
votes
1answer
216 views
How do process calculi, CSP, Promela, … compare?
In protocol analysis, formal verification is a very important tool.
What are the major differences between ...
4
votes
3answers
406 views
A proof-of-work random number generation system for Pokémon [closed]
(The original question that was here was considered too confusing, unclear, and rambling. You can still view it in the edit history, but the content is no longer useful by itself, and cannot be ...
4
votes
2answers
201 views
Provable Encryption
Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key?
Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
4
votes
3answers
355 views
Is this a secure implementation of password reset email?
I am redesigning a password reset email mechanism because the existing implementation scares the hell out of me. My goal is to generate reset codes that are:
Expired
Tamper Resistant
Single Use
...
4
votes
2answers
1k views
What advantage does facebook's new encrypted access_token have?
When a user on facebook grants an app access to their account, an API key is issued to the app. This key is app and user-specific. This process is described in Facebook's developer documentation.
...
4
votes
2answers
137 views
Generating non-repeating N-bit IVs, which are indistinguishable from randomness
I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
4
votes
1answer
83 views
How to construct yes/no - election protocol, such that only the result is revealed?
Can we use Threshold scheme to construct an (yes/no)-election protocol, such that every voter can give a positive or negative vote or he can abstain, and such that only the result of the election is ...
3
votes
3answers
222 views
How to avoid a chicken and egg scenario with encrypting passwords?
I am working on application that allows users to upload files containing company data and then share those files with a list of other users that have specific roles within the system.
I want to ...
3
votes
2answers
153 views
What challenge should I use in a challenge-response proof-of-work?
In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them.
Client connects
Server ...
3
votes
2answers
183 views
Is there a way to do fair exchange between two parties who don't trust each other?
Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
3
votes
1answer
193 views
Is Truecrypt's multiple/cascading encryption safe?
Is Truecrypt use of cascading encryption safe? Is it useful? Truecrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very ...
3
votes
3answers
748 views
Should we sign-then-encrypt, or encrypt-then-sign?
We often want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
3
votes
1answer
331 views
Efficient and stateless anti-forgery method
One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
3
votes
2answers
160 views
What crypto system allows for 3 parties: Party 1 who makes an assertion, Party 2 mutates the assertion, Party 3 validates it
I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows ...
3
votes
3answers
150 views
Efficient Symmetric Mutual Entity Authentication Protocol
I am looking for an Authentication protocol for access control. Let's say both the client and server would share a symmetric secret (256 bit key) and the client wants to access the server. Access ...
3
votes
1answer
183 views
Undecrypt using the OpenSSL EVP API?
I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation.
When using AES-256-CBC on the two sides, it's important ...
3
votes
1answer
445 views
RSA-based authentication and key-agreement protocol
An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications.
To that ...
3
votes
1answer
91 views
Is there any serious discussion about using blinding intermediaries in digital currency scenarios?
A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function.
...
3
votes
1answer
197 views
Blind signature with openssl
I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
3
votes
0answers
216 views
Why do new versions of TLS use an explicit IV for CBC suites?
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: They used the last part of the previous record, a value that can be predicted by the attacker. ...
3
votes
3answers
128 views
Authenticating data generated by a particular build of an open source program
[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.]
My ...
2
votes
4answers
169 views
Increased CRC collision probability when adding bits to input message
The Scenario
I have a message string I need to transport over a wireless network that may be unreliable. This message string is about 100 bits long, and is packaged with an 8-bit CRC. When the ...
2
votes
2answers
249 views
Why do we need Hash by key?
(i'm just trying to find what am I missing...)
Assuming John have a clear text message , he can create a regular hash ( like md5 , or sha256) and then encrypt the ...
2
votes
2answers
146 views
Protocol to generate Client Certificates at the start of a SSL session automatically?
A more secure form of 'cookie' could be created for SSL communications through the following method.
The client generates and requests the server to sign a certificate.
Then the client authenticates ...
2
votes
2answers
274 views
Benefit of combining classical substitution ciphers with modern cryptography
I know that a simple monoalphabetic substitution cipher is considered extremely weak, on account of linguistic frequency-analysis attacks. However, assume the following:
cleartext is encrypted ...
2
votes
2answers
238 views
How do public key rings work in cryptographic applications?
I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
2
votes
2answers
187 views
How can I encrypt more than 64 bit with the Data Encryption Standard?
The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key.
If my data is more than 64 bits, (suppose 66 or 67 bits), will ...
2
votes
1answer
252 views
Is a known plaintext, ciphertext, and public-key a viable attack on RSA?
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.
Alice and Bob each have their public- and private-key pairs ...
2
votes
2answers
126 views
How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?
I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this...
I want another entity, lets call them the Auditor, to ...
2
votes
2answers
132 views
Untraceable communication protocol
I am doing a research about secure communication protocols.
I would be interested to know whether a protocol exists such that it grants that the two end-points taking part to the communication cannot ...
2
votes
2answers
82 views
What are the cryptographic assumptions in the Dolev Yao model?
In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox.
Does blackbox here mean that the primitive is to be considered CPA ...
2
votes
1answer
143 views
Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle?
I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
