# Tag Info

6

SSL was designed long ago when encrypt-then-MAC wasn't that popular yet. Even TLS 1.2, published in 2008, is pretty old by now, and while encrypt-then-MAC was preferred by then, the practical risks were underestimated for a long time. Padding oracles attacks became well known after several high profile attacks in 2010. With stream ciphers, MAC-then-encrypt ...

2

I may be interpreting your question incorrectly, but it sounds to me like you are asking if Caroline can prove (in court or whatever) that she can only gain access to some secret $S$ if both Alice and Bob collaborate in revealing it to her. Unfortunately as you have currently set up the question, I don't think that is possible, because your question ...

2

NOTE: My cryptography-based solution above (accepted answer) is my preferred method, but since it is significantly different I am including my old answer here (I did not want to clutter my other answer with it). Non-cryptographic solution: While the above extension to the BitTorrent protocol would require a lot more work, you can still nearly eliminate ...

2

Covert two-party/multi-party computation provides exactly what you're looking for. The two-party case was introduced by von Ahn, Hopper, and Langford, and a more formal definition and multi-party protocol was given by Chandran, Goyal, Ostrovsky and Sahai. Covert secure computation even hides whether or not the parties participated in the computation at ...

1

$A$ has outsourced it's private data to the server, right? In that case $A$'s private data has already been leaked to the adversary when the server was corrupted. So there is no added leakage in $B$ also learning this data. In fact since only one of $B$ and the server can be corrupted (assuming static corruptions) we can conclude that $B$ is honest, and ...

1

Should we sign-then-encrypt, or encrypt-then-sign? ... Do the same issues with (symmetric-key) MAC-then-encrypt apply to (public-key) sign-then-encrypt? Yes. From a security engineering standpoint, you are consuming unauthenticated data during decryption if you mac-then-encrypt or sign-then-encrypt. A very relevant paper is Krawczyk's The Order of ...

1

You could ask Alice and Bob to rate their "affection" for one another using some scale, then apply a protocol for the Socialist Millionaire's Problem (a variant of Yao's Millionaire's Problem) to determine whether the values are equal. If the scale is finite (say, in the range from 1-10), then a party can learn some information about the other's value by ...

1

You could do something fairly simple, such as $UserSecret = Random()$ $UserID = HMAC(ServerSecret, UserSecret)$ Send the user the two values. When he reconnects, he sends the two values back. If re-calculating $UserID$ with the user's $UserSecret$ gives the same $UserID$ then that proves (to a high degree of certainty) that it's the same person that was ...

Only top voted, non community-wiki answers of a minimum length are eligible