Tag Info

New answers tagged

0

First, there is a non-security argument in favor of option 2.: if you can cache the AES key across key exchanges, you can save time in key setup. Whether that's relevant I'll leave for you to decide. CTR fails when the same key-nonce pair is used twice. Let's assume the nonces are always unique, and that key derivation and mixing is strong. Birthday bound ...


0

No, Paillier is not commutative. Your proposal for doing oblivious decryption is almost correct. Multiplication in the ciphertext domain is addition in the plaintext domain, so $E(pk, m+r) = E(pk, m) \cdot E(pk, r)$. Given $m+r$ in a finite group, Bob cannot figure out $m$ as long as $r$ is only ever used once.


1

For this they have to register their public keys in a server: Alice generates her public and private keys (pub_A, priv_A). Alice sends pub_A to a public server. Bob generates his public and private keys (pub_B, priv_B). Bob sends pub_B to a public server. So, you are basicly exchange public keys and the server uses those as encryption ...


3

This is exactly where automatic protocol analysis tools can help you. For example, using the Scyther tool, the protocol description using symmetric encryption is: /* * Protocol description for Scyther * * Note we use 'K' to model 'k' since Scyther assumes 'k(.,.)' refers * to pre-shared keys between two agents. */ // The protocol description with ...


2

An algorithm which is secure even if the enemy acquires everything but the key may be regarded as a means of generating secure algorithms. If one presently has a secure channel for communicating with a correspondent, and will need to communicate securely in future when no secure channel is available, using some dice to generate a random key and conveying it ...


3

The "interesting" part of your encryption is here: Therefore, I prepend a block at the beginning of my packet. Its content goes as follows: First four bytes: current timestamp in seconds Next 12 bytes: zeros I compute the sha256 hash of the message (32 bytes) I xor the timestamp + zeros block with the first half of the hash I xor the ...


5

At a high level, the major flaw is that you are rolling your own crypto protocol. You should strongly consider using a standardized protocol like DTLS. Some specific problems: Symmetric key distribution is left unspecified. Keys must be changed occasionally to thwart distinguishers. No way to recover from symmetric key compromise. Your message ...


0

I don't think they are even used academically anymore, possibly because of soundness problems and limited expressivity. I would not recommend this approach.


6

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. The ciphertext is the ENTIRE ciphertext (including IV etc.), and this is what must be MACed. This is granted. However, if you MAC-then-encrypt in the ...



Top 50 recent answers are included