# Tag Info

1

What do you mean that you keep the root of the merkle tree locally? Is the merkle tree signed? If i understand what you are saying correctly, then the server can choose not to display to the public the changes you have made and keep presenting the merkle tree for the values before you updated them. Even if you sign the merkle tree the server can still do ...

0

In order to provide message integrity, a hash or message authentication function (MAC) is used. Sometimes, encryption and integrity are used together as (i) encrypt-then-MAC: provides ciphertext integrity, but no plaintext integrity, (ii) MAC-then-encrypt: provides plaintext integrity, but no ciphertext integrity, and (iii) encrypt-and-MAC: provides ...

2

Yes, this is secure. Even simpler would be to just use XSalsa20-Poly1305 and the long term key directly. You could authenticate any additional data with the Poly1305 just as well as in the case of the ChaCha-based combination. However, if you use e.g. libsodium where the former interface does not support additional data and the latter has a short nonce, ...

6

Even after your updates, the first part seems unnecessary. However, steps 4-5 do indeed prevent the attacker from learning future nonces they could ask the key MAC values for. So the protocol steps 4-7 would be secure with a secure MAC. I agree with CodesInChaos that using HMAC would be better, because H(m||k) has some weaknesses, while HMAC is standard. ...

3

I'm not sure I understand your question entirely. If there is only one possible message, then the ciphertext can be trivially decrypted simply by choosing this message. I'll assume instead that the ciphertext contains the shuffled bit pattern of a name chosen from a set of more than one name. The problem with bit shuffling is that the number of set bits ...

3

To answer your first question, the incrementation is required in order to prevent spoofing of that message. An attacker could send back the same encrypted nonce claiming to be Bob. However, if Bob incriments the nonce and sends it back encrypted, Alice would know for sure that Bob has received the nonce and has incremented it. Now, Alice encrypting the ...

6

My only idea is that B authenticates himself to A, because if A later decrypts it, A will see whether B was able to decrypt it. But why would you need to increment the nonce? Correct, that's the idea. If B didn't need to increment the nonce and just encrypted the same value, the message sent back would be the same that A sent, so an attacker would be ...

11

I assume the question is related to academic work: why do we implement a protocol if we already know how efficient it is by a complexity analysis? The answer depends very much on the type of protocol. However, the answer typically is that a theoretical complexity analysis usually does not suffice to understand the concrete efficiency. If the "previously best ...

10

Do we implement it for proof of concept? Absolutely. It's very easy to miss vital points if no implementation exists. W3C for instance doesn't even allow protocols to be standardized without reference implementation(s). Furthermore, an implementation may show small improvements as well. Personally I would require an implementation of all the (minimal) ...

0

My recommendation will be to use a stream cipher consisting of any block algorithm in CTR mode. You could use block ciphers like AES, or hash functions like BLAKE2. Stream ciphers are very efficient and light weight, hence it is the preferred cipher for encrypting phone calls. It should be good enough for your project. Block ciphers and hash functions make ...

1

It's trivial to code your own wrapper function if you really want to use such API. Here is a Python-inspired pseudo code: def mywrapper(data, offset, encspecs): subdata = data[0:offset] ciphertext = whatever_enc_function(subdata, encspecs) return ciphertext encspecs = ... plaintext = "...etc" ciphertxt = mywrapper(plaintext, offset, encspecs) ...

0

How about something like interleaving the bits of the base hash function outputs to generate a key (taking one bit from each hash in sequence, skipping hashes that have no unincorporated bits remaining), then generating a HMAC using each base hash function with however many bits of key they can use: $$K(x) = interleaveBits(H_0(x), H_1(x), H_2(x))$$ H(x) ...

Top 50 recent answers are included