Tag Info

2

The purpose is to prevent a two-for-one guessing attack, where an active adversary, impersonating the server, can test two password guesses per attempt. The attack and why the multiplier prevents it is described in Section 2 of the SRP-6 paper (ps). (According to MacKenzie, it was discovered by Bleichenbacher.) In brief, the attack goes like this: Instead ...

3

From RFC 4226: 7.4. Resynchronization of the Counter Although the server's counter value is only incremented after a successful HOTP authentication, the counter on the token is incremented every time a new HOTP is requested by the user. Because of this, the counter values on the server and on the token might be out of synchronization. ...

4

“Well-typed” relates to a type system. This is a general concept in computer science, the usage here is an example of the general concept and is not specific to cryptography. “Well-typed” does not refer to a cryptographic protocol, but to a theory (model) in which a protocol is described. A type system is a way to assign properties (called types) to ...

5

When they write “well-typed”, they’re simply stating that the process $P$ is well-typed in context, or type environment. (Where the type environment contains a set of type assumptions occurring in $P$.) Keeping it simple: you can think of the term as a kind of classification. The term origins in Type Theory and is (more-or-less frequently) used in relation ...

5

For the moment assume $g$ is a secret (uniformly random) generator, but that $p$ may be known to the adversary. Then given only $g^a, g^b$, the Diffie-Hellman key $g^{ab}$ is information-theoretically uniform (up to small statistical error), i.e., it cannot even be found by brute force because the adversary does not have enough information to determine it. ...

3

I am wondering if using Skein or the Keccak hash algorithm in this construction (as a stream cipher) is secure: In the case of Skein and Keccak it should be secure. However, both of those have defined their own cipher modes which you should IMO prefer. (For compatibility, if not security.) The Skein one is defined in section 4.10 of the paper. It uses ...

1

If you replace $H$ with a MAC that is build using $H$, i.e. NMAC, then it will be provably secure. Encryption will be $C_i = MAC_k(IV | i) \oplus P_i$. You are guaranteed by the MAC security property (existential forgery) that an adversary cannot generate any of the key stream on his own and so you are left with a secure stream cipher. Just using $H$ by ...

1

Yes, that is possible -- that's exactly the problem that secure multiparty computation solves. You should start by reading standard references on secure multiparty computation. You might enjoy the following paper, and follow-on work: Secure Multiparty Computations on Bitcoin, Marcin Andrychowicz and Stefan Dziembowski and Daniel Malinowski and Łukasz ...

1

I think my definition of 'simple' is different from yours. : ) Are there any evident attacks on it? It's vulnerable to man-in-the-middle attacks, like: Step 9: M replaces $\langle b_{U}, v'_{U}, h'_{U} \rangle$ with $\langle b_{U}, v_{M}, h_{M} \rangle$, where they've calculated their own random bit string and used their own key to encrypt it. Now M ...

3

The answer depends on how you would layer the encryption on top of the existing protocol. If you implemented your own Skype client, you could deal with compression issues yourself. That might allow you to use format preserving encryption, perhaps on the compressed data stream and not the audio itself. However, you would need to be careful – speech ...

3

If you want $N$ serial numbers, your serial numbers will have to use $n$ bits for uniqueness, where $n = \log_2 N$. So if you have 100 bits to use for the serial, you could use 20 to get about a million serials and have 80 bits to use for a cryptographic MAC or signature. Now there are two approaches, the symmetric and the asymmetric. In the symmetric ...

7

What happens if the sender is at another point in the sequence? ... the key is pressed while out of range to the car. In a rolling code (code hopping) system, the keyfob transmitter maintains a synchronization counter C, incremented every time a button is pushed. The car receiver stores the most recent validated synchronization counter it has received ...

3

In a rolling code both the sender and the receiver always move forward in the sequence. If the sender has sent the $n$th code, then it will send the $(n+1)$th next. Contrarily, if the receiver has seen the $n$th code it will only accept the $(n+1)$th code or some later code. What happens if the sender is at another point in the sequence? Think of that ...

Top 50 recent answers are included