Questions tagged [protocol-analysis]
Protocol analysis is the detailed analysis of the security of an abstract or concrete cryptographic protocol.
201 questions
0
votes
0
answers
44
views
Order of Enigma's rotors does not increase total number of keys
I have a question about “order of rotors”. I read about Enigma but I do not understand this point. If the machine has 3 rotors, for example 1_2_3, so it has 26×26×26 total keys. If we change the ...
- 27
3
votes
1
answer
78
views
Is the user's password revealed to a curious server in the OPAQUE PAKE?
If the server is honest-but-curious, it can attempt to guess the user’s password $\mathsf{pw}$ by computing $\mathsf{rw} = H(\mathsf{pw}, H'(\mathsf{pw})^s)$,where $s$ is the server's OPRF key. Then, ...
0
votes
0
answers
28
views
Looking for Additional Signal Protocol Attacks
I’m researching different types of attacks on the Signal protocol and have identified the following so far:
Unknown Key Share (UKS) Attack
Key Compromise Impersonation (KCI) Attack
I’m wondering if ...
- 61
1
vote
1
answer
49
views
Why does WhatsApp use two constants (0x0600 and 0x0601) for signing linking metadata between primary and companion devices?
In WhatsApp, two types of devices can be connected to an account: the primary device (a mobile) and a companion device (connected through the primary device). To indicate that both devices are linked ...
- 61
0
votes
0
answers
29
views
What are the main steps for proving the soundness of zk-SNARKs?
I’m currently researching zero-knowledge proofs, specifically zk-SNARKs, and I’m interested in understanding the process of proving their soundness.
Could someone outline the main steps or provide an ...
2
votes
1
answer
120
views
Title: Why Does WhatsApp Use Both CBC and GCM Encryption?
"I noticed that WhatsApp uses both CBC (Cipher Block Chaining) and GCM (Galois/Counter Mode) encryption in different scenarios. For example, CBC is used for transmitting media and exchanging ...
- 61
1
vote
0
answers
49
views
whatsapp's live location ratchting
I've been reading WhatsApp's white paper (titled WhatsApp Encryption Overview), but I'm having trouble understanding the ratcheting method used for live location sharing (page 16) not the ones used in ...
- 61
1
vote
0
answers
73
views
Understanding Signal Protocols for Group chat, Voice, and Video call
I am new to the field of protocols and currently researching the Signal protocol and its security features. So far, I have studied X3DH, Double Ratchet, the Sesame algorithm, and PQXDH, which is ...
- 61
0
votes
0
answers
76
views
Assessing the security of the V2Ray ecosystem and its protocols
I recently came across tools like v2rayNG, described as "A V2Ray client for Android, supporting Xray core and V2Fly core," which function as VPN or proxy clients. These seem to utilize ...
- 133
0
votes
0
answers
52
views
Does Qrypt's BLAST protocol based on "Doubly-Affine Extractors" use public-key or symmetric-key cryptography?
The company Qrypt states that "Key distribution based on asymmetric algorithms is a weak link for cryptography" and claims to "enable encryption without distributing encryption keys&...
- 441
0
votes
0
answers
59
views
Does this protocol description and design look sound?
I am working on a tool that uses password derived keys for AES and a selectable modes of operation to encrypt (and later decrypt) text for storage on an insecure media. The tool is constrained to ...
- 101
3
votes
1
answer
1k
views
How does SMB authentication work?
When I learned about the inner workings of the TLS protocol and what exactly it protects a connection against, I was surprised to learn that even asymmetric encryption can be defeated by a MITM attack ...
- 161
1
vote
0
answers
96
views
Zero Knowledge 3-coloring, but we allow malicious V to challenge two edges
So I think I understand how zero knowledge protocol with 3-coloring is supposed to work. But in an attempt to increase soundness of the protocol, we allow the verifier V to challenge two edges per ...
- 19
1
vote
0
answers
36
views
What is the maximum number of current members in a group CA that MKA can support?
The MACsec standard (IEEE 802.1AE-2018) states "The number of SCIs (and hence the number of SSCIs) is ultimately limited by the maximum number of current members in a group CA that MKA can ...
- 11
1
vote
1
answer
46
views
How to construct a protocol for a trustless standardized paper test?
So the problem I'm exploring is basically how to run a paper exam (such as the SAT) in such a way that participants can be sure that their exams were graded fairly, meaning the exam hosts can't change ...
- 187
1
vote
0
answers
65
views
Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$
Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order.
Assume that I know how to construct an efficiently computable ...
- 425
2
votes
1
answer
261
views
Confirming understanding of security protocol modelled in Scyther
In university, I'm currently learning how to use Scyther to model security protocols. Currently I am trying to understand what is happening in an example protocol given to me which is:
...
- 77
2
votes
3
answers
692
views
Secure Multi-Party Computation (MPC) protocol with all dishonest parties
What if we consider an MPC protocol in which all parties are dishonest? Is it unattainable (even with allowing abort) or is it just meaningless to think about?
user105855
2
votes
0
answers
107
views
Automated Security Protocol tool that models algebraic operations
Are there any automated security protocol verification tools that model algebraic operations; specifically addition.
I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
- 327
1
vote
1
answer
83
views
Public key fingerprint verification for large groups
If you were designing:
An open source client that offered E2E encryption for e.g. folder sharing between users
Each user had public keys for signing (and separate public keys for encryption of ...
- 11
3
votes
1
answer
101
views
Do ideal non-cyclotomic lattices provide better compression in lattice-based cryptography?
Let $f \in \mathbb{Z}[x]$ be an irreducible polynomial of degree $N$ and $q \in \mathbb{N}$. Consider the rings $R := \mathbb{Z}[x]/f$ and $R_q := R/q$. Obviously, an element of $R_q$ can be ...
- 425
1
vote
1
answer
354
views
How should I interpret this definition of the Dolev Yao Closure?
Please see the image below which represents an algebraic definition of the Dolev Yao Closure. From reading around, it appears this is BAN logic and that the lines mean "If you believe the above ...
- 113
2
votes
0
answers
108
views
Scyther related questions for handling/splitting values and verifying hashes
While implementing a protocol in Scyther, I need help with the following questions -
How do we split a particular message/variable into two parts in Scyther?
(For eg. if I have value R in my protocol ...
- 53
4
votes
3
answers
684
views
Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?
Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
- 425
0
votes
0
answers
67
views
Why is a protocol that is secure in the presence of a malicious adversary also secure in the presence of an augmented semi-honest adversary？
Proposition Let π be a protocol that securely computes a functionality f in the presence of malicious adversaries. Then π securely computes f in the presence of augmented semi-honest adversaries.
...
- 1
2
votes
1
answer
298
views
Does TLS use use two symmetric keys in the same way SSH does? One for client to server and one for server to client communication?
As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
- 73
5
votes
1
answer
2k
views
Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?
As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
- 73
2
votes
1
answer
183
views
Question about malicious security in protocol using OT
I was studying a protocol that used an OT and suddenly and suddenly I realize that I fail to imagine how a protocol using an OT could be malicious secure.
Suppose we have a protocol P that use an OT ...
- 21
2
votes
1
answer
122
views
Why do we always assume that the functions that the protocols can replicate are of the form $f:\{0,1\}^*\to\{0,1\}^*$?
Taking into account the vast literature of secure multiparty computation and secret sharing, there is a specific assumption that is made for the calculation of a rule function. The latter function ...
- 279
1
vote
1
answer
89
views
How should you manage keys to prevent lateral movement?
Let's say I'm designing a communications protocol that will be used by many pairs of devices to communicate amongst each other (between the pairs only).
Assuming the devices in the pair can ...
- 111
2
votes
1
answer
142
views
Altering a subroutine PPT's output to fit a reduction proof
I have a protocol that operates in the malicious setting which involves parties sending each other group elements $u\in \mathbb{G}$ of a specific form (For example, these are messages of the form $u=g^...
- 209
4
votes
1
answer
149
views
Distinguishers and next bit predictors without the uniform distribution
Consider a probability distribution $D$ over $n$ bit strings. Denote $U$ to be the uniform distribution over $n$ bit strings and $U_{n}$ to be the uniform distribution over integers $\{1, 2, \ldots, n\...
- 397
3
votes
2
answers
542
views
Tamarin-prover Issue on a Basic Diffie-Hellman Exchange
I am starting Tamarin prover, and it is hard to understand.
Here is a basic example of my issue:
First Code :
...
- 31
1
vote
2
answers
462
views
Who provides prime numbers for cryptographic protocols?
I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE.
Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
- 11
2
votes
0
answers
1k
views
How to reconstruct the static private key of a Diffie Hellman client, when I can freely choose A, g and p?
I am struggling with a Diffie Hellman crypto challenge based on a client that uses a static private key. My goal is to trick the client into revealing enough information to reconstruct the private key ...
- 121
0
votes
2
answers
126
views
Formal modeling and automated verification of a remote attestation protocol
I'm involved in the design of a communication protocol that requires mutual
remote attestation of both communicating parties prior to exchanging any other
data. We found several tools for symbolic ...
- 1
2
votes
1
answer
795
views
Security proof, Sequence of games
I hope someone can help me with the sequence of games security proof for protocols. Here are my questions:
What is the aim of each individual game? i.e. why can't we do this in one indistinguishable ...
- 327
14
votes
1
answer
3k
views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
- 352
0
votes
1
answer
33
views
Is establishing a secret key possible given this characteristic primitive?
I am wondering if there are any readily available solutions for the following problem:
I have a ring-topology network with several devices connected to it, some malicious, some legitimate. I want to ...
- 101
3
votes
1
answer
541
views
Does using Noise asynchronously weaken its security properties?
Can Noise be used asynchronously without weakening its security properties?
Specifically, there are two users, A and B, who communicate asynchronously by leaving messages for each other on an ...
- 105
2
votes
1
answer
728
views
Purpose of signing the signed prekey in X3DH?
I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm ...
- 23
-1
votes
1
answer
88
views
Which encryption mode is best for transport of random values?
I was wondering which block encryption mode or modes will be most appropriate for transport of random values of one-block length. Block length could be of size 256 bytes and transport is from person ...
- 111
1
vote
1
answer
47
views
Assumption of difficulty of attack in restricted short time
As well known, different assumptions of difficulty of some problems are used in provable security. E.g., if some crypto-scheme is breakable only in case the attacker finds preimages for hash function, ...
- 763
0
votes
2
answers
302
views
Random Oracle to prove an Authenticated DH protocol
I am trying to understand how they use the random oracle to solve the CDH. For example, in the security proof on page 7 of the following paper; A Lightweight Message Authentication Scheme for Smart ...
- 327
2
votes
1
answer
201
views
Extract adversary's secret input in simulation based security proofs
I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
- 41
0
votes
1
answer
778
views
Authentication protocol
Alice and Bob share a secret key K. Suppose that someone suggests the following methods to allow Alice to securely authenticate to Bob.
Bob generates a random message r, enciphers it using K under a ...
- 1
0
votes
1
answer
64
views
A modified question of Hazay & Lindell's Efficient Secure Two-Party protocols Book
Based on the question proposed on page 27, we propose a modified question as follows:
Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($...
1
vote
0
answers
89
views
Simulation-based proof in the semi-honest model when a party is corrupted
Full paper
Would you mind telling me based on the attached file, why in case 3(corrupted client B), the authors did not use the real input which is $S_B$ and instead they have generated $S'_B$? In ...
2
votes
1
answer
486
views
Information Theoretic Oblivious Transfer?
Do we have information theoretic oblivious transfer protocols that are that can not be broken by a computationally unbounded attacker?
- 67
0
votes
0
answers
53
views
Digital signature forging on a server, after entity authentication [duplicate]
Lets assume there is a guy called Ben, he contacts some server for a ticket number and the server returns a random number to him. Ben then signs that number and sends it back to the server, which ...
- 65