Questions tagged [protocol-analysis]

Protocol analysis is the detailed analysis of the security of an abstract or concrete cryptographic protocol.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Proof of reputation on a subject

I'm mulling over the need for a proof of reputation performed on a subject. When a guy starts to build a future he has to start here from scratch, his previous reputation does not matter, but it is ...
demo void gan's user avatar
0 votes
0 answers
38 views

Zero Knowledge 3-coloring, but we allow malicious V to challenge two edges

So I think I understand how zero knowledge protocol with 3-coloring is supposed to work. But in an attempt to increase soundness of the protocol, we allow the verifier V to challenge two edges per ...
HughJass24's user avatar
1 vote
0 answers
35 views

What is the maximum number of current members in a group CA that MKA can support?

The MACsec standard (IEEE 802.1AE-2018) states "The number of SCIs (and hence the number of SSCIs) is ultimately limited by the maximum number of current members in a group CA that MKA can ...
user1234's user avatar
0 votes
0 answers
31 views

How can I impersonate Bob without creating a new session

Good morning, I've been struggling with this protocol for the last few days and I'm out of ideas now. The goal is to impersonate Bob by just modifying or dropping packages. The attacker(me) is a Proxy ...
Goel77's user avatar
  • 1
1 vote
1 answer
39 views

How to construct a protocol for a trustless standardized paper test?

So the problem I'm exploring is basically how to run a paper exam (such as the SAT) in such a way that participants can be sure that their exams were graded fairly, meaning the exam hosts can't change ...
Sidharth Ghoshal's user avatar
1 vote
0 answers
61 views

Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$

Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order. Assume that I know how to construct an efficiently computable ...
Dimitri Koshelev's user avatar
2 votes
1 answer
80 views

Confirming understanding of security protocol modelled in Scyther

In university, I'm currently learning how to use Scyther to model security protocols. Currently I am trying to understand what is happening in an example protocol given to me which is: ...
hasin's user avatar
  • 77
2 votes
3 answers
596 views

Secure Multi-Party Computation (MPC) protocol with all dishonest parties

What if we consider an MPC protocol in which all parties are dishonest? Is it unattainable (even with allowing abort) or is it just meaningless to think about?
randoracle's user avatar
2 votes
0 answers
101 views

Automated Security Protocol tool that models algebraic operations

Are there any automated security protocol verification tools that model algebraic operations; specifically addition. I am familiar with AVISPA and Verifpal, and they are both great and user-friendly ...
Mona's user avatar
  • 177
1 vote
1 answer
73 views

Public key fingerprint verification for large groups

If you were designing: An open source client that offered E2E encryption for e.g. folder sharing between users Each user had public keys for signing (and separate public keys for encryption of ...
gecad41980's user avatar
3 votes
1 answer
96 views

Do ideal non-cyclotomic lattices provide better compression in lattice-based cryptography?

Let $f \in \mathbb{Z}[x]$ be an irreducible polynomial of degree $N$ and $q \in \mathbb{N}$. Consider the rings $R := \mathbb{Z}[x]/f$ and $R_q := R/q$. Obviously, an element of $R_q$ can be ...
Dimitri Koshelev's user avatar
1 vote
1 answer
266 views

How should I interpret this definition of the Dolev Yao Closure?

Please see the image below which represents an algebraic definition of the Dolev Yao Closure. From reading around, it appears this is BAN logic and that the lines mean "If you believe the above ...
Connor's user avatar
  • 113
2 votes
0 answers
75 views

Scyther related questions for handling/splitting values and verifying hashes

While implementing a protocol in Scyther, I need help with the following questions - How do we split a particular message/variable into two parts in Scyther? (For eg. if I have value R in my protocol ...
ankastic's user avatar
4 votes
3 answers
669 views

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
Dimitri Koshelev's user avatar
0 votes
0 answers
48 views

Why is a protocol that is secure in the presence of a malicious adversary also secure in the presence of an augmented semi-honest adversary?

Proposition Let π be a protocol that securely computes a functionality f in the presence of malicious adversaries. Then π securely computes f in the presence of augmented semi-honest adversaries. ...
Peng Nie's user avatar
2 votes
1 answer
183 views

Does TLS use use two symmetric keys in the same way SSH does? One for client to server and one for server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
nilch's user avatar
  • 73
5 votes
1 answer
2k views

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
nilch's user avatar
  • 73
2 votes
1 answer
114 views

Question about malicious security in protocol using OT

I was studying a protocol that used an OT and suddenly and suddenly I realize that I fail to imagine how a protocol using an OT could be malicious secure. Suppose we have a protocol P that use an OT ...
miky's user avatar
  • 21
2 votes
1 answer
119 views

Why do we always assume that the functions that the protocols can replicate are of the form $f:\{0,1\}^*\to\{0,1\}^*$?

Taking into account the vast literature of secure multiparty computation and secret sharing, there is a specific assumption that is made for the calculation of a rule function. The latter function ...
Hunger Learn's user avatar
1 vote
1 answer
86 views

How should you manage keys to prevent lateral movement?

Let's say I'm designing a communications protocol that will be used by many pairs of devices to communicate amongst each other (between the pairs only). Assuming the devices in the pair can ...
ijustlovemath's user avatar
2 votes
1 answer
131 views

Altering a subroutine PPT's output to fit a reduction proof

I have a protocol that operates in the malicious setting which involves parties sending each other group elements $u\in \mathbb{G}$ of a specific form (For example, these are messages of the form $u=g^...
yacovm's user avatar
  • 209
4 votes
1 answer
122 views

Distinguishers and next bit predictors without the uniform distribution

Consider a probability distribution $D$ over $n$ bit strings. Denote $U$ to be the uniform distribution over $n$ bit strings and $U_{n}$ to be the uniform distribution over integers $\{1, 2, \ldots, n\...
BlackHat18's user avatar
3 votes
2 answers
301 views

Tamarin-prover Issue on a Basic Diffie-Hellman Exchange

I am starting Tamarin prover, and it is hard to understand. Here is a basic example of my issue: First Code : ...
Hlen's user avatar
  • 31
1 vote
2 answers
328 views

Who provides prime numbers for cryptographic protocols?

I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE. Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
Greybound's user avatar
2 votes
0 answers
873 views

How to reconstruct the static private key of a Diffie Hellman client, when I can freely choose A, g and p?

I am struggling with a Diffie Hellman crypto challenge based on a client that uses a static private key. My goal is to trick the client into revealing enough information to reconstruct the private key ...
Demento's user avatar
  • 121
0 votes
2 answers
103 views

Formal modeling and automated verification of a remote attestation protocol

I'm involved in the design of a communication protocol that requires mutual remote attestation of both communicating parties prior to exchanging any other data. We found several tools for symbolic ...
iures's user avatar
  • 1
2 votes
1 answer
583 views

Security proof, Sequence of games

I hope someone can help me with the sequence of games security proof for protocols. Here are my questions: What is the aim of each individual game? i.e. why can't we do this in one indistinguishable ...
Mona's user avatar
  • 177
11 votes
1 answer
2k views

What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
Expectator's user avatar
0 votes
1 answer
31 views

Is establishing a secret key possible given this characteristic primitive?

I am wondering if there are any readily available solutions for the following problem: I have a ring-topology network with several devices connected to it, some malicious, some legitimate. I want to ...
bernd feinman's user avatar
3 votes
1 answer
471 views

Does using Noise asynchronously weaken its security properties?

Can Noise be used asynchronously without weakening its security properties? Specifically, there are two users, A and B, who communicate asynchronously by leaving messages for each other on an ...
8n8's user avatar
  • 105
2 votes
1 answer
591 views

Purpose of signing the signed prekey in X3DH?

I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm ...
Soham Roy's user avatar
-1 votes
1 answer
85 views

Which encryption mode is best for transport of random values?

I was wondering which block encryption mode or modes will be most appropriate for transport of random values of one-block length. Block length could be of size 256 bytes and transport is from person ...
Haseeb Saeed's user avatar
1 vote
1 answer
45 views

Assumption of difficulty of attack in restricted short time

As well known, different assumptions of difficulty of some problems are used in provable security. E.g., if some crypto-scheme is breakable only in case the attacker finds preimages for hash function, ...
Mikhail Koipish's user avatar
0 votes
2 answers
237 views

Random Oracle to prove an Authenticated DH protocol

I am trying to understand how they use the random oracle to solve the CDH. For example, in the security proof on page 7 of the following paper; A Lightweight Message Authentication Scheme for Smart ...
Mona's user avatar
  • 177
2 votes
1 answer
173 views

Extract adversary's secret input in simulation based security proofs

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
WYC's user avatar
  • 41
0 votes
1 answer
634 views

Authentication protocol

Alice and Bob share a secret key K. Suppose that someone suggests the following methods to allow Alice to securely authenticate to Bob. Bob generates a random message r, enciphers it using K under a ...
JFow16's user avatar
  • 1
0 votes
1 answer
53 views

A modified question of Hazay & Lindell's Efficient Secure Two-Party protocols Book

Based on the question proposed on page 27, we propose a modified question as follows: Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($...
Amirhossein Adavoudi's user avatar
1 vote
0 answers
79 views

Simulation-based proof in the semi-honest model when a party is corrupted

Full paper Would you mind telling me based on the attached file, why in case 3(corrupted client B), the authors did not use the real input which is $S_B$ and instead they have generated $S'_B$? In ...
Amirhossein Adavoudi's user avatar
2 votes
1 answer
382 views

Information Theoretic Oblivious Transfer?

Do we have information theoretic oblivious transfer protocols that are that can not be broken by a computationally unbounded attacker?
Severus's user avatar
  • 57
0 votes
0 answers
53 views

Digital signature forging on a server, after entity authentication [duplicate]

Lets assume there is a guy called Ben, he contacts some server for a ticket number and the server returns a random number to him. Ben then signs that number and sends it back to the server, which ...
Anan's user avatar
  • 65
2 votes
0 answers
63 views

No freshness protection for single messages, but for the overall protocol

I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for ...
user avatar
0 votes
1 answer
55 views

Can I Implement a Well-Trusted Protocol with Well-Trusted Libraries in JavaScript securely?

Just for anyone reading this: DO NOT ROLL YOUR OWN ALGORITHM. Besides that, is implementing a well-trusted protocol with well-trusted algorithms and libraries a good idea? Is this likely to ...
user avatar
0 votes
1 answer
52 views

Order of OTs and commitments in Yao's Protocol for malicious adversaries

I was reading the book Efficient Secure Two-Party Protocols by Y. Lindell and C. Hazay. Page 92 of the book says This check is crucial and thus the order of first running the oblivious transfer and ...
Severus's user avatar
  • 57
0 votes
1 answer
47 views

Constant number of rounds in Yao's Protocol for semi honest adversaries

According to me, every OT takes a constant number of rounds and since we have to do an OT for every input of one party, we'll have to do O(n) OTs which would correspond to O(n) rounds. But I have read ...
Severus's user avatar
  • 57
2 votes
1 answer
585 views

What time is used in a TOTP counter?

I am currently working on a desktop TOTP client. From the TOTP spec at https://www.rfc-editor.org/rfc/rfc6238#section-4.1, the 6 digit OTP is generated from counter (in this case time). But what is &...
M4X_'s user avatar
  • 145
3 votes
1 answer
627 views

From 2-round key-exchange protocol to a public-key encryption scheme CPA-secure

I have to solve this exercise and I really could use some help: Show that any 2-round key-exchange protocol (that is, where each party sends a single message) satisfying $Definition$ $9.1$ can be ...
quaqua's user avatar
  • 63
10 votes
1 answer
447 views

Contradiction to the Sequential Self-Composability of Black-Box Zero-Knowledge?

In short: it is well-known that black-box zero-knowledge protocols are sequentially self-composable. However, Goldreich and Krawczyk [GK90] present a protocol which is proven to be zero-knowledge (in ...
Xiao Liang's user avatar
1 vote
0 answers
225 views

How to prevent reflection attack in Needham-Schroeder in ECB mode?

We know that Needham-Schroeder is vulnerable to a reflection attack as shown here. How can I make it secure using ECB and without using timestamps? I need to modify the protocol. Otwan-Rees is a ...
user415612's user avatar
3 votes
0 answers
150 views

Equivalents of Yao's Xor lemma to rounds, or other hardness amplification methods?

Simple question: I just learn the existence of the great Yao's Xor lemma (see a quick sum-up at the end of this post). I'd like to use a similar argument, but instead of a simple function, I've a two ...
Léo Colisson's user avatar
1 vote
0 answers
194 views

Security of the Needham-Schroeder public key protocol after a minor adjustment

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer: We have the Needham Schroeder Public Key Protocol:...
CowNorris's user avatar
  • 111