Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [protocol-analysis]

Protocol analysis is the detailed analysis of the security of an abstract or concrete cryptographic protocol.

6
votes
3answers
2k views

Finding flaw in cryptographic protocol

If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute. How about Finding a flaw in cryptographic protocol?! How can you ...
2
votes
1answer
51 views

Are the following asymmetric encryption schemes equivalent?

Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server. You'd prefer to not use simply a symmetric key for encryption, because if the machine ...
2
votes
0answers
34 views

Proving the lack of Perfect Forward Secrecy

In specific regarding the NSA's Key Exchange Algorithm, I read in an analysis of the protocol that perfect forward secrecy cannot be provided. Is there any way to prove or justify this? I couldn't ...
0
votes
1answer
39 views

Fairness and guaranteed output delivery

Why for achieving the fairness and guaranteed output delivery, less than a half of the parties should be corrupted? ($t < m/2$, where $t$ is the number of corrupted parties and $m$ is the total ...
-1
votes
1answer
41 views

Which of these deductions are true about the simulator and the adversary?

Which of these deductions make sense? The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
0
votes
1answer
42 views

Is function Deterministic or Probabilistic in the malicious security definition?

As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
3
votes
1answer
79 views

How does future secrecy fail for Signal group messaging?

In the paper More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema, the abstract claims that We additionally show that strong security properties, such as ...
1
vote
1answer
50 views

A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
3
votes
1answer
65 views

The interaction between the malicious Adversary and the Simulator and Real-Ideal' views

This example is from “Efficient Secure Two-Party Protocols-Carmit Hazay-Yehuda Lindell”. And the security proof of the above example is this: I have drawn a picture that is deduced from the above ...
1
vote
1answer
55 views

How to use Real-Ideal model in a specific scenario (two party with cloud)

I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
0
votes
1answer
32 views

Using the security definition in the malicious model to prove security in the semi honest model

Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm) Would you ...
2
votes
1answer
105 views

Getting a Keeloq manufacturer key

I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-...
1
vote
0answers
57 views

Universal Composability

What's the magic of Universal Composability security framework? And how can UC be used in the analysis of practical protocols?
0
votes
1answer
64 views

Basic encrypted custom protocol

I've been suggested to ask here instead of stackoverflow, so here I am. I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols ...
0
votes
0answers
19 views

Interpretation of the PBFT paper by Castro and Likov

I find the following paragraph at the end of pag.4 of the PBFT paper by Castro and Likov confusing: This is true because $prepared(m,v,n,i)$ and $|\mathcal{R}|=3f+1$ imply that at least $f+1$ non-...
1
vote
1answer
68 views

Advantages of a TLS handshake over pre-shared public keys

Lets assume the following setup: A vendor manufactures IoT devices where each is able to generate an individual private/public key-pair. Only the public key is exposed, the private key is assumed to ...
50
votes
2answers
9k views

Is the software that uses PGP broken, or is it PGP itself?

PGP is all over the news (even on TV) and there seems to be a lot of confusion about it. For the time being, people face articles like Attention PGP users: new vulnerabilities require you to take ...
11
votes
3answers
257 views

Using weak hash functions to construct a stream cipher

I am in the awkward position of developing a secure encryption scheme that provides data-at-rest security for a very limited embedded system. The system is only guaranteed to have 4 MiB of memory (...
0
votes
0answers
159 views

Unknown key-share attack

In the unknown key-share attack a dishonest entity C tempts two honest entities A and B to establish a key shared between them. At the end of the attack, A believes she shares the key with B, but B ...
0
votes
1answer
61 views

Analysing communication complexity of a protocol

My question is more about the practical side of designing crypto. protocols and it is related to complexity. So, if you think it's irrelevant to this forum please kindly let me know and I will remove ...
2
votes
2answers
73 views

Fully homomorphic encryption with polynomials

I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea. Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
4
votes
0answers
829 views

Has Telegram security been significantly improved with MTProto 2.0?

Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...
1
vote
1answer
47 views

Why would we use a Key Agreement Protocol if we already have a key between 2 entities?

For example in my course there is this protocol : Initialisation: A and B are sharing a symmetric key S. (1) A -> B: Ra ; A generates a random number and sends it to A (2) A <- B: Rb ; B does ...
2
votes
1answer
124 views

Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
2
votes
1answer
74 views

GCM and decrypting with Krack

I'm trying to understand how Krack works on GCM. I thought that looking at GCM would be easier since it's a full break and the video shows a tool that is able to decrypt everything. I see that the IV ...
2
votes
0answers
89 views

List of security protocols that have been proved to have bugs using formal methods

I'm looking for articles about finding bugs in security protocols using formal methods so I can test them using tools like proverif I've searched a lot of references but most of them seem to be about ...
0
votes
1answer
52 views

Proving knowledge of a value and computation that uses it

Alice picks random points P and Q in a group where DLP w.r.t. a base point G is hard (I am ...
2
votes
3answers
368 views

Security concern with TOTP

I am pretty new to cryptography and I have been studying up on TOTP (Time Based OTP) and while I have learnt how the computation works, I'm unable to figure out why using TOTP makes a system more ...
1
vote
0answers
157 views

what is scyther code for this protocol? [closed]

I wrote the following protocol. I wrote the code. I do not know how to write the rest of the code. please guide me. usertype SessionKey; usertype TimeStamp; hashfunction H1; macro sessionkey = H();...
0
votes
0answers
47 views

Prove of identity by signature scheme

Let $\Pi = (\mathrm{Gen}, \mathrm{Sign}, \mathrm{Vrfy})$ be a signature scheme, which is existentially unforgeable under adaptive chosen-message attacks. (Assume such a scheme exists.) Consider the ...
1
vote
0answers
850 views

Is the crypto riot.im claims to use safe? [closed]

My friends want to communicate with me using “about.riot.im”, I tried to research them and the protocols they claim to use and I only found their own websites promoting it, so the whole thing seems ...
0
votes
1answer
92 views

Prove that this protocol based on square roots modulo $n$ is zero knowledge

Consider the following (zero knowledge) protocol based on the hardness of finding square roots modulo $n$. The Prover states that he knows a square root $x$ modulo $n$ of $y$, i.e., $y = x^2 \pmod n$. ...
8
votes
1answer
821 views

Free Start Collision In SHA-3

Given that the five sub-functions that comprise SHA-3 are reversible an individual can produce specific outputs of their choosing. The following is to my knowledge an example of a free start collision ...
2
votes
1answer
61 views

How do I construct and use the Okamoto protocol simulator?

Proof Okamoto protocol has zero knowledge if we constructing a suitable simulator I found the following schema of Okamoto: But I don't really understand —how can I construct such a simulator and ...
5
votes
2answers
185 views

Modelling broadcast functionality in Universally Composable Framework

I'm studying the UC framework by Canetti. While I understand the basic idea, there are still a lot of details that I need to work through. One thing that's puzzling me is how to achieve concurrency ...
-1
votes
1answer
126 views

Use of extra AES on top of SSL protocol [closed]

A client is communicating with a server through https, which should provide them with the security they need. I would like to add an extra layer of security. The protocol would look something like : ...
1
vote
0answers
158 views

Design a simplified version of the protocol for secure addition

To learn secure multiparty communication, I want to design a simplified protocol for secure addition, where instead of receiving two (random) numbers in $Z_p$, a player only receives a single (random) ...
-6
votes
1answer
87 views

Is a symmetric cryptographic code secure if only the sender and recipient know the method used to encrypt? [closed]

I recently designed an encoding method that I'm fairly sure is unique. Is it universally secure, provided that anyone intercepting the message doesn't know anything about how it was encrypted? Could ...
4
votes
0answers
79 views

What's the difference between game-based and simulation-based security? [duplicate]

What's the difference between game-based and simulation-based security? When we use the simulation-based, how to construct the simulator based on the adversary?
1
vote
2answers
354 views

Properties of a single-message protocol using AES

The following protocol is used for providing data confidentiality between sender and receiver: $$ \text{sender} \rightarrow \text{receiver}: E_k(m \mathbin\Vert \mathrm{ID}_s\mathbin\Vert \mathrm{...
1
vote
0answers
68 views

What is Difference between Managed Object and Object Type in KMIP?

I currently study and develop the KMIP. I test the sample(Part of sample message encode(Beispiel Nachricht Enkodierung)) with opensource, KMIP4J. I think Symmetric Key(Object Type) in sample is ...
1
vote
1answer
406 views

Sigma protocol to prove that the prover knows how open a commitment

Sigma protocol to prove that the prover knows how open a commitment. Consider the unconditionally hiding commitment scheme based on discrete log, i.e., the public key $p_k = (p,g,y)$, where $\langle ...
2
votes
1answer
339 views

why does TTLV encoding in KMIP require padding?

I study the KMIP in OASIS standard, I need some help. Integers, Enumerations, and Intervals in KMIP length shall be padded with four bytes. the reason for padding in kmip is need to match the right ...
4
votes
1answer
131 views

ZK proof of “element in subgroup” protocol

Consider the following protocol for $P$ and $V$ : Note: The multiplicative group is $Z_p^*$ and $p$ is prime. Note: The protocol is for proving that $x \in \langle \alpha \rangle$. Input to $P$ and ...
5
votes
1answer
226 views

Geometric Cryptography and Zero-Knowledge Proofs

Trying to understand zero-knowledge proofs, I came across this page, which provides an excellent example of a simple cryptographic protocol. I will reproduce the protocol here for the sake of ...
1
vote
1answer
307 views

Showing formally that DDH hardness implies CDH hardness

As part of homework problem, I need to show that DDH hardness implies CDH hardness. Assume $CDH$ is hard relative to some group generator. The intuition is pretty clear, so I've made the trivial ...
0
votes
0answers
206 views

How does whatsapp transfer privatekey between clients

Whatsapp uses signal protocol and it claims to never leave private key from client. However whatsapp supports multiple clients (chrome app - Web, and phone client (android/ios)) if message was sent ...
0
votes
1answer
76 views

Is battery usage an important parameter for mobile based key exchange protocol?

I am studying a key exchange protocol based on public key cryptography technique specifically designed for mobile devices. I noticed there is no importance given to battery usage by these protocols. ...
1
vote
1answer
112 views

Simplified universal composability (SUC): can I model the use of encryption? Can I prove fairness?

I have been reading Canetti, Cohen and Lindell's paper, "A Simpler Variant of Universally Composable Security for Standard Multiparty Computation", and there are some parts that I didn't understand. ...
0
votes
0answers
37 views

Confusion with encryption explanation method

I was reading about Defective Sign & encrypt from the below link http://collaboration.cmc.ec.gc.ca/science/rpn/biblio/ddj/Website/articles/DDJ/2001/0111/0111b/0111b.htm And in their explanation ...