Questions tagged [protocol-analysis]

Protocol analysis is the detailed analysis of the security of an abstract or concrete cryptographic protocol.

Filter by
Sorted by
Tagged with
1
vote
2answers
112 views

Who provides prime numbers for cryptographic protocols?

I am currently writing a thesis about different cryptographic protocols like DH-Key exchange, TLS or IKE. Most of them rely on a prime number earlier or later, so for security reasons I wondered if ...
1
vote
0answers
37 views

How to reconstruct the static private key of a Diffie Hellman client, when I can freely choose A, g and p?

I am struggling with a Diffie Hellman crypto challenge based on a client that uses a static private key. My goal is to trick the client into revealing enough information to reconstruct the private key ...
0
votes
1answer
26 views

Formal modeling and automated verification of a remote attestation protocol

I'm involved in the design of a communication protocol that requires mutual remote attestation of both communicating parties prior to exchanging any other data. We found several tools for symbolic ...
1
vote
1answer
116 views

Security proof, Sequence of games

I hope someone can help me with the sequence of games security proof for protocols. Here are my questions: What is the aim of each individual game? i.e. why can't we do this in one indistinguishable ...
5
votes
1answer
239 views

What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
0
votes
1answer
24 views

Is establishing a secret key possible given this characteristic primitive?

I am wondering if there are any readily available solutions for the following problem: I have a ring-topology network with several devices connected to it, some malicious, some legitimate. I want to ...
0
votes
0answers
24 views

A combination of game-based and simulation definitions to analyse a protocol security

Consider the case we want to design a crypto protocol: $P_1$, say for verifiable computation. We define the protocol by designing a game and prove its security. Consider that we want to design another ...
3
votes
1answer
319 views

Does using Noise asynchronously weaken its security properties?

Can Noise be used asynchronously without weakening its security properties? Specifically, there are two users, A and B, who communicate asynchronously by leaving messages for each other on an ...
1
vote
1answer
139 views

Purpose of signing the signed prekey in X3DH?

I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm ...
0
votes
0answers
13 views

Why is Dolev Yao a local Inference System but blind signatures aren't?

I am currently working on this tutorial: https://www.infsec.cs.uni-saarland.de/wp-content/uploads/sites/2/2017/04/CK-fntpl-14.pdf However, I am struggling with the term "local inference system&...
-1
votes
1answer
81 views

Which encryption mode is best for transport of random values?

I was wondering which block encryption mode or modes will be most appropriate for transport of random values of one-block length. Block length could be of size 256 bytes and transport is from person ...
1
vote
1answer
37 views

Assumption of difficulty of attack in restricted short time

As well known, different assumptions of difficulty of some problems are used in provable security. E.g., if some crypto-scheme is breakable only in case the attacker finds preimages for hash function, ...
0
votes
2answers
105 views

Random Oracle to prove an Authenticated DH protocol

I am trying to understand how they use the random oracle to solve the CDH. For example, in the security proof on page 7 of the following paper; A Lightweight Message Authentication Scheme for Smart ...
2
votes
1answer
76 views

Extract adversary's secret input in simulation based security proofs

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
0
votes
1answer
133 views

Authentication protocol

Alice and Bob share a secret key K. Suppose that someone suggests the following methods to allow Alice to securely authenticate to Bob. Bob generates a random message r, enciphers it using K under a ...
0
votes
1answer
46 views

A modified question of Hazay & Lindell's Efficient Secure Two-Party protocols Book

Based on the question proposed on page 27, we propose a modified question as follows: Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($...
1
vote
0answers
34 views

Simulation-based proof in the semi-honest model when a party is corrupted

Full paper Would you mind telling me based on the attached file, why in case 3(corrupted client B), the authors did not use the real input which is $S_B$ and instead they have generated $S'_B$? In ...
1
vote
1answer
180 views

Information Theoretic Oblivious Transfer?

Do we have information theoretic oblivious transfer protocols that are that can not be broken by a computationally unbounded attacker?
0
votes
0answers
49 views

Digital signature forging on a server, after entity authentication [duplicate]

Lets assume there is a guy called Ben, he contacts some server for a ticket number and the server returns a random number to him. Ben then signs that number and sends it back to the server, which ...
2
votes
0answers
51 views

No freshness protection for single messages, but for the overall protocol

I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for ...
0
votes
1answer
37 views

Can I Implement a Well-Trusted Protocol with Well-Trusted Libraries in JavaScript securely?

Just for anyone reading this: DO NOT ROLL YOUR OWN ALGORITHM. Besides that, is implementing a well-trusted protocol with well-trusted algorithms and libraries a good idea? Is this likely to ...
0
votes
1answer
39 views

Order of OTs and commitments in Yao's Protocol for malicious adversaries

I was reading the book Efficient Secure Two-Party Protocols by Y. Lindell and C. Hazay. Page 92 of the book says This check is crucial and thus the order of first running the oblivious transfer and ...
0
votes
1answer
35 views

Constant number of rounds in Yao's Protocol for semi honest adversaries

According to me, every OT takes a constant number of rounds and since we have to do an OT for every input of one party, we'll have to do O(n) OTs which would correspond to O(n) rounds. But I have read ...
2
votes
1answer
195 views

What time is used in a TOTP counter?

I am currently working on a desktop TOTP client. From the TOTP spec at https://tools.ietf.org/html/rfc6238#section-4.1, the 6 digit OTP is generated from counter (in this case time). But what is "...
3
votes
1answer
216 views

From 2-round key-exchange protocol to a public-key encryption scheme CPA-secure

I have to solve this exercise and I really could use some help: Show that any 2-round key-exchange protocol (that is, where each party sends a single message) satisfying $Definition$ $9.1$ can be ...
10
votes
1answer
351 views

Contradiction to the Sequential Self-Composability of Black-Box Zero-Knowledge?

In short: it is well-known that black-box zero-knowledge protocols are sequentially self-composable. However, Goldreich and Krawczyk [GK90] present a protocol which is proven to be zero-knowledge (in ...
1
vote
0answers
146 views

How to prevent reflection attack in Needham-Schroeder in ECB mode?

We know that Needham-Schroeder is vulnerable to a reflection attack as shown here. How can I make it secure using ECB and without using timestamps? I need to modify the protocol. Otwan-Rees is a ...
3
votes
0answers
78 views

Equivalents of Yao's Xor lemma to rounds, or other hardness amplification methods?

Simple question: I just learn the existence of the great Yao's Xor lemma (see a quick sum-up at the end of this post). I'd like to use a similar argument, but instead of a simple function, I've a two ...
1
vote
0answers
119 views

Security of the Needham-Schroeder public key protocol after a minor adjustment

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer: We have the Needham Schroeder Public Key Protocol:...
2
votes
1answer
356 views

Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack

Trying to turn bookish knowledge to practical: Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, ...
1
vote
0answers
56 views

Is it necessary to transmit two or three points of an elliptic curve?

Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
7
votes
3answers
2k views

Finding flaw in cryptographic protocol

If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute. How about Finding a flaw in cryptographic protocol?! How can you ...
2
votes
1answer
63 views

Are the following asymmetric encryption schemes equivalent?

Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server. You'd prefer to not use simply a symmetric key for encryption, because if the machine ...
2
votes
0answers
92 views

Proving the lack of Perfect Forward Secrecy

In specific regarding the NSA's Key Exchange Algorithm, I read in an analysis of the protocol that perfect forward secrecy cannot be provided. Is there any way to prove or justify this? I couldn't ...
0
votes
1answer
65 views

Fairness and guaranteed output delivery

Why for achieving the fairness and guaranteed output delivery, less than a half of the parties should be corrupted? ($t < m/2$, where $t$ is the number of corrupted parties and $m$ is the total ...
-1
votes
1answer
58 views

Which of these deductions are true about the simulator and the adversary?

Which of these deductions make sense? The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
0
votes
1answer
76 views

Is function Deterministic or Probabilistic in the malicious security definition?

As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
3
votes
1answer
285 views

How does future secrecy fail for Signal group messaging?

In the paper More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema, the abstract claims that We additionally show that strong security properties, such as ...
1
vote
1answer
90 views

A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
3
votes
1answer
169 views

The interaction between the malicious Adversary and the Simulator and Real-Ideal' views

This example is from “Efficient Secure Two-Party Protocols-Carmit Hazay-Yehuda Lindell”. And the security proof of the above example is this: I have drawn a picture that is deduced from the above ...
2
votes
1answer
137 views

How to use Real-Ideal model in a specific scenario (two party with cloud)

I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
0
votes
1answer
78 views

Using the security definition in the malicious model to prove security in the semi honest model

Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm) Would you ...
2
votes
1answer
699 views

Getting a Keeloq manufacturer key

I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-...
0
votes
1answer
313 views

Basic encrypted custom protocol

I've been suggested to ask here instead of stackoverflow, so here I am. I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols ...
1
vote
1answer
170 views

Advantages of a TLS handshake over pre-shared public keys

Lets assume the following setup: A vendor manufactures IoT devices where each is able to generate an individual private/public key-pair. Only the public key is exposed, the private key is assumed to ...
55
votes
2answers
11k views

Is the software that uses PGP broken, or is it PGP itself?

PGP is all over the news (even on TV) and there seems to be a lot of confusion about it. For the time being, people face articles like Attention PGP users: new vulnerabilities require you to take ...
12
votes
3answers
592 views

Using weak hash functions to construct a stream cipher

I am in the awkward position of developing a secure encryption scheme that provides data-at-rest security for a very limited embedded system. The system is only guaranteed to have 4 MiB of memory (...
0
votes
1answer
92 views

Analysing communication complexity of a protocol

My question is more about the practical side of designing crypto. protocols and it is related to complexity. So, if you think it's irrelevant to this forum please kindly let me know and I will remove ...
3
votes
2answers
174 views

Fully homomorphic encryption with polynomials

I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea. Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
11
votes
0answers
2k views

Has Telegram security been significantly improved with MTProto 2.0?

Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...