Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
0
votes
1answer
53 views

How modern messengers encryption keys can't be hacked

I dont know is this question more like reverse-engineering or cryptographic. Why governments are hunting for encryptions keys? Aren't they delievering by the network the same as the encypted messages? ...
0
votes
0answers
17 views

Append-only log with secret metadata?

I need sets of encrypted records which need to be stored in an append-only log. It should be possible to efficiently recover just the headers of each record, so that specific records can be retrieved ...
0
votes
0answers
30 views

Importance of Backward and forward secrecy

Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy
1
vote
0answers
18 views

Why isn't Kerberos using temporary keys to avoid dictionary attacks?

In the Kerberos protocol, the user sends his ID, the server (Or ticket granting server) ID and a nonce value. The Key Distribution Center uses a key (I assume symmetrical) derived from the client's ...
1
vote
2answers
73 views

How to design a secure challange-response authentication protocol?

I am implementing a custom challenge-response protocol to authenticate a client to a server. Mutual authentication is not required, i.e. the server doesn't need to be authenticated to the client. The ...
11
votes
0answers
524 views

Crypto AG (Switzerland) - Which algorithms were used and how did the backdoors work?

Backstory Crypto AG was a company located in Switzerland that specialized in communication security. They produced a number of encryption machines (some similar to the infamous Enigma) used for ...
0
votes
0answers
38 views

Conditioning access to private key?

I would like to provide a public/private keypair to a user, but require that the user obtain an authorizing key before being allowed to use the private key. I don't want the authorizing party to have ...
0
votes
0answers
37 views

Secure equivalent for giving an unknown card, applied to magician's card tricks

I suspect that this is already something trivial, but I can't find the answer, probably because I don't know how to search the cryptographic primitive that refers to my problem. Imagine the typical ...
0
votes
1answer
68 views

Secret community forming based on zero-knowledge proof (IOT)

I want to discuss a simplistic scheme that comes to my mind, after I read about zero-knowledge proof and some fermentation time. I should mention that this is not born out of a business need or ...
1
vote
1answer
142 views

How to play Mental Skull

"Skull" or "Skull and Roses" is a table top game. The rules can be found here. I was thinking of how I could play this game P2P. At first it seemed easy: Each time I had to place a card face down I ...
0
votes
1answer
42 views

A modified question of Hazay & Lindell's Efficient Secure Two-Party protocols Book

Based on the question proposed on page 27, we propose a modified question as follows: Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($...
0
votes
0answers
31 views

Simulation-based proof in a particular scenario

Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public ...
1
vote
1answer
88 views

Simulator in semi-honest model in real/model paradigm

Does a simulator in the semi-honest model in IDEAL/REAL model paradigm necessarily make use of the corrupted party's input? For example, suppose a simulator given an input named $I$ and an output ...
1
vote
0answers
23 views

How to design a moderated, group for private messages?

I’m trying to figure out how I could create a private group that was P2P yet still allowed someone to moderate members (no public access to messages). I’m assuming standard hybrid encryption (RSA/EC + ...
1
vote
1answer
37 views

Difference between Verification and Public Key for Signature Schemes

This is a semantics Question. Typically, in many asymmetric schemes, for this question specifically, digital signatures, we see that designers describe the key given to the verifier as Public Key. ...
0
votes
0answers
39 views

Protocol for leader election [duplicate]

A leader should be selected by randomly choosing one of three parties A, B and C. The parties use the following protocol: $A → B: N_A$ (where $N_A$ is a nonce) $B → C:$ $N_{AB}$ $= N_A$ ^ $N_B$ (...
0
votes
1answer
72 views

What's the utility of the last two messages of Needham Schroeder Symmetric key protocol

The protocol works like this But I can't understand what's the utility of message 4 and 5, what do they protect from? They do not protect from replay attack if Ks gets compromised because B won't be ...
1
vote
1answer
74 views

Is there value in performing signature during key exchange?

I looked around the net, however I couldn't see anything authoritative on this. If one is using something like libsodium to perform key exchange (using x25519), is there value in using Ed25519/...
2
votes
1answer
48 views

Total anonymity against malicious agents

Suppose we have $N$ parties, two of whom are Alice and Bob, while some fraction of the remainder are malicious agents working together. We form a network where each party can pass an encrypted message ...
1
vote
0answers
41 views

Did key-wrap modes see actual use?

Is there an IETF standard-track protocol have IANA-registered IDs for deterministic authenticated encryption yet? If not, what's preventing their adoption? What changes to protocols will DAEs likely ...
1
vote
1answer
189 views

Getting unlimited amount of signatures - Risk?

Lets suppose we have a communication protocol given where messages $(1)$ and $(2)$ are send over an unsecure network. There are some prerequisites like distributed certificates etc., but they should ...
2
votes
0answers
45 views

No freshness protection for single messages, but for the overall protocol

I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for ...
0
votes
1answer
35 views

Can I Implement a Well-Trusted Protocol with Well-Trusted Libraries in JavaScript securely?

Just for anyone reading this: DO NOT ROLL YOUR OWN ALGORITHM. Besides that, is implementing a well-trusted protocol with well-trusted algorithms and libraries a good idea? Is this likely to ...
0
votes
1answer
52 views

Byzantine Agreement: Why does OM need f+1 rounds in a synchronous setting?

To get Byzantine Fault Tolerance in a synchronous model you can use an Oral Message Algorithm. For n > 3f+1 it gets an Byzantine agreement in ...
0
votes
1answer
44 views

Reference books in security and privacy preservation [closed]

I am looking for books or reference guides to learn and teach "cryptography, security and privacy preservation techniques"? I need some advice to good resources that I can use.
1
vote
1answer
48 views

Is there an algorithm that allows to distribute elements securely between parties?

Let's say we have a set of numbers $n = \{ 1, 2, 3, 4, 5, \ldots \}$ and $m$ players ($m < \operatorname{sizeof}(n)$, of course). I want to know if there's a way for all $m$'s to pick different ...
1
vote
1answer
164 views

Station-to-Station protocol questions

Basic Station-to-Station protocol which authenticates Bob and Alice if they safely shared their long-term asymmetric public keys. Alice sends Bob her public key $A_K$ Bob receives $A_K$ and computes ...
2
votes
1answer
126 views

Key derivation for AES-GCM using HKDF?

I have a system comprising N >1000 nodes. At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random ...
2
votes
1answer
224 views

Commitment to a polynomial

$A(x) \bmod B(x) = C(x)$ and $A(x) \bmod D(x) = E(x)$: A dealer knows $A(x)$ polynomial, which is a secret. He distributes $C(x)$ and $E(x)$ privately to $X$ and $Y$, respectively. $B(x)$ and $D(x)$ ...
2
votes
0answers
76 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
0
votes
1answer
45 views

specific scenario question relating to using NACL crypto_box in a protocol

Scenario 1: SenderA sends message1 to ReceiverB message1 is encrypted using NACL crypto_box using SenderA secret key and ReceiverB public key. we understand that the NACL crypto_box authenticator ...
2
votes
1answer
89 views

What time is used in a TOTP counter?

I am currently working on a desktop TOTP client. From the TOTP spec at https://tools.ietf.org/html/rfc6238#section-4.1, the 6 digit OTP is generated from counter (in this case time). But what is "...
2
votes
1answer
106 views

Are two keys derived from the same password vulnerable to a related key attack?

Background I am currently writing a password manager application. As usual, the passwords are put in a file encrypted using a user-entered password. I'm using the NaCl library but actually it's not ...
-1
votes
2answers
100 views

How to sell a piece of data through blockchain?

User A attempts to sell a piece of data D (byte level) to user B at price C through the blockchain. A and B do not trust each other. A worry: After the data D is delivered, B does not complete the ...
2
votes
0answers
26 views

Is there a scheme to force a party to generate a fresh key?

Is there a way to force one party to generate a fresh key, such that another party can be convinced that the key was freshly generated, without that party also knowing the key? I'm motivated by a ...
7
votes
3answers
156 views

Is there any protocol for proving that a message was written at a certain time?

Does there exist a way to cryptographically prove that a message was written at a certain time? I know that one can write messages in bitcoin transactions to that the message is preserved in the ...
1
vote
1answer
53 views

Privacy and warrants to obtain information

How could a site issue a `warrant'*, a document which: 1) Others can verify was issued from that site 2) Contains a date stamp, a named site and instructions which can be presented to a third site by ...
9
votes
3answers
2k views

Examples of protocols that are insecure when run concurrently

I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
0
votes
1answer
74 views

Is the following non-interactive zero-knowledge set membership protocol provable secure?

Given the following Zero-knowledge set-membership protocol https://infoscience.epfl.ch/record/128718/files/CCS08.pdf]. That is given in the following steps (Please refer to page 9). The Verifier -...
2
votes
1answer
146 views

Could time lock encryption be implemented through indistinguishable obfuscation?

In the paper "How to build time-lock encryption", the authors give a theoretical solution to build time-lock encryption using multi-linear based witness encryption and blockchain. However, an ...
1
vote
1answer
109 views

Does such a cryptographic protocol exist?

Persons A, B and C put x€, y€ and z€ in a pot, respectively. Suppose that anyone can make a withdrawal from the pot as long as they prove they have such a right and that the y€ that B deposited is ...
2
votes
2answers
139 views

Choice between appending or prepending nonces to ciphertexts

I understand that when using CTR mode it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant. However, ...
1
vote
1answer
76 views

Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags(non-deterministic)?

If we use non-deterministic MACs in encrypt-and-authenticate approach, is it secure?
0
votes
0answers
21 views

Efficient interactive proof of existence of path in a graph

Suppose Alice wants to convince Bob that she has found a path of length $M$ between vertices $v$ and $w$ in a certain graph. Bob can verify this claim in $O(M)$ time by having Alice send the list of ...
0
votes
0answers
86 views

Digital Signature Password verification

I currently have this TOFU protocol: First connection: Client generates salt and inputs a password Client saves salt Client hashes password with argon2 and salt Client generates Ed25519 keys Client ...
0
votes
0answers
78 views

When Shamir secret sharing used in one time pad scheme

In the following, all operations are defined over a finite field of prime order. Please note that what I'm explaining below is a part of a bigger protocol, however, to keep things simple I just ...
1
vote
0answers
61 views

Acceptable points of failure when applying encryption in an application [closed]

I am working an a Windows application that will encrypt and decrypt files using AES Encryption. The 32 byte key which is diversified and derived using a ATSHA204 unique serial number and some addition ...
5
votes
2answers
173 views

MPC protocols for high school kids

I was explaining MPC to a high school student. He was excited and asked me for some examples. The only ones that I could think of are by using garbled circuits. Are there some simple MPC protocols for ...
1
vote
1answer
92 views

Protocol Design for IoT devices having PSK using AES-GCM

Handshake: 1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv" 2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag ...
0
votes
2answers
77 views

cryptographically signed streaming data

On a high level the question is: how does one cryptographically sign streaming data? Here is the context: a number of people are continuously streaming data to me the data is public and does not ...

1
2 3 4 5
12