Questions tagged [protocol-design]
Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).
697
questions
1
vote
1
answer
70
views
How often do Double ratchet in Signal protocol update DH ratchet key
I'm trying to understand the specification behind doubleratchet algorithm, item 2.4. Double Ratchet.
According to wiki:
A client renews session key material in interaction with the remote
peer using ...
- 409
1
vote
1
answer
60
views
Signal protocol: are One-time prekeys derived from Signed Prekey or just randomly generated?
Do signal protocol derive One-time prekeys from Signed Prekey with some KDF or are they just randomly generated in the same way as Signed Prekey?
- 409
0
votes
0
answers
33
views
What is best $1$ out $2$ oblivious transfer?
There are a lot of oblivious transfer algorithm. What is the best? It would be good if it were malicious secure, but that is not necessary, if this make protocol very difficult/slow. This protocol ...
- 175
0
votes
0
answers
28
views
Signature algorithm/protocol with fillable gaps?
Consider how a cheque-book works: Alice goes to the Bank, and gets some incomplete messages, like ...
- 101
3
votes
0
answers
74
views
Real-world protocols based on pairings such that the number of additions in $\mathbb{G}_1$ is equal to the number of additions in $\mathbb{G}_2$
Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \...
- 395
1
vote
0
answers
35
views
What is the maximum number of current members in a group CA that MKA can support?
The MACsec standard (IEEE 802.1AE-2018) states "The number of SCIs (and hence the number of SSCIs) is ultimately limited by the maximum number of current members in a group CA that MKA can ...
- 11
0
votes
0
answers
31
views
How can I impersonate Bob without creating a new session
Good morning,
I've been struggling with this protocol for the last few days and I'm out of ideas now. The goal is to impersonate Bob by just modifying or dropping packages. The attacker(me) is a Proxy ...
- 1
0
votes
0
answers
32
views
Protocol security
This protocol is designed to establish a session key K'AB between two parties without the interaction with a server. In this case, the key KAB is a long-term key shared between Alice and Bob. I am ...
- 1
5
votes
1
answer
80
views
difference between Covert and Security with abort
In the realm of secure Multi-Party Computation (MPC) schemes, there exist two fundamental concepts known as the covert adversary model and security with abort. From what I understand, both of these ...
- 482
2
votes
2
answers
69
views
plain text size prediction
In your opinion, is the correlation between the length of the ciphertext and the decrypted text (even if it is approximate) a cipher vulnerability? Or is there a solution to this problem outside of it?...
- 23
2
votes
1
answer
95
views
Parameters needed for Chaum-Pedersen Protocol
I've came across a Stackexchange question about the Chaum-Pedersen Protocol which is based on the generalised schnorr protocol. As I understand it, it uses discrete logs and cyclic groups of prime ...
- 21
0
votes
0
answers
17
views
Group keys with revocation in publish/subscribe IoT
I have a group of subscribers who are subscribed to a message broker in an IoT setting, let's say to the topic 'sensor/temperature'. Now, I want to create a public/private key pair in such a way that ...
1
vote
1
answer
39
views
How to construct a protocol for a trustless standardized paper test?
So the problem I'm exploring is basically how to run a paper exam (such as the SAT) in such a way that participants can be sure that their exams were graded fairly, meaning the exam hosts can't change ...
- 187
2
votes
1
answer
85
views
Is there any secure deterministic two-party computation protocol?
The notion of security considered here is privacy. Is there a secure two-party protocol does not rely on randomness at all when considering passive adversaries (or active adversaries)? If the answer ...
- 21
5
votes
2
answers
180
views
Authenticated encryption scheme for one-way radio telemetry
I'm designing an authenticated encryption scheme for a noninteractive one-way radio telemetry system. A number of devices in the field send back telemetry to a base station periodically, but no ...
- 3,527
1
vote
0
answers
38
views
Is there a type of method where multiple keys are involved, and final key produces invalid results unless all prior keys are used?
I'm looking for a mechanism for a type of cert/key signing, where multiple keys need to sign/encrypt something, and a final key/method does not product a valid confirmation unless all those keys did ...
- 111
1
vote
1
answer
69
views
Does game-theoretical fairness work in when the goal of one party is randomness
When we take the coin flip in Blum's algorithm in "Coin flipping by telephone a protocol for solving impossible problems", where Alice and Bob both want ownership over the same car, then one ...
- 13
1
vote
0
answers
166
views
ED25519, RSA, Post Quantum Encryption confirmation
I am working on a chat feature to use both post quantum cryptography along with RSA, and want to confirm my thoughts.
As these algorithms haven't been fully battle tested, I have decided to use a ...
- 11
3
votes
0
answers
57
views
On the Adaptive Security of MPC Protocols
In adversarial context of MPC, the corruption behavior
refers to the assumptions about the corrupted parties’ deviation level from the protocol
specification. Three main types of corruption behaviors ...
- 538
1
vote
0
answers
61
views
Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$
Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order.
Assume that I know how to construct an efficiently computable ...
- 395
1
vote
0
answers
50
views
Pseudo-isomorphic graphs
Some famous cryptographical protocols rely on the construction of graphs $G_i= (V_i, E_i)$ for $i=0,1$ that are not isomorphic. For the safety of this protocol, it is central that one can not easily ...
1
vote
0
answers
78
views
How to compute the absolute value of a float number using only addition and multiplication (or using an and-xor circuit)?
Hi I am trying to calculate the abs or a float number $x$, however, I want to apply this operation when $x$ is under fully homomorphic encryption (typically CKKS ...
- 11
1
vote
1
answer
116
views
Question about Secure Multi-Party Computation
I am doing research about Non-interactive Secure Multi-party Computation and encounter a dilemma that I am not quite sure if it is possible and wonder if there are better thoughts that could help.
...
- 13
0
votes
1
answer
53
views
Honest programming language for malicious adversaries in MPC protocols
One method to create a secure MPC protocol against malicious adversaries is to create a secure protocol against semi-honest adversaries and then add some zero-knowledge proofs to ensure that the ...
- 25
1
vote
0
answers
28
views
Does the private blockchain have to follow client-server model when considering BFT?
I'm a newbie, currently interested in data security & integrity.
I'm quite new to blockchain and distributed system theories, and suffering from some unclear doubts/questions on the fault-tolerant ...
- 11
0
votes
0
answers
15
views
Will this RSA-based cross-signing schema work for preventing forgery?
I am a web developer and a newbie in cryptography, so my question may sound not very related to this community, let me know if so, and where to ask.
Context is a distributed application, to exchange ...
- 113
1
vote
1
answer
73
views
Public key fingerprint verification for large groups
If you were designing:
An open source client that offered E2E encryption for e.g. folder sharing between users
Each user had public keys for signing (and separate public keys for encryption of ...
- 11
3
votes
0
answers
58
views
How to create an encryption such that we need two keys to decrypt, while one key is derivable from the other if I have the secret
Suppose I have some plaintext $M$, and I want to have some process $f$ to make ciphertext $M':=f(M,s)$, where $s$ is some secret. The ciphertext $M'$ can be decrypted by using some decryption process $...
- 31
1
vote
0
answers
32
views
Is there a scheme for voting on decrypting a message with a variable voter count?
I am wondering if there might be a scheme for the following scenario: Let's suppose a government wants a truly democratic intelligence agency. For this the government publishes all intelligence ...
- 11
0
votes
0
answers
49
views
Oblivious transfer protocol to retrieve k elements
The sever holds the N encrypted elements, each element is associated with an index (unencrypted). The receiver wants to retrieve only k-out-N elements using k-out-N OT.
The motivation for using OT is ...
- 1
1
vote
1
answer
40
views
How would you design an API server to store user sercrets?
This is not for a production application, but just my exploration to help me understand cryptography.
At the simplest level, I want to design a key-value store for user secrets.
This is exposed over ...
user104510
0
votes
1
answer
105
views
Shamir Secret Sharing over an unsecure channel for a protocol design
Let's suppose that we have two parties, $A$ and $B$ that are using a Shamir Secret Sharing scheme with $k=3$. $A$ holds the points $[x_1, f(x_1)]$ and $[x_2, f(x_2)]$ while $B$ holds $[x_3, f(x_3)]$ ...
- 13
1
vote
0
answers
57
views
Using multiple asymmetric keys as backups for one another
I've been thinking about ways to take advantage of multiple asymmetric encryption schemes so that each key could be a backup to the others in case of cryptanalysis of one given scheme.
Those public ...
- 11
0
votes
0
answers
58
views
Bloackchain e-voting: verfiy that voter is allowed to vote but didnt already voted, without reaviling his identity
I am trying to make a e-voting system based on blockchain and I am trying to think about a way that i can verify that a vote is legal without reavling the identity of the voter.
One of the solutions ...
- 21
0
votes
0
answers
123
views
How to encrypt keys in a content-addressable store, for lookup and enumeration
I'm implementing a content-addressable file store - similar to a key/value store, but the key is always a hash of the value.
I'd like to build an encryption layer for it, to hide what data is being ...
0
votes
1
answer
52
views
Would a consensus algorithm like the one I describe work?
Given n nodes(miners/validators),
Every unspent transaction output is broadcasted to all n nodes.
Each node will select a batch of transactions and add it to their
block. The specific mechanism of ...
- 1
1
vote
1
answer
265
views
How should I interpret this definition of the Dolev Yao Closure?
Please see the image below which represents an algebraic definition of the Dolev Yao Closure. From reading around, it appears this is BAN logic and that the lines mean "If you believe the above ...
- 113
0
votes
1
answer
51
views
How to know who is an attacker in byzantine broadcast?
2 requirements of Byzantine broadcast (consistency and validity) only state honest node should output certain bit without mentioning what should malicious nodes do.
How do we know the identity of each ...
- 122
1
vote
1
answer
120
views
Why lattice based cryptographic schemes usually are not bandwidth efficient?
The question is mainly stated in the title. I am new to lattices and I have a basic understanding of them but not something in depth. I was watching a presentation of of a VSS (Verifiable Secret ...
- 878
0
votes
2
answers
109
views
Encryption algorithm where proving the decryption is equal to spoiling the key?
Is there an encryption algorithm or MAC algorithm for which NO zero-knowledge-proof exists, provably? I want people who want to prove that a ciphertext decrypts into some plaintext to have to spoil ...
- 125
1
vote
1
answer
171
views
Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?
Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
- 15.2k
0
votes
0
answers
32
views
Verifying meeting by sending same signed random number to central authority?
I am trying to develop a simple protocol for two users to verify (with respect to a trusted central authority) that they have (intentionally) met/communicated with each other.
My idea was this: Users ...
- 113
0
votes
1
answer
71
views
Short description of encryption methods? [closed]
I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them.
Hash then encrypt
MAC then encrypt
Encrypt and MAC
Encrypt then MAC
- 1
1
vote
2
answers
151
views
Is there a winning strategy based on this coin-flipping protocol?
Given the coin flipping protocol:
A chooses $a \in_R \{0,1\}$ and computes $commit(a,r)$. She sends $commit(a,r)$ to B.
B chooses $b \in_R \{0,1\}$ and sends $b$ to A.
A sends $open(a,r)$ and B ...
- 383
1
vote
2
answers
145
views
Proving that a protocol is not attackable
Consider the following protocol:
$A\rightarrow B: \{N_A,A\}_{pk(B)}$
$B\rightarrow A: \{N_B,N_A\}_{pk(A)}$
$A\rightarrow B: hash(N_B, A, B)$
where it is intended that when either $A$ or $B$ has ...
- 151
3
votes
1
answer
184
views
What is the purpose of the WireGuard handshake mac1 field?
The mac1 field in the WireGuard handshake messages is populated as:
...
1
vote
1
answer
231
views
Version rollback attack prevention in TLS 1.2?
Are there any methods to prevent version rollback attack while using TLS 1.2 (apart from disabling lower versions)? I've read about how TLS 1.3 provides a downgrade protection mechanism which is ...
4
votes
3
answers
669
views
Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?
Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
- 395
1
vote
0
answers
33
views
Developing a Simmetric Key Distribution protocol to use with rfc6238
I'm trying to develop a Key Distribution Protocol to share symmetric keys in RFC 6238 (OTP).
I started with RFC 6063, but this protocol is developed over old and known insecure algorithms like PBKDF ...
0
votes
0
answers
36
views
Password Authenticated Key Exchange Protocol
This problem appeared in a past exam paper.
In PAKE (password authenticated key exchange) protocols, $A$ and $B$ authenticate each
other by knowledge of a shared password that is too weak to allow an ...
- 151