Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
2
votes
0answers
60 views

Why can proverif not find value that I just created?

I have a really simple ProVerif problem. My current proverif code looks like this: ...
1
vote
0answers
39 views

Scheme where earlier hashes provide "hints" to find same or nearby hashes

I am looking for a hash methodology that allows previous hashes to provide "hints" to find same or nearby hashes: if I expect to find a message $M = P + U$ consisting of private $P$ and ...
1
vote
1answer
26 views

Is there a secure two party protocol that makes P1 (with x as input) gets rx+r' and P2 gets (r,r')

It should be a secure two party protocol against malicious adversary. P1's input is X in Zp* (p is a prime number); P2's input is nothing. P1's output is rX+r'. r,r' are random numbers from Zp* P2' ...
0
votes
0answers
17 views

What security properties do I lose when letting the group creator choose group keys in a protocol similar to the Signal Protocol?

As far as I know Whatsapp ,Signal and co in their group channels first used the already existing peer-to-peer channels between the participants and protected using the Double Ratchet Algorithm to ...
1
vote
1answer
77 views

Proof that someone has access to a private key whose public key is part of a known group

I'm a crypto newbie and hoping to get pointed in the right direction. I've seen some related questions like this but none that satisfy my requirements. Let's say Jane's Forum is a large community, and ...
0
votes
0answers
35 views

Why would a KEK be used with a KDF?

When using openssl cms -encrypt -pwri_password, it follows the process described in RFC 3211, which passes the user-provided password into a KDF, but then, rather ...
1
vote
0answers
30 views

Security proof for TLS 1.x

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys. It is also stated that, if TLS 1.2 was to be modified ...
0
votes
1answer
60 views

Detect if two numbers are equal without disclosing further information

Consider the following scenario. Alice picks a number A; Bob picks a number B. Both A and B belong to a relatively small set X (by small I mean that X can be easily looped through: for intuition sake, ...
1
vote
0answers
21 views

Composite order ECC and Ristretto

I've been looking at ristretto.group, and its really cool. I understand for some protocols we need curve points to behave as if they were from a prime order curve. I have a few questions on this, Do ...
0
votes
0answers
49 views

What security does the BMR protocol offer against corruption?

I've been conducting some research into general-purpose MPC protocols and have been unable to pinpoint the exact security offered by the BMR protocol. The reference I've been using for the majority of ...
1
vote
1answer
62 views

In TLS 1.3, what is the rational for using different handshake transcripts for Resumption Master Secret vs Application Traffic Secrets?

The TLS 1.3 RFC, section 7.1 lists this as the last part of the key schedule: https://datatracker.ietf.org/doc/html/rfc8446#section-7.1 ...
2
votes
1answer
67 views

What happen if the curve used in key agreement protocol also used in signature inside of protocol? [duplicate]

In key agreement (or key exchange) protocols, is used signature for authentication. Suppose that key exchange protocols execute on elliptic curve. The initiator of protocol must sends signature of his ...
6
votes
1answer
145 views

Is there any cryptographic reason to sign over the signature algID and params?

It seems to be common-practice for a signature protocol to include the algorithmID and params (if any) in the data being signed. For example: RSA PKCS#1 v1.5 includes the digest alg in the data being ...
0
votes
0answers
37 views

Is there a name for this simple identity verification scheme?

Once, while idly wondering, I came up with a simple scheme to prove the authenticity of a chain of messages given the authenticity of the first. It consists of putting a hash at the end of each ...
0
votes
0answers
21 views

Few questions about setting up SuperCop primitives

Have a couple of questions about the supercop library. I've refrained from asking this question for a considerable amount of time because every time I thought about asking it, it sounded stupid in my ...
0
votes
1answer
64 views

Is this protocol secure?

Before anyone freaks out, this is purely speculative and I am not developing a cryptosystem! I can't see anything wrong with this protocol, but my knowledge of cryptography is rather superficial: ...
1
vote
2answers
152 views

Is it safe to say that a XOR with an unknown input provides a random output?

I am wondering if you have an input $x_{1}$ and you XOR it with an unknown random second input $x_{2}$, is it safe to say that the resulting $x_{1}\oplus x_{2}$ will be random ? The final idea would ...
2
votes
0answers
30 views

Failure of parallel composition [duplicate]

Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of ...
1
vote
1answer
58 views

what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?

Related question here. I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
0
votes
2answers
104 views

How can a recipient recognize which encrypted messages are intended for them?

Let's say there's a decentralized email service where parties' public keys are known. A sender sends a message to a recipient by encrypting via RSA with the recipient's public key and posting the ...
0
votes
2answers
146 views

Given ciphertexts C1, C2 of different messages P1 and P2; how can we prove that both C1 and C2 were encrypted using public keys of the same pair?

I vaguely recall reading about a scheme that accomplished this but am not able to figure out which one it was. For the sake of brevity I'm gonna omit any nonces. Let's say we have an asymmetric ...
1
vote
0answers
49 views

Combining ECC And RSA for a Web Based Chat system

I'm a building a Web application chat message system(Over TLS) and i would like to know if the following theory is correct. Sender I'm generating keyPairs using RSA and another KeyPairs using ECC. By ...
0
votes
0answers
29 views

In group key agreement/exchange protocols, does key independence implies forward and backward secrecy?

Kim et al. [here] define Foward and Backward secrecy as follows: Forward Secrecy (not perfect foward secrecy): the inability for a passive attacker to obtain past group keys from a subset of new ...
1
vote
0answers
28 views

What is the main difference between anonymous authentication and using an anonymous credential?

What is the main difference between anonymous authentication and the use of an anonymous credential? And when we should use them?
1
vote
0answers
34 views

Signature algorithm for constrained environment, curve25512 already present for ECDH

I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no ...
0
votes
0answers
24 views

Unilateral authentication with implicit key authentication

Is it possible to design a cryptography protocol with achieving unilateral authentication of one party A by party B using implicit key authentication? Key authentication is the property whereby one ...
0
votes
0answers
70 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
0
votes
0answers
37 views

What are different types of signature properties?

I am reading about digital signatures these days. I read about blind signatures, group signatures and ring signatures. Are there other type of signatures as well?
3
votes
2answers
108 views

Anonymizing a group chat

I wonder if it's possible to have a peer-to-peer group chat protocol, where anybody is free to join the chat and broadcast with a chosen username to all others who have joined it, but with a strong ...
2
votes
1answer
71 views

Using crypto_sign then crypto_box_seal for anonymous messages

If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do? ...
0
votes
0answers
59 views

How to formally define the security of Random Oblivious Transfer

Assume that there is a protocol $(A,B)$ such that receives no input and satisfies: $A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$ $B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$...
1
vote
1answer
112 views

Securing communication between limited embedded systems

I am currently trying to harden communication over a limited physical communication channel on an embedded system. The Scenario I think the system is rather typical for small embedded applications: ...
1
vote
0answers
33 views

Construct an Oblivious Transfer protocol using a secure protocol that outputs random bits between two sides

Assume that there is a protocol $(A,B)$ such that receives no input and satisfies: $A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$ $B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$...
2
votes
1answer
72 views

How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol

I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin. I ...
4
votes
2answers
209 views

MAC-then-encrypt in SIGMA protocol for authenticated key exchange

The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption. The SIGMA-I variant illustrated below ...
2
votes
1answer
67 views

How to securely deal cards?

Thanks to a certain pandemic going around I was wondering whether there is any cryptographic way to remotely deal cards without the dealer being able to know them and without requiring to trust a ...
1
vote
0answers
19 views

Are there any mutual-distance bounding protocols in RFID context?

Distance-bounding algorithms are a classical solution for the Relay Attack, wherein a verifier can determine an upper bound on its distance from the prover. However, recent literature is discussing ...
0
votes
2answers
219 views

Designing a simple challenge-response symmetric mutual authentication protocol

I am designing a protocol that 2 devices will use to mutually authenticate over an unreliable, unsecure channel. The system must be fast and low-power, so symmetric cryptography is a requirement. I ...
2
votes
2answers
134 views

Prove that you have the data when hash is public

I am designing an online service where users can upload files (3d models) for processing. I want to speed up things when the same file is uploaded by many different users by allowing them to post a ...
0
votes
1answer
25 views

Is establishing a secret key possible given this characteristic primitive?

I am wondering if there are any readily available solutions for the following problem: I have a ring-topology network with several devices connected to it, some malicious, some legitimate. I want to ...
0
votes
1answer
116 views

How to securely share AES key between two remote devices (client and server) through UDP protocol?

I have two separate system (client) and (server). I am having a problem which is to encrypt a message from the client and decrypt at the server. In order to do that, I am required to transmit my key ...
2
votes
0answers
21 views

Is there an interactive proof protocol for proving that a preimage in a map $g: Z_{q}^{n} → G_{T}$ is mapped to a given public value, say y?

There already exist interactive proof protocols with logarithmic communication for proving that a secret multi-exponent $x ∈ Z^{n}_{q}$ for a public multi-exponentiation $P = \textbf{g}^{\textbf{x}} ∈ ...
3
votes
0answers
78 views

Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?

While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
15
votes
5answers
7k views

Is it easy to crack a hashed phone number?

I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?
0
votes
1answer
64 views

Can two traitors safely reveal themselves to each other?

Suppose Alice is a traitor and suspects Bob might also be a traitor. If Bob is a traitor, she would like to conspire with him together, if not she doesn't want to reveal that she is a traitor. Is ...
1
vote
1answer
126 views

Question of proving the opening of Pedersen Commitment

Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
0
votes
0answers
99 views

Computational Binding of Pedersen Commitment

Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen ...
50
votes
1answer
11k views

Why do 5G, 4G, etc., use non-conventional algorithms?

Looking up information about 5G and the previous 3GPP standards, why have they been incorporating non-conventional algorithms into the standards? For example, AES has been considered secure for ages ...
0
votes
0answers
64 views

Diffie-Hellman Key Exchange - Key Derivation before Execution

I am dealing with protocol design regarding the Diffie-Hellman Key Exchange (DHKE). The DHKE is performed by the Key Master and some Slave Component. Afterwards, a session key is transmitted using the ...
3
votes
1answer
267 views

How are initialization vectors used in TLS 1.1?

From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this ...

1
2 3 4 5
13