Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

0
votes
0answers
16 views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
3
votes
2answers
81 views

How to encrypt numeric data on a ticket

I have a customer with an existing ticketing system that generates tickets for events like theaters, movies, football and so on. The information in each ticket is encoded in a 16 decimal digit ...
0
votes
0answers
24 views

Dynamic accumulator with only non-membership witness

Goal: Construct a dynamic accumulator which can add elements and provide non-membership witnesses. I wanted to know if my construction is correct. Consider a group $Z_p$ where $p$ is prime number. ...
1
vote
1answer
47 views

Proof of ignorance to prevent “double-spend”?

Suppose I have some knowledge that I want to transfer securely from Alice's computer to Bob's computer, and prove that future breaches to Alice's computer will not reveal that information to someone ...
1
vote
1answer
47 views

Validating a shared secret between two parties, one bit at a time

What is the following protocol known as? Is it considered secure? Would it work? Background Alice and Bob each have a secret. They wish to determine if they both know the same secret. If they do ...
2
votes
1answer
68 views

Zero Knowledge range proof

I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
1
vote
1answer
38 views

Fairness in Multi party computation

Why for achieving the fairness, less than a half of the parties should be corrupted? ($t<m/2$, where $t$ is the number of corrupted parties and $m$ is the total number of the involved parties). How ...
0
votes
0answers
48 views

Simple but secure method to share secret (128 bit AES key) though an untrusted relay

I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
0
votes
0answers
21 views

Is my reasoning sound in the included scenario?

There is a package that contains a device, the device is activated/deactivated over a short range radio signal - it's function is to detect any unauthorised tampering of the package during the time it ...
2
votes
0answers
59 views

Concept for a RSA “repeater”. Is it sensible?

I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my ...
1
vote
0answers
47 views

Is it necessary to transmit two or three points of an elliptic curve?

Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
0
votes
1answer
35 views

Does Off-The-Record protocol provide future (backward) secrecy?

I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?
2
votes
1answer
84 views

Extending the Socialist millionaire problem to three parties

The usual solution of socialist millionaire problem allows to authenticate whether TWO parties have the same secret information. Are there any natural solution of the same problem for THREE parties?
10
votes
5answers
2k views

How to use proof of lack of knowledge?

This is a purely hypothetical example but is provable ignorance useful in cryptography? For example, let's say I have a trapdoor collision resistant function. I know the trapdoor and therefore some $...
3
votes
1answer
110 views

In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?

According to KeyCDN, TLSv1.3 connections are established in a single round trip: While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip If ...
1
vote
1answer
39 views

rolling key with two keyfobs

Hy i just saw this Question: How does a rolling code work? And I just wondered how it is possible that my Vehicle (A 2013 Mazda 6) has two key fobs? As i understand this shuld not be possible. ...
2
votes
1answer
78 views

Detect MITM with hashed session-key — Is my protocol secure?

I have the following setup: An app ("client") wants to communicate securely with a device I created ("server"). The client has the public key of the server (and a hashed password) preinstalled. I use ...
1
vote
1answer
61 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
2
votes
2answers
120 views

What's wrong with this digital signature scheme?

With regards to user authentication... The server sends Alice a randomly chosen number. Alice signs the number and sends the signature back to the server. The server checks the signature using Alice'...
1
vote
2answers
75 views

What conditions does a provable secure cryptosystem satisfy?

A cryptosystem can be entirely dependent on its underlying problem or it can have a reduction to other known problems. Solvability can be affordable if there exists a reduction of the base problem to ...
0
votes
1answer
44 views

Computing/using RSA modulus without knowing its factors

There are some protocols, e.g. this, that require parties to compute/use RSA modulus: $N$ without knowing it's factors or $\phi(N)$. One way of doing it is to use a trusted party. Question: Is ...
1
vote
1answer
46 views

Instead of sending a set of random values, send a key for a PRF

Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and ...
0
votes
1answer
38 views

Economically Rational as a security proof

Is it possible to prove the security of a cryptocurrency payment protocol by saying that the actors will seek to maximize their profits. Would I need to set this up as a game and prove it that way or ...
0
votes
1answer
47 views

Time-release Protocol Implementation

“How to Build Time-Lock Encryption” by Jager “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan I looked through the references, googled, searched GitHub ...
1
vote
1answer
43 views

How can process algebra help to design security protocols?

Would you please tell me how process algebra could help me to design security protocols? More specifically, can I use it for proving the security of protocols? Is process algebra used for any ...
-1
votes
1answer
44 views

Which of these deductions are true about the simulator and the adversary?

Which of these deductions make sense? The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
0
votes
1answer
45 views

Is function Deterministic or Probabilistic in the malicious security definition?

As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
1
vote
1answer
53 views

A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
6
votes
1answer
128 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
1
vote
1answer
56 views

How to use Real-Ideal model in a specific scenario (two party with cloud)

I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
0
votes
1answer
36 views

Using the security definition in the malicious model to prove security in the semi honest model

Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm) Would you ...
1
vote
2answers
95 views

Zero-Knowledge Bingo

Bingo is the game of chance where each player matches the numbers on their card with the numbers that the caller draws at random. When the first player has collected enough called numbers on their ...
2
votes
1answer
150 views

Getting a Keeloq manufacturer key

I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-...
5
votes
1answer
101 views

How do mix networks work with server downtime?

I am looking for an analysis of practical mix networks with server downtime. For example, if a message is supposed to go from A -> B -> C -> D, what happens if B wants to send the message but C is ...
-2
votes
1answer
28 views

Should I use failed decryptings to handle multiple session keys?

I feel like this question is specific enough to stand on its own. Say I have a set of clients each with a unique ID and already established pair of session keys for each client. When a client ...
0
votes
1answer
75 views

Basic encrypted custom protocol

I've been suggested to ask here instead of stackoverflow, so here I am. I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols ...
2
votes
0answers
46 views

Can “X3DH” instead of HMQV be used for OPAQUE?

So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether ...
1
vote
1answer
140 views

Zero-knowledge transfer of value protocol II [closed]

This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
0
votes
0answers
24 views

Threshold signature scheme with combiner outside the group

Assume we have a (t,n) threshold signature scheme in which the secret key is shared between the n group users. If at least t users sign a certain message . Can we build the scheme in such away ...
2
votes
0answers
39 views

breaking anonymous key exchange protocol

An anonymous key exchange protocol $P$ is pair of probabilistic machines $(A,B)$ that sends messages to each other and at the end, both $A$ and $B$ will share the same key $k$. The attacker can see ...
3
votes
3answers
293 views

Zero-knowledge transfer of value protocol inspired by EC El Gamal

This is a follow up on the question I asked here. I designed a scheme that allows the following: Alice has a value $a$ which she wants to keep secret Bob has a value $b$ which he wants to keep secret ...
0
votes
0answers
20 views

Interpretation of the PBFT paper by Castro and Likov

I find the following paragraph at the end of pag.4 of the PBFT paper by Castro and Likov confusing: This is true because $prepared(m,v,n,i)$ and $|\mathcal{R}|=3f+1$ imply that at least $f+1$ non-...
6
votes
1answer
144 views

In coin flipping protocols, why aborting is allowed, and why the non-aborting party flips a coin at the end?

To convey how an adversary can bias the coin, most often a simple commitment-based two party coin-tossing protocol is given, as in [1]: Alice sends Bob the commitment $c = commit(x)$ Bob sends Alice ...
1
vote
0answers
145 views

Leak information (new setting)

This question is similar to Leak Information?, but with new settings. Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at ...
3
votes
1answer
76 views

shared symmetric key

Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify ...
0
votes
1answer
38 views

How can I prove I'm the recipient of an encrypted message without revealing my identity and the message?

Alice wants to leave a message for Bob. So she encrypt a signed message with Bob's public key. Then leaves it at a dead drop service. Then later Bob arrives and checks the messages and attempts to ...
2
votes
1answer
51 views

Would it be possible to negotiate a key of 128 or 256 bits strength using Merkle puzzles?

One can be fascinated by the simplicity of the schemes created by Ralf Merkle; like the Merkle tree or his key negociation protocol over an insecure channel. Wikipedia has some material on "Merkle ...
1
vote
1answer
180 views

Storing Salt in Ciphertext?

I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
2
votes
1answer
146 views

Key establishment from secret answer to a question using Socialist Millionaire Protocol

I have read this as telling that two parties sharing a low-entropy secret (such as a secret answer to a question) can use it to establish a high-entropy shared secret key across a classical insecure ...
3
votes
3answers
128 views

How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...