Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
0 votes
1 answer
96 views

Should hash salt and public key be a part of cryptographic signature?

I'm updating some piece of software I wrote quite some time ago. It is supposed to sign some content. So at the moment I have the following process: I have a (private, public) keys pair. These can ...
freakish's user avatar
  • 103
0 votes
1 answer
56 views

Protocol for verifying novel compression algorithm?

By the pigeonhole principle, we can demonstrate that arbitrary lengths of random data are uncompressible in the general case. But let us imagine that I claim that I have created an oracle that can ...
johnwbyrd's user avatar
  • 101
0 votes
0 answers
46 views

Secure key exchange for custom USB device

I'm learning various cryptography protocols and use cases and since I'm developing a USB device and PC application, it would be nice to use encrypted communication. I studied TLS 1.2 key exchange but ...
unalignedmemoryaccess's user avatar
1 vote
0 answers
91 views

Does 'digitization' of tickets always need private data? Or is it just data gathering? Any simple method without?

Many companies argue their gathering of private data with 'digitization' but I guess their real intention is most likely just gathering data. However I didn't came up with a simple idea without it. ...
UncleBob's user avatar
1 vote
0 answers
79 views

Ephemeral ECC refresh vs. simple hash ratchet

Some protocols employ ephemeral ECC key exchanges throughout the session. Such as the Noise framework. Is the rationale to do this simply because you can do it efficiently? To provide future secrecy ...
user avatar
2 votes
0 answers
54 views

Proof of knowledge of big message

Say party A wants to prove that it has seen the entirety of a public, big message m. Providing the hash of m is not good enough, ...
Eugen's user avatar
  • 121
1 vote
1 answer
103 views

How often do Double ratchet in Signal protocol update DH ratchet key

I'm trying to understand the specification behind doubleratchet algorithm, item 2.4. Double Ratchet. According to wiki: A client renews session key material in interaction with the remote peer using ...
pacman's user avatar
  • 429
1 vote
1 answer
67 views

Signal protocol: are One-time prekeys derived from Signed Prekey or just randomly generated?

Do signal protocol derive One-time prekeys from Signed Prekey with some KDF or are they just randomly generated in the same way as Signed Prekey?
pacman's user avatar
  • 429
0 votes
0 answers
40 views

What is best $1$ out $2$ oblivious transfer?

There are a lot of oblivious transfer algorithm. What is the best? It would be good if it were malicious secure, but that is not necessary, if this make protocol very difficult/slow. This protocol ...
Galois group's user avatar
0 votes
0 answers
29 views

Signature algorithm/protocol with fillable gaps?

Consider how a cheque-book works: Alice goes to the Bank, and gets some incomplete messages, like ...
Danya02's user avatar
  • 101
3 votes
0 answers
75 views

Real-world protocols based on pairings such that the number of additions in $\mathbb{G}_1$ is equal to the number of additions in $\mathbb{G}_2$

Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \...
Dimitri Koshelev's user avatar
1 vote
0 answers
35 views

What is the maximum number of current members in a group CA that MKA can support?

The MACsec standard (IEEE 802.1AE-2018) states "The number of SCIs (and hence the number of SSCIs) is ultimately limited by the maximum number of current members in a group CA that MKA can ...
user1234's user avatar
0 votes
0 answers
33 views

How can I impersonate Bob without creating a new session

Good morning, I've been struggling with this protocol for the last few days and I'm out of ideas now. The goal is to impersonate Bob by just modifying or dropping packages. The attacker(me) is a Proxy ...
Goel77's user avatar
  • 1
0 votes
0 answers
33 views

Protocol security

This protocol is designed to establish a session key K'AB between two parties without the interaction with a server. In this case, the key KAB is a long-term key shared between Alice and Bob. I am ...
azn 's user avatar
  • 1
5 votes
1 answer
122 views

difference between Covert and Security with abort

In the realm of secure Multi-Party Computation (MPC) schemes, there exist two fundamental concepts known as the covert adversary model and security with abort. From what I understand, both of these ...
Mahdi Mahdavi's user avatar
2 votes
2 answers
72 views

plain text size prediction

In your opinion, is the correlation between the length of the ciphertext and the decrypted text (even if it is approximate) a cipher vulnerability? Or is there a solution to this problem outside of it?...
nano toster's user avatar
2 votes
1 answer
168 views

Parameters needed for Chaum-Pedersen Protocol

I've came across a Stackexchange question about the Chaum-Pedersen Protocol which is based on the generalised schnorr protocol. As I understand it, it uses discrete logs and cyclic groups of prime ...
Jason L. B.'s user avatar
0 votes
0 answers
18 views

Group keys with revocation in publish/subscribe IoT

I have a group of subscribers who are subscribed to a message broker in an IoT setting, let's say to the topic 'sensor/temperature'. Now, I want to create a public/private key pair in such a way that ...
kekdajeet's user avatar
1 vote
1 answer
43 views

How to construct a protocol for a trustless standardized paper test?

So the problem I'm exploring is basically how to run a paper exam (such as the SAT) in such a way that participants can be sure that their exams were graded fairly, meaning the exam hosts can't change ...
Sidharth Ghoshal's user avatar
2 votes
1 answer
90 views

Is there any secure deterministic two-party computation protocol?

The notion of security considered here is privacy. Is there a secure two-party protocol does not rely on randomness at all when considering passive adversaries (or active adversaries)? If the answer ...
amyyy's user avatar
  • 33
5 votes
2 answers
197 views

Authenticated encryption scheme for one-way radio telemetry

I'm designing an authenticated encryption scheme for a noninteractive one-way radio telemetry system. A number of devices in the field send back telemetry to a base station periodically, but no ...
Polynomial's user avatar
  • 3,527
1 vote
0 answers
40 views

Is there a type of method where multiple keys are involved, and final key produces invalid results unless all prior keys are used?

I'm looking for a mechanism for a type of cert/key signing, where multiple keys need to sign/encrypt something, and a final key/method does not product a valid confirmation unless all those keys did ...
New Alexandria's user avatar
1 vote
1 answer
71 views

Does game-theoretical fairness work in when the goal of one party is randomness

When we take the coin flip in Blum's algorithm in "Coin flipping by telephone a protocol for solving impossible problems", where Alice and Bob both want ownership over the same car, then one ...
Mangudai's user avatar
1 vote
0 answers
227 views

ED25519, RSA, Post Quantum Encryption confirmation

I am working on a chat feature to use both post quantum cryptography along with RSA, and want to confirm my thoughts. As these algorithms haven't been fully battle tested, I have decided to use a ...
Jake Nelson's user avatar
4 votes
0 answers
77 views

On the Adaptive Security of MPC Protocols

In adversarial context of MPC, the corruption behavior refers to the assumptions about the corrupted parties’ deviation level from the protocol specification. Three main types of corruption behaviors ...
NB_1907's user avatar
  • 640
1 vote
0 answers
63 views

Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$

Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order. Assume that I know how to construct an efficiently computable ...
Dimitri Koshelev's user avatar
1 vote
0 answers
60 views

Pseudo-isomorphic graphs

Some famous cryptographical protocols rely on the construction of graphs $G_i= (V_i, E_i)$ for $i=0,1$ that are not isomorphic. For the safety of this protocol, it is central that one can not easily ...
Dominic van der Zypen's user avatar
1 vote
0 answers
97 views

How to compute the absolute value of a float number using only addition and multiplication (or using an and-xor circuit)?

Hi I am trying to calculate the abs or a float number $x$, however, I want to apply this operation when $x$ is under fully homomorphic encryption (typically CKKS ...
itabline's user avatar
1 vote
1 answer
174 views

Question about Secure Multi-Party Computation

I am doing research about Non-interactive Secure Multi-party Computation and encounter a dilemma that I am not quite sure if it is possible and wonder if there are better thoughts that could help. ...
qingqingthe's user avatar
0 votes
1 answer
58 views

Honest programming language for malicious adversaries in MPC protocols

One method to create a secure MPC protocol against malicious adversaries is to create a secure protocol against semi-honest adversaries and then add some zero-knowledge proofs to ensure that the ...
user avatar
1 vote
0 answers
38 views

Does the private blockchain have to follow client-server model when considering BFT?

I'm a newbie, currently interested in data security & integrity. I'm quite new to blockchain and distributed system theories, and suffering from some unclear doubts/questions on the fault-tolerant ...
J.L.'s user avatar
  • 11
1 vote
1 answer
78 views

Public key fingerprint verification for large groups

If you were designing: An open source client that offered E2E encryption for e.g. folder sharing between users Each user had public keys for signing (and separate public keys for encryption of ...
gecad41980's user avatar
3 votes
0 answers
60 views

How to create an encryption such that we need two keys to decrypt, while one key is derivable from the other if I have the secret

Suppose I have some plaintext $M$, and I want to have some process $f$ to make ciphertext $M':=f(M,s)$, where $s$ is some secret. The ciphertext $M'$ can be decrypted by using some decryption process $...
Ulysses Zhan's user avatar
1 vote
0 answers
32 views

Is there a scheme for voting on decrypting a message with a variable voter count?

I am wondering if there might be a scheme for the following scenario: Let's suppose a government wants a truly democratic intelligence agency. For this the government publishes all intelligence ...
Franz Bauer's user avatar
0 votes
0 answers
52 views

Oblivious transfer protocol to retrieve k elements

The sever holds the N encrypted elements, each element is associated with an index (unencrypted). The receiver wants to retrieve only k-out-N elements using k-out-N OT. The motivation for using OT is ...
A_guest's user avatar
1 vote
1 answer
44 views

How would you design an API server to store user sercrets?

This is not for a production application, but just my exploration to help me understand cryptography. At the simplest level, I want to design a key-value store for user secrets. This is exposed over ...
user avatar
0 votes
1 answer
113 views

Shamir Secret Sharing over an unsecure channel for a protocol design

Let's suppose that we have two parties, $A$ and $B$ that are using a Shamir Secret Sharing scheme with $k=3$. $A$ holds the points $[x_1, f(x_1)]$ and $[x_2, f(x_2)]$ while $B$ holds $[x_3, f(x_3)]$ ...
Pietro's user avatar
  • 13
1 vote
0 answers
59 views

Using multiple asymmetric keys as backups for one another

I've been thinking about ways to take advantage of multiple asymmetric encryption schemes so that each key could be a backup to the others in case of cryptanalysis of one given scheme. Those public ...
Olivia Leiv's user avatar
0 votes
0 answers
61 views

Bloackchain e-voting: verfiy that voter is allowed to vote but didnt already voted, without reaviling his identity

I am trying to make a e-voting system based on blockchain and I am trying to think about a way that i can verify that a vote is legal without reavling the identity of the voter. One of the solutions ...
שחר כהן's user avatar
0 votes
0 answers
135 views

How to encrypt keys in a content-addressable store, for lookup and enumeration

I'm implementing a content-addressable file store - similar to a key/value store, but the key is always a hash of the value. I'd like to build an encryption layer for it, to hide what data is being ...
Colonel Thirty Two's user avatar
0 votes
1 answer
55 views

Would a consensus algorithm like the one I describe work?

Given n nodes(miners/validators), Every unspent transaction output is broadcasted to all n nodes. Each node will select a batch of transactions and add it to their block. The specific mechanism of ...
rasputin's user avatar
1 vote
1 answer
318 views

How should I interpret this definition of the Dolev Yao Closure?

Please see the image below which represents an algebraic definition of the Dolev Yao Closure. From reading around, it appears this is BAN logic and that the lines mean "If you believe the above ...
Connor's user avatar
  • 113
0 votes
1 answer
55 views

How to know who is an attacker in byzantine broadcast?

2 requirements of Byzantine broadcast (consistency and validity) only state honest node should output certain bit without mentioning what should malicious nodes do. How do we know the identity of each ...
Paul Yu's user avatar
  • 156
1 vote
1 answer
136 views

Why lattice based cryptographic schemes usually are not bandwidth efficient?

The question is mainly stated in the title. I am new to lattices and I have a basic understanding of them but not something in depth. I was watching a presentation of of a VSS (Verifiable Secret ...
tur11ng's user avatar
  • 962
0 votes
2 answers
113 views

Encryption algorithm where proving the decryption is equal to spoiling the key?

Is there an encryption algorithm or MAC algorithm for which NO zero-knowledge-proof exists, provably? I want people who want to prove that a ciphertext decrypts into some plaintext to have to spoil ...
donaastor's user avatar
  • 125
1 vote
1 answer
186 views

Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?

Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
Paul Uszak's user avatar
  • 15.4k
0 votes
0 answers
32 views

Verifying meeting by sending same signed random number to central authority?

I am trying to develop a simple protocol for two users to verify (with respect to a trusted central authority) that they have (intentionally) met/communicated with each other. My idea was this: Users ...
JMC's user avatar
  • 113
0 votes
1 answer
71 views

Short description of encryption methods? [closed]

I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them. Hash then encrypt MAC then encrypt Encrypt and MAC Encrypt then MAC
Dylk58's user avatar
  • 1
1 vote
2 answers
153 views

Is there a winning strategy based on this coin-flipping protocol?

Given the coin flipping protocol: A chooses $a \in_R \{0,1\}$ and computes $commit(a,r)$. She sends $commit(a,r)$ to B. B chooses $b \in_R \{0,1\}$ and sends $b$ to A. A sends $open(a,r)$ and B ...
Anon's user avatar
  • 403
1 vote
2 answers
145 views

Proving that a protocol is not attackable

Consider the following protocol: $A\rightarrow B: \{N_A,A\}_{pk(B)}$ $B\rightarrow A: \{N_B,N_A\}_{pk(A)}$ $A\rightarrow B: hash(N_B, A, B)$ where it is intended that when either $A$ or $B$ has ...
SVMteamsTool's user avatar

1
2 3 4 5
15