Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if ...

0
votes
0answers
9 views

Computing/using RSA modulus without knowing its factors

There are some protocols, e.g. this, that require parties to compute/use RSA modulus: $N$ without knowing it's factors or $\phi(N)$. One way of doing it is to use a trusted party. Question: Is ...
1
vote
1answer
36 views

Instead of sending a set of random values, send a key for a PRF

Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and ...
0
votes
1answer
37 views

Economically Rational as a security proof

Is it possible to prove the security of a cryptocurrency payment protocol by saying that the actors will seek to maximize their profits. Would I need to set this up as a game and prove it that way or ...
0
votes
1answer
41 views

Time-release Protocol Implementation

“How to Build Time-Lock Encryption” by Jager “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan I looked through the references, googled, searched GitHub ...
1
vote
1answer
37 views

How can process algebra help to design security protocols?

Would you please tell me how process algebra could help me to design security protocols? More specifically, can I use it for proving the security of protocols? Is process algebra used for any ...
-1
votes
1answer
31 views

Which of these deductions are true about the simulator and the adversary?

Which of these deductions make sense? The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
0
votes
1answer
38 views

Is function Deterministic or Probabilistic in the malicious security definition?

As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
0
votes
0answers
149 views

Security proof in the semi-honest model

This protocol is designed in the semi-honest model. Two parties encrypt their input and send it to the cloud. Cloud will perform computation using a homomorphic encryption and send the result to P2. ...
2
votes
1answer
47 views

A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
7
votes
1answer
106 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
1
vote
1answer
52 views

How to use Real-Ideal model in a specific scenario (two party with cloud)

I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
0
votes
1answer
31 views

Using the security definition in the malicious model to prove security in the semi honest model

Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm) Would you ...
0
votes
1answer
58 views

Zero-Knowledge Bingo

Bingo is the game of chance where each player matches the numbers on their card with the numbers that the caller draws at random. When the first player has collected enough called numbers on their ...
0
votes
0answers
28 views

Observable Signer Timelock

I want to design a system able to generate private/public keys where as system owner I should be able to know and share immediately the public part but for the private this must be revealed only after ...
2
votes
1answer
73 views

Getting a Keeloq manufacturer key

I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-...
5
votes
1answer
96 views

How do mix networks work with server downtime?

I am looking for an analysis of practical mix networks with server downtime. For example, if a message is supposed to go from A -> B -> C -> D, what happens if B wants to send the message but C is ...
-2
votes
1answer
26 views

Should I use failed decryptings to handle multiple session keys?

I feel like this question is specific enough to stand on its own. Say I have a set of clients each with a unique ID and already established pair of session keys for each client. When a client ...
0
votes
1answer
56 views

Basic encrypted custom protocol

I've been suggested to ask here instead of stackoverflow, so here I am. I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols ...
2
votes
0answers
31 views

Can “X3DH” instead of HMQV be used for OPAQUE?

So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether ...
1
vote
1answer
125 views

Zero-knowledge transfer of value protocol II [closed]

This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
0
votes
0answers
24 views

Threshold signature scheme with combiner outside the group

Assume we have a (t,n) threshold signature scheme in which the secret key is shared between the n group users. If at least t users sign a certain message . Can we build the scheme in such away ...
2
votes
0answers
33 views

breaking anonymous key exchange protocol

An anonymous key exchange protocol $P$ is pair of probabilistic machines $(A,B)$ that sends messages to each other and at the end, both $A$ and $B$ will share the same key $k$. The attacker can see ...
3
votes
3answers
260 views

Zero-knowledge transfer of value protocol inspired by EC El Gamal

This is a follow up on the question I asked here. I designed a scheme that allows the following: Alice has a value $a$ which she wants to keep secret Bob has a value $b$ which he wants to keep secret ...
0
votes
0answers
16 views

Interpretation of the PBFT paper by Castro and Likov

I find the following paragraph at the end of pag.4 of the PBFT paper by Castro and Likov confusing: This is true because $prepared(m,v,n,i)$ and $|\mathcal{R}|=3f+1$ imply that at least $f+1$ non-...
6
votes
1answer
130 views

In coin flipping protocols, why aborting is allowed, and why the non-aborting party flips a coin at the end?

To convey how an adversary can bias the coin, most often a simple commitment-based two party coin-tossing protocol is given, as in [1]: Alice sends Bob the commitment $c = commit(x)$ Bob sends Alice ...
1
vote
0answers
145 views

Leak information (new setting)

This question is similar to Leak Information?, but with new settings. Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at ...
3
votes
1answer
56 views

shared symmetric key

Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify ...
0
votes
1answer
38 views

How can I prove I'm the recipient of an encrypted message without revealing my identity and the message?

Alice wants to leave a message for Bob. So she encrypt a signed message with Bob's public key. Then leaves it at a dead drop service. Then later Bob arrives and checks the messages and attempts to ...
2
votes
1answer
49 views

Would it be possible to negotiate a key of 128 or 256 bits strength using Merkle puzzles?

One can be fascinated by the simplicity of the schemes created by Ralf Merkle; like the Merkle tree or his key negociation protocol over an insecure channel. Wikipedia has some material on "Merkle ...
1
vote
1answer
104 views

Storing Salt in Ciphertext?

I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
2
votes
1answer
89 views

Key establishment from secret answer to a question using Socialist Millionaire Protocol

I have read this as telling that two parties sharing a low-entropy secret (such as a secret answer to a question) can use it to establish a high-entropy shared secret key across a classical insecure ...
3
votes
3answers
116 views

How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...
2
votes
2answers
146 views

Doing RSA-KEM with RSA-OAEP

I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/...
1
vote
1answer
33 views

Does semi-honest adversary eavesdrop honest parties communication?

Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to ...
0
votes
1answer
47 views

Conditional $k,n$ secret sharing

I would like to know if there is a way to place a condition on $k$-out-of-$n$ secret sharing such that out of $k$ participants who can pool their shares to reconstruct a secret, one of them should ...
3
votes
0answers
55 views

X.509 strong authentication protocols

Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
4
votes
0answers
90 views

Proof of knowledge of exponentiations

I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of ...
0
votes
0answers
57 views

Payment system with anonymity towards seller and payment provider

Tl;dr: How would you construct a protocol for a payment system, where the seller doesn't know the Id of the buyer, and the payment processor doesn't know what's being bought (but can say if it's been ...
3
votes
1answer
57 views

Robust combiner for preimage resistance

My question is about chaining two hash functions to create a robust combiner for preimage resistance. @Zooko already gave a detailed answer here: $$H_{\circ}(x) = H_0(H_1(x))$$ is as strong as ...
2
votes
0answers
55 views

Why won't a BFT protocol using simple signing/voting work?

PBFT and most consensus algorithms are more complicated than a simple voting scheme. By simple voting I mean the following: we require all nodes to sign their local copy of the state and send this ...
2
votes
2answers
72 views

Bellovin ESP Attack on UDP Packets

In Bellovin's ESP Attack, it is stated that: If $L_A$, $L_B$ are using UDP, attack is easier: Wait till session ends Allocate $L_B$'s UDP port to $X_B$ Replay all packets So, how ...
5
votes
1answer
226 views

Secure group chat with large groups

I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group. Whatsapp also limits group size to ...
0
votes
0answers
39 views

Secure Data from physical and logical Theft in a Multi User Environment

For machine learning I need to store data (~50 GB a file, 100 TB in total) on my server. I need to grant some people time limited read access to those files. The server endpoint can be trusted, the ...
1
vote
1answer
66 views

Multi User limited Time Encryption of big Datasets

Updated Question: New Thread Original Question: (Thanks cypherfox for answering that one) I am in need to store data > 100 TB on a local network share (NAS/SAN) and grant individuals access to the ...
1
vote
1answer
36 views

Algorithm design to verify an assertion on encrypted values

I'm trying to design some kind of protocol but I'm stuck, need some help please.. Given $ (a,b,c)\in \mathbb{N}^+$ with $ a + b = c $ I need to send an asymmetric encrypted version of a,b and c ...
1
vote
1answer
136 views

mbed tls DTLS v1.2 system with -ECDHE-ECDSA, mutual auth and pre-installed public/private keys, no unnecessary messages or ASN.1/X.509 decoding

I am designing an IoT system based on Silicon Labs EFR32 MCUs with hardware accelerated support for SHA-256, AES-128-CBC and ECC (m255) computation. The system will communicate over a proprietary ...
0
votes
0answers
132 views

Unknown key-share attack

In the unknown key-share attack a dishonest entity C tempts two honest entities A and B to establish a key shared between them. At the end of the attack, A believes she shares the key with B, but B ...
2
votes
0answers
30 views

Unanimity for three (or more) players

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following unanimity protocol for three players: Three players want to ...
4
votes
1answer
77 views

Role of session identifier in Otway-Rees protocol

According to Wikipedia, Otway-Ress protocol is as follow: The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server S (M is ...