Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
1
vote
0answers
14 views

Composite order ECC and Ristretto

I've been looking at ristretto.group, and its really cool. I understand for some protocols we need curve points to behave as if they were from a prime order curve. I have a few questions on this, Do ...
0
votes
0answers
32 views

What security does the BMR protocol offer against corruption?

I've been conducting some research into general-purpose MPC protocols and have been unable to pinpoint the exact security offered by the BMR protocol. The reference I've been using for the majority of ...
1
vote
1answer
44 views

In TLS 1.3, what is the rational for using different handshake transcripts for Resumption Master Secret vs Application Traffic Secrets?

The TLS 1.3 RFC, section 7.1 lists this as the last part of the key schedule: https://datatracker.ietf.org/doc/html/rfc8446#section-7.1 ...
2
votes
1answer
52 views

What happen if the curve used in key agreement protocol also used in signature inside of protocol? [duplicate]

In key agreement (or key exchange) protocols, is used signature for authentication. Suppose that key exchange protocols execute on elliptic curve. The initiator of protocol must sends signature of his ...
6
votes
1answer
131 views

Is there any cryptographic reason to sign over the signature algID and params?

It seems to be common-practice for a signature protocol to include the algorithmID and params (if any) in the data being signed. For example: RSA PKCS#1 v1.5 includes the digest alg in the data being ...
0
votes
0answers
36 views

Is there a name for this simple identity verification scheme?

Once, while idly wondering, I came up with a simple scheme to prove the authenticity of a chain of messages given the authenticity of the first. It consists of putting a hash at the end of each ...
0
votes
0answers
17 views

Few questions about setting up SuperCop primitives

Have a couple of questions about the supercop library. I've refrained from asking this question for a considerable amount of time because every time I thought about asking it, it sounded stupid in my ...
0
votes
1answer
61 views

Is this protocol secure?

Before anyone freaks out, this is purely speculative and I am not developing a cryptosystem! I can't see anything wrong with this protocol, but my knowledge of cryptography is rather superficial: ...
1
vote
2answers
144 views

Is it safe to say that a XOR with an unknown input provides a random output?

I am wondering if you have an input $x_{1}$ and you XOR it with an unknown random second input $x_{2}$, is it safe to say that the resulting $x_{1}\oplus x_{2}$ will be random ? The final idea would ...
2
votes
0answers
25 views

Failure of parallel composition

Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of ...
1
vote
1answer
54 views

what motivated the design decisions of RFC 8291 (“Message Encryption for Web Push”)?

Related question here. I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
0
votes
2answers
100 views

How can a recipient recognize which encrypted messages are intended for them?

Let's say there's a decentralized email service where parties' public keys are known. A sender sends a message to a recipient by encrypting via RSA with the recipient's public key and posting the ...
0
votes
2answers
127 views

Given ciphertexts C1, C2 of different messages P1 and P2; how can we prove that both C1 and C2 were encrypted using public keys of the same pair?

I vaguely recall reading about a scheme that accomplished this but am not able to figure out which one it was. For the sake of brevity I'm gonna omit any nonces. Let's say we have an asymmetric ...
1
vote
0answers
44 views

Combining ECC And RSA for a Web Based Chat system

I'm a building a Web application chat message system(Over TLS) and i would like to know if the following theory is correct. Sender I'm generating keyPairs using RSA and another KeyPairs using ECC. By ...
0
votes
0answers
27 views

In group key agreement/exchange protocols, does key independence implies forward and backward secrecy?

Kim et al. [here] define Foward and Backward secrecy as follows: Forward Secrecy (not perfect foward secrecy): the inability for a passive attacker to obtain past group keys from a subset of new ...
1
vote
0answers
25 views

What is the main difference between anonymous authentication and using an anonymous credential?

What is the main difference between anonymous authentication and the use of an anonymous credential? And when we should use them?
1
vote
0answers
31 views

Signature algorithm for constrained environment, curve25512 already present for ECDH

I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no ...
0
votes
0answers
21 views

Unilateral authentication with implicit key authentication

Is it possible to design a cryptography protocol with achieving unilateral authentication of one party A by party B using implicit key authentication? Key authentication is the property whereby one ...
0
votes
0answers
68 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
0
votes
0answers
37 views

What are different types of signature properties?

I am reading about digital signatures these days. I read about blind signatures, group signatures and ring signatures. Are there other type of signatures as well?
3
votes
2answers
105 views

Anonymizing a group chat

I wonder if it's possible to have a peer-to-peer group chat protocol, where anybody is free to join the chat and broadcast with a chosen username to all others who have joined it, but with a strong ...
2
votes
1answer
61 views

Using crypto_sign then crypto_box_seal for anonymous messages

If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do? ...
0
votes
0answers
53 views

How to formally define the security of Random Oblivious Transfer

Assume that there is a protocol $(A,B)$ such that receives no input and satisfies: $A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$ $B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$...
1
vote
1answer
104 views

Securing communication between limited embedded systems

I am currently trying to harden communication over a limited physical communication channel on an embedded system. The Scenario I think the system is rather typical for small embedded applications: ...
1
vote
0answers
33 views

Construct an Oblivious Transfer protocol using a secure protocol that outputs random bits between two sides

Assume that there is a protocol $(A,B)$ such that receives no input and satisfies: $A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$ $B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$...
2
votes
1answer
69 views

How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol

I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin. I ...
4
votes
2answers
186 views

MAC-then-encrypt in SIGMA protocol for authenticated key exchange

The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption. The SIGMA-I variant illustrated below ...
2
votes
1answer
65 views

How to securely deal cards?

Thanks to a certain pandemic going around I was wondering whether there is any cryptographic way to remotely deal cards without the dealer being able to know them and without requiring to trust a ...
1
vote
0answers
19 views

Are there any mutual-distance bounding protocols in RFID context?

Distance-bounding algorithms are a classical solution for the Relay Attack, wherein a verifier can determine an upper bound on its distance from the prover. However, recent literature is discussing ...
0
votes
2answers
161 views

Designing a simple challenge-response symmetric mutual authentication protocol

I am designing a protocol that 2 devices will use to mutually authenticate over an unreliable, unsecure channel. The system must be fast and low-power, so symmetric cryptography is a requirement. I ...
2
votes
2answers
118 views

Prove that you have the data when hash is public

I am designing an online service where users can upload files (3d models) for processing. I want to speed up things when the same file is uploaded by many different users by allowing them to post a ...
0
votes
1answer
25 views

Is establishing a secret key possible given this characteristic primitive?

I am wondering if there are any readily available solutions for the following problem: I have a ring-topology network with several devices connected to it, some malicious, some legitimate. I want to ...
0
votes
1answer
97 views

How to securely share AES key between two remote devices (client and server) through UDP protocol?

I have two separate system (client) and (server). I am having a problem which is to encrypt a message from the client and decrypt at the server. In order to do that, I am required to transmit my key ...
2
votes
0answers
21 views

Is there an interactive proof protocol for proving that a preimage in a map $g: Z_{q}^{n} → G_{T}$ is mapped to a given public value, say y?

There already exist interactive proof protocols with logarithmic communication for proving that a secret multi-exponent $x ∈ Z^{n}_{q}$ for a public multi-exponentiation $P = \textbf{g}^{\textbf{x}} ∈ ...
3
votes
0answers
77 views

Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?

While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
15
votes
5answers
7k views

Is it easy to crack a hashed phone number?

I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?
0
votes
1answer
64 views

Can two traitors safely reveal themselves to each other?

Suppose Alice is a traitor and suspects Bob might also be a traitor. If Bob is a traitor, she would like to conspire with him together, if not she doesn't want to reveal that she is a traitor. Is ...
1
vote
1answer
110 views

Question of proving the opening of Pedersen Commitment

Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
0
votes
0answers
87 views

Computational Binding of Pedersen Commitment

Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen ...
50
votes
1answer
11k views

Why do 5G, 4G, etc., use non-conventional algorithms?

Looking up information about 5G and the previous 3GPP standards, why have they been incorporating non-conventional algorithms into the standards? For example, AES has been considered secure for ages ...
0
votes
0answers
54 views

Diffie-Hellman Key Exchange - Key Derivation before Execution

I am dealing with protocol design regarding the Diffie-Hellman Key Exchange (DHKE). The DHKE is performed by the Key Master and some Slave Component. Afterwards, a session key is transmitted using the ...
3
votes
1answer
238 views

How are initialization vectors used in TLS 1.1?

From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this ...
1
vote
0answers
56 views

Can two anonymous parties determine whether they interacted before, without being able to link encounters?

Assume an anonymous communication system in which anonymous parties randomly meet in pairs to exchange information. How could two anonymous parties determine whether they have interacted before, ...
1
vote
0answers
30 views

How does one ensure that a handshake protocol is secure assuming all underlying cryptography used are secure

Suppose one have to design handshake protocol using known secure cryptographic algorithm. The designer of implementer can assume that crypotography is secure but how would they ensure protocol itself ...
0
votes
1answer
64 views

How modern messengers encryption keys can't be hacked [closed]

I dont know is this question more like reverse-engineering or cryptographic. Why governments are hunting for encryptions keys? Aren't they delievering by the network the same as the encypted messages? ...
0
votes
0answers
136 views

Importance of Backward and forward secrecy

Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy
1
vote
0answers
52 views

Why isn't Kerberos using temporary keys to avoid dictionary attacks?

In the Kerberos protocol, the user sends his ID, the server (Or ticket granting server) ID and a nonce value. The Key Distribution Center uses a key (I assume symmetrical) derived from the client's ...
1
vote
2answers
399 views

How to design a secure challange-response authentication protocol?

I am implementing a custom challenge-response protocol to authenticate a client to a server. Mutual authentication is not required, i.e. the server doesn't need to be authenticated to the client. The ...
18
votes
0answers
837 views

Crypto AG (Switzerland) - Which algorithms were used and how did the backdoors work?

Backstory Crypto AG was a company located in Switzerland that specialized in communication security. They produced a number of encryption machines (some similar to the infamous Enigma) used for ...
0
votes
0answers
40 views

Conditioning access to private key?

I would like to provide a public/private keypair to a user, but require that the user obtain an authorizing key before being allowed to use the private key. I don't want the authorizing party to have ...

1
2 3 4 5
13