Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
1 vote
1 answer
78 views

Why lattice based cryptographic schemes usually are not bandwidth efficient?

The question is mainly stated in the title. I am new to lattices and I have a basic understanding of them but not something in depth. I was watching a presentation of of a VSS (Verifiable Secret ...
user avatar
  • 502
1 vote
0 answers
30 views

Information-theoretically secure computation of a conjunction (with a semi-honest third party)

Suppose Alice and Bob want to compute the conjunction of their private bits in an information-theoretically secure way (so this approach, which uses standard oblivious transfer, does not suffice). ...
user avatar
  • 199
0 votes
2 answers
73 views

Encryption algorithm where proving the decryption is equal to spoiling the key?

Is there an encryption algorithm or MAC algorithm for which NO zero-knowledge-proof exists, provably? I want people who want to prove that a ciphertext decrypts into some plaintext to have to spoil ...
user avatar
  • 115
1 vote
1 answer
116 views

Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?

Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
user avatar
  • 13.9k
0 votes
0 answers
30 views

Verifying meeting by sending same signed random number to central authority?

I am trying to develop a simple protocol for two users to verify (with respect to a trusted central authority) that they have (intentionally) met/communicated with each other. My idea was this: Users ...
user avatar
  • 101
0 votes
1 answer
57 views

Short description of encryption methods? [closed]

I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them. Hash then encrypt MAC then encrypt Encrypt and MAC Encrypt then MAC
user avatar
  • 1
0 votes
0 answers
31 views

How is there a $\frac{1}{poly(n)}$ bias in a multiple-round coin tossing protocol with commitment?

On p.2, Example 1.1 (in this paper), there is a description of a coin tossing protocol with bias 1/4. In the paragraph below the example, they note that for a protocol with $r$ rounds (assume for the ...
user avatar
  • 189
1 vote
2 answers
137 views

Is there a winning strategy based on this coin-flipping protocol?

Given the coin flipping protocol: A chooses $a \in_R \{0,1\}$ and computes $commit(a,r)$. She sends $commit(a,r)$ to B. B chooses $b \in_R \{0,1\}$ and sends $b$ to A. A sends $open(a,r)$ and B ...
user avatar
  • 189
1 vote
2 answers
132 views

Proving that a protocol is not attackable

Consider the following protocol: $A\rightarrow B: \{N_A,A\}_{pk(B)}$ $B\rightarrow A: \{N_B,N_A\}_{pk(A)}$ $A\rightarrow B: hash(N_B, A, B)$ where it is intended that when either $A$ or $B$ has ...
user avatar
0 votes
0 answers
36 views

PSK based resumption vs session ID/ticket based resumption in TLS

I was reading about TLS 1.3, and noticed how session resumption was done via PSKs instead of Session IDs/Session Tickets. But from what I've understood, PSKs just seem like a combination of Session ...
user avatar
2 votes
0 answers
34 views

What is the purpose of the WireGuard handshake mac1 field?

The mac1 field in the WireGuard handshake messages is populated as: ...
user avatar
1 vote
1 answer
37 views

Version rollback attack prevention in TLS 1.2?

Are there any methods to prevent version rollback attack while using TLS 1.2 (apart from disabling lower versions)? I've read about how TLS 1.3 provides a downgrade protection mechanism which is ...
user avatar
4 votes
3 answers
643 views

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
user avatar
1 vote
0 answers
28 views

Developing a Simmetric Key Distribution protocol to use with rfc6238

I'm trying to develop a Key Distribution Protocol to share symmetric keys in RFC 6238 (OTP). I started with RFC 6063, but this protocol is developed over old and known insecure algorithms like PBKDF ...
user avatar
0 votes
0 answers
27 views

Password Authenticated Key Exchange Protocol

This problem appeared in a past exam paper. In PAKE (password authenticated key exchange) protocols, $A$ and $B$ authenticate each other by knowledge of a shared password that is too weak to allow an ...
user avatar
1 vote
1 answer
58 views

Create an or-proof for a given list of elements with public input

Let $g\in G$ and $h\in H$ be two group generators. Given a list L of m group elements, where $L=(L_1,...,L_m)$, a prover wants to convince a public verifier (namely, a verifier who only has public ...
user avatar
  • 21
1 vote
1 answer
65 views

Anonymous PAKE using two party computation

Let's say client side has a secret password $\pi$. The server has a series of indices $0..n-1$ and a salt associated value $s_i$ for all $i \in \{0,n-1\}$ call it set $S=\{s_i | i \in \{0,n-1\}\}$ ...
user avatar
1 vote
0 answers
40 views

Implementation of a "running hash" on constrained devices

The following link documents a proposal for a TLS-like alternative for constrained devices. https://github.com/lake-wg/edhoc/blob/4f56898808989e449cc412a8b136674202a0ddce/draft-ietf-lake-edhoc.md#...
user avatar
  • 1,313
2 votes
1 answer
73 views

Does TLS use use two symmetric keys in the same way SSH does? One for client to server and one for server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
user avatar
  • 63
4 votes
1 answer
2k views

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
user avatar
  • 63
0 votes
0 answers
65 views

Difference between WhatsApp and Signal implementation of the Open Whisper Protocol

WhatsApp has taken the step of using the Open Whisper Protocol for their message encryption, borrowed from the Signal application. I was wondering if there was any obvious, high level, difference in ...
user avatar
2 votes
1 answer
78 views

Question about malicious security in protocol using OT

I was studying a protocol that used an OT and suddenly and suddenly I realize that I fail to imagine how a protocol using an OT could be malicious secure. Suppose we have a protocol P that use an OT ...
user avatar
  • 21
0 votes
2 answers
105 views

How can I use a secret sharing scheme when the secret is not a number but a statement?

I want to use a secret sharing scheme, where every player $i\in N$ has to share a pair of secrets $(l_i,\nu_{l_i})$, where $l_i$ is a unique code (positive integer) for every player, but $\nu_{l_i}$ ...
user avatar
1 vote
1 answer
112 views

Mathematical formulation for a cryptosystem

I will try to define easily the cryptographic system of this paper. The author designs a communication game for $N$ players. The private information of every player is denoted as $t_i\in T_i$ and ...
user avatar
  • 131
1 vote
1 answer
89 views

Could someone explain the protocol of Yevgeniy Dodis, Shai Halevi, and Tal Rabin in details?

This is from the paper of Yevgeniy Dodis, Shai Halevi, and Tal Rabin Could anyone provide some help about understanding how the following protocol is executed? The game is played based on the sequel ...
user avatar
  • 131
0 votes
1 answer
53 views

Is this a well defined sharing scheme to propose

A proposed secret sharing scheme: Suppose that $p:S\times Y\to X$, with $|Y|\geq|S|$ is a cipher where, $y\in Y$ is the key and $x\in X$ the code, $p$ is bijective, namely $(x,y)$ is associated with ...
user avatar
0 votes
0 answers
47 views

Secure multi-party computation made simple - questions

The scheme that I refer to is from this paper. A secret $s\in D$ is obtained by splitting s into a random sum. We have (actually linear) for any $k$ this $k$-out-of-$k$ secret-sharing scheme: Select $...
user avatar
0 votes
0 answers
26 views

Could you provide the proof of a secure multi - secret sharing scheme that fulfils the requirements of correctness and information-theoretic privacy?

Suppose that we have a multi-secret sharing scheme and let $I$ be the a set of agents. Say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\in S$ such that the share $...
user avatar
1 vote
0 answers
53 views

Could anybody help by applying a secure multiparty secret sharing scheme?

Suppose that we have a multi-secret sharing scheme as it is described in the literature Let there be $I$ agents and say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\...
user avatar
2 votes
0 answers
80 views

Secure multiparty scheme in key (splitting) distribution among the players

Suppose that we have a game with $I$ players and each of them has a private secret say $e_i$. Every player wants to share her secret with the rest of the players but in such a way that she will not be ...
user avatar
0 votes
0 answers
35 views

How can I enrich this mechanism of communication to become more efficient and secure?

Suppose that we have a Bayesian game, where $t_i\in T_i$ denotes the type of player $i$. Say that we have a communication game (communication equilibrium). The players do send each other an encrypted ...
user avatar
0 votes
0 answers
12 views

How to design such a protocol that the agents could replicate the mediator by themselves?

A problem in game theory is that of communication. Taking into account the classic approach of Myerson and Forges, the agents communicate each other, however indirectly, through a communication ...
user avatar
1 vote
0 answers
89 views

xChaCha20 Block Keys for Poly1305

So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
user avatar
  • 111
0 votes
0 answers
41 views

Could anyone provide any idea of such a protocol?

Could anybody provide the seminal paper and/or every specific manual in mathematics that describes a secure multiparty computation procedure, where the players will exchange encrypted messages (...
user avatar
1 vote
0 answers
31 views

Looking for an E2EE protocol

I'm working on an application that allows people to share different types of data with other people that are in the same group. Group limit is 16 people. Logic behind it is very similar to group chats....
user avatar
1 vote
0 answers
58 views

Classic secret sharing schemes vs Homomorphic secret sharing schemes

What is the difference between the classic secret sharing schemes that are used in the protocols of Ben-or and Rabin, Ben-Or, M., Goldwasser, S., Wigderson (that is the Shamir's secret sharing scheme) ...
user avatar
2 votes
1 answer
98 views

Why do we always assume that the functions that the protocols can replicate are of the form $f:\{0,1\}^*\to\{0,1\}^*$?

Taking into account the vast literature of secure multiparty computation and secret sharing, there is a specific assumption that is made for the calculation of a rule function. The latter function ...
user avatar
0 votes
0 answers
13 views

Efficient cheap talk communication in game theory

Are there any papers about efficient cheap talk communication, where the players achieve the equilibrium payoffs of a correlated strategy as in Aumann's seminal paper? Or in case no such paper exists, ...
user avatar
0 votes
1 answer
52 views

How should you manage keys to prevent lateral movement?

Let's say I'm designing a communications protocol that will be used by many pairs of devices to communicate amongst each other (between the pairs only). Assuming the devices in the pair can ...
user avatar
2 votes
1 answer
141 views

Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation?

Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation? The idea is that every player $i$, of $N<+\infty$ players, holds a secret say $s_i$. All of them want to share ...
user avatar
5 votes
2 answers
229 views

Cheapest way to prove that two different private keys are known to the same person?

Say that there are two unrelated ECC keypairs ($Pub_1$, $Priv_1$) and ($Pub_2$, $Priv_2$). Alice claims that she knows both $Priv_1$ and $Priv_2$, but Bob doesn't trust her, and thinks that $Priv_2$ ...
user avatar
0 votes
0 answers
24 views

Rational secure multiparty computation with permuatation secret sharing scheme?

Taking a look in this economic paper they use cryptographic tools to implement correletaed equilibria in the case of two plaeyrs. They use permutations for the exchange of information between the ...
user avatar
0 votes
0 answers
22 views

Secure protocols by implementing cheap talk instead on a centralized mediator to compute any function $f(s_1,...,s_n) = (y_1,...,y_n)$?

Based on this paper a protocol is secure if and only if it satisfies secrecy and resiliency. Most of the papers in ecnomic and computer since deal with the following problem. They consider the case ...
user avatar
4 votes
1 answer
168 views

Is there a difference between the strength of Telgram's (MTproto) forward secrecy and Signal's?

If I understood correctly, the Signal protocol generates a new key after every message sent and forgets the previous one. Telegram, on the other hand, renews the key only after 100 messages or one ...
user avatar
  • 41
0 votes
2 answers
44 views

Understanding MITM in an example authentication protocol

Imagine that we have a protocol like this: B -> A: RB A -> B: {RB,B}K Goal: authenticate A to B K: a shared key between A and B {}K: encrypting by K After receiving {RB, B}K by B, B is able to ...
user avatar
  • 33
1 vote
0 answers
45 views

Secure protocols with the dynamic programming solution concept?

Suppose that we have the usual problem of secure communication, where each of the $I$ agents have a private signal $s_1,s_2,\dots,I$ and they wish to compute any function $f(s_1,s_1,...,s_I)=(x_1,x_2,....
user avatar
  • 131
3 votes
1 answer
80 views

What are Practical Primitives based on Lattices, LWE and FHE?

Lattice-based cryptography is being used for several primitives and applications. I know there are newer works for PIR, PSI, ORAM that have seen tremendous improvements due to FHE. In some cases, FHE ...
user avatar
2 votes
2 answers
168 views

Why do people use protocols like PGP, when TLS already exists?

TLS is the standard cryptography protocol on the internet, and many websites use it to secure their communications. However, for personal use, most people use other protocols like PGP, instead of ...
user avatar
1 vote
1 answer
58 views

Secret sharing is based in random variables that are uniformly distributed?

In Rabin and Ben-Or, their basic assumption is that each participant can broadcast a message to all other participants and that each pair of participants can communicate secretly. Hence, they design a ...
user avatar
0 votes
0 answers
24 views

Secure multiparty protocols proof and why is a necessary condition?

Is there a strict proof for secure multiparty protocols? What do they serve? I mean some have shown the existence for such protocols, but can I use them in order to substitute a mediator in game ...
user avatar

1
2 3 4 5
14