Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
3
votes
1answer
104 views

Mathematical formulation for a cryptosystem

I will try to define easily the cryptographic system of this paper. The author designs a communication game for $N$ players. The private information of every player is denoted as $t_i\in T_i$ and ...
1
vote
1answer
74 views

Could someone explain the protocol of Yevgeniy Dodis, Shai Halevi, and Tal Rabin in details?

This is from the paper of Yevgeniy Dodis, Shai Halevi, and Tal Rabin Could anyone provide some help about understanding how the following protocol is executed? The game is played based on the sequel ...
0
votes
1answer
45 views

Is this a well defined sharing scheme to propose

A proposed secret sharing scheme: Suppose that $p:S\times Y\to X$, with $|Y|\geq|S|$ is a cipher where, $y\in Y$ is the key and $x\in X$ the code, $p$ is bijective, namely $(x,y)$ is associated with ...
0
votes
0answers
32 views

Secure multi-party computation made simple - questions

The scheme that I refer to is from this paper. A secret $s\in D$ is obtained by splitting s into a random sum. We have (actually linear) for any $k$ this $k$-out-of-$k$ secret-sharing scheme: Select $...
0
votes
0answers
21 views

Could you provide the proof of a secure multi - secret sharing scheme that fulfils the requirements of correctness and information-theoretic privacy?

Suppose that we have a multi-secret sharing scheme and let $I$ be the a set of agents. Say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\in S$ such that the share $...
2
votes
0answers
51 views

Could anybody help by applying a secure multiparty secret sharing scheme?

Suppose that we have a multi-secret sharing scheme as it is described in the literature Let there be $I$ agents and say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\...
4
votes
0answers
75 views

Secure multiparty scheme in key (splitting) distribution among the players

Suppose that we have a game with $I$ players and each of them has a private secret say $e_i$. Every player wants to share her secret with the rest of the players but in such a way that she will not be ...
0
votes
0answers
35 views

How can I enrich this mechanism of communication to become more efficient and secure?

Suppose that we have a Bayesian game, where $t_i\in T_i$ denotes the type of player $i$. Say that we have a communication game (communication equilibrium). The players do send each other an encrypted ...
0
votes
0answers
12 views

How to design such a protocol that the agents could replicate the mediator by themselves?

A problem in game theory is that of communication. Taking into account the classic approach of Myerson and Forges, the agents communicate each other, however indirectly, through a communication ...
1
vote
0answers
57 views

xChaCha20 Block Keys for Poly1305

So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
1
vote
0answers
39 views

Could anyone provide any idea of such a protocol?

Could anybody provide the seminal paper and/or every specific manual in mathematics that describes a secure multiparty computation procedure, where the players will exchange encrypted messages (...
1
vote
0answers
26 views

Looking for an E2EE protocol

I'm working on an application that allows people to share different types of data with other people that are in the same group. Group limit is 16 people. Logic behind it is very similar to group chats....
1
vote
0answers
42 views

Classic secret sharing schemes vs Homomorphic secret sharing schemes

What is the difference between the classic secret sharing schemes that are used in the protocols of Ben-or and Rabin, Ben-Or, M., Goldwasser, S., Wigderson (that is the Shamir's secret sharing scheme) ...
3
votes
1answer
88 views

Why do we always assume that the functions that the protocols can replicate are of the form $f:\{0,1\}^*\to\{0,1\}^*$?

Taking into account the vast literature of secure multiparty computation and secret sharing, there is a specific assumption that is made for the calculation of a rule function. The latter function ...
0
votes
0answers
12 views

Efficient cheap talk communication in game theory

Are there any papers about efficient cheap talk communication, where the players achieve the equilibrium payoffs of a correlated strategy as in Aumann's seminal paper? Or in case no such paper exists, ...
0
votes
1answer
44 views

How should you manage keys to prevent lateral movement?

Let's say I'm designing a communications protocol that will be used by many pairs of devices to communicate amongst each other (between the pairs only). Assuming the devices in the pair can ...
4
votes
1answer
115 views

Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation?

Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation? The idea is that every player $i$, of $N<+\infty$ players, holds a secret say $s_i$. All of them want to share ...
5
votes
2answers
206 views

Cheapest way to prove that two different private keys are known to the same person?

Say that there are two unrelated ECC keypairs ($Pub_1$, $Priv_1$) and ($Pub_2$, $Priv_2$). Alice claims that she knows both $Priv_1$ and $Priv_2$, but Bob doesn't trust her, and thinks that $Priv_2$ ...
0
votes
0answers
22 views

Rational secure multiparty computation with permuatation secret sharing scheme?

Taking a look in this economic paper they use cryptographic tools to implement correletaed equilibria in the case of two plaeyrs. They use permutations for the exchange of information between the ...
0
votes
0answers
22 views

Secure protocols by implementing cheap talk instead on a centralized mediator to compute any function $f(s_1,...,s_n) = (y_1,...,y_n)$?

Based on this paper a protocol is secure if and only if it satisfies secrecy and resiliency. Most of the papers in ecnomic and computer since deal with the following problem. They consider the case ...
4
votes
1answer
145 views

Is there a difference between the strength of Telgram's (MTproto) forward secrecy and Signal's?

If I understood correctly, the Signal protocol generates a new key after every message sent and forgets the previous one. Telegram, on the other hand, renews the key only after 100 messages or one ...
0
votes
2answers
43 views

Understanding MITM in an example authentication protocol

Imagine that we have a protocol like this: B -> A: RB A -> B: {RB,B}K Goal: authenticate A to B K: a shared key between A and B {}K: encrypting by K After receiving {RB, B}K by B, B is able to ...
1
vote
0answers
38 views

Secure protocols with the dynamic programming solution concept?

Suppose that we have the usual problem of secure communication, where each of the $I$ agents have a private signal $s_1,s_2,\dots,I$ and they wish to compute any function $f(s_1,s_1,...,s_I)=(x_1,x_2,....
3
votes
0answers
59 views

What are Practical Primitives based on Lattices, LWE and FHE?

Lattice-based cryptography is being used for several primitives and applications. I know there are newer works for PIR, PSI, ORAM that have seen tremendous improvements due to FHE. In some cases, FHE ...
2
votes
2answers
123 views

Why do people use protocols like PGP, when TLS already exists?

TLS is the standard cryptography protocol on the internet, and many websites use it to secure their communications. However, for personal use, most people use other protocols like PGP, instead of ...
1
vote
1answer
56 views

Secret sharing is based in random variables that are uniformly distributed?

In Rabin and Ben-Or, their basic assumption is that each participant can broadcast a message to all other participants and that each pair of participants can communicate secretly. Hence, they design a ...
0
votes
0answers
23 views

Secure multiparty protocols proof and why is a necessary condition?

Is there a strict proof for secure multiparty protocols? What do they serve? I mean some have shown the existence for such protocols, but can I use them in order to substitute a mediator in game ...
2
votes
0answers
23 views

Example of exchanging information

I am searching for a simle model that can simulate the following procedure. Suppose that $i$ and $j$ are two agents that each one obtains her state dependets signal $s_i(\omega)$ and $s_j(\omega)$. ...
3
votes
0answers
42 views

Algorithmic game theory and protocol design for communication

There is a field of exchanging information that combines cryptography and game theory. I am interested in understanding this field, but it's a little complex for me. To begin with there is a paper of ...
2
votes
2answers
227 views

Different secret sharing schemes instead of Shamir's?

Are there any different secret sharing schemes instead of Shamir's Secret Sharing , that is not based in polynomial interpolation over finite fields? Or is it the most efficient than the others?
2
votes
0answers
66 views

Why can proverif not find value that I just created?

I have a really simple ProVerif problem. My current proverif code looks like this: ...
1
vote
0answers
39 views

Scheme where earlier hashes provide "hints" to find same or nearby hashes

I am looking for a hash methodology that allows previous hashes to provide "hints" to find same or nearby hashes: if I expect to find a message $M = P + U$ consisting of private $P$ and ...
1
vote
1answer
37 views

Is there a secure two party protocol that makes P1 (with x as input) gets rx+r' and P2 gets (r,r')

It should be a secure two party protocol against malicious adversary. P1's input is X in Zp* (p is a prime number); P2's input is nothing. P1's output is rX+r'. r,r' are random numbers from Zp* P2' ...
0
votes
0answers
19 views

What security properties do I lose when letting the group creator choose group keys in a protocol similar to the Signal Protocol?

As far as I know Whatsapp ,Signal and co in their group channels first used the already existing peer-to-peer channels between the participants and protected using the Double Ratchet Algorithm to ...
1
vote
1answer
100 views

Proof that someone has access to a private key whose public key is part of a known group

I'm a crypto newbie and hoping to get pointed in the right direction. I've seen some related questions like this but none that satisfy my requirements. Let's say Jane's Forum is a large community, and ...
0
votes
0answers
49 views

Why does CMS' PasswordRecipient use a KEK?

When using openssl cms -encrypt -pwri_password, it follows the process described in RFC 3211, which passes the user-provided password into a KDF, but then, rather ...
1
vote
0answers
34 views

Security proof for TLS 1.x

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys. It is also stated that, if TLS 1.2 was to be modified ...
0
votes
1answer
62 views

Detect if two numbers are equal without disclosing further information

Consider the following scenario. Alice picks a number A; Bob picks a number B. Both A and B belong to a relatively small set X (by small I mean that X can be easily looped through: for intuition sake, ...
1
vote
0answers
27 views

Composite order ECC and Ristretto

I've been looking at ristretto.group, and its really cool. I understand for some protocols we need curve points to behave as if they were from a prime order curve. I have a few questions on this, Do ...
0
votes
0answers
50 views

What security does the BMR protocol offer against corruption?

I've been conducting some research into general-purpose MPC protocols and have been unable to pinpoint the exact security offered by the BMR protocol. The reference I've been using for the majority of ...
1
vote
1answer
79 views

In TLS 1.3, what is the rational for using different handshake transcripts for Resumption Master Secret vs Application Traffic Secrets?

The TLS 1.3 RFC, section 7.1 lists this as the last part of the key schedule: https://datatracker.ietf.org/doc/html/rfc8446#section-7.1 ...
2
votes
1answer
82 views

What happen if the curve used in key agreement protocol also used in signature inside of protocol? [duplicate]

In key agreement (or key exchange) protocols, is used signature for authentication. Suppose that key exchange protocols execute on elliptic curve. The initiator of protocol must sends signature of his ...
6
votes
1answer
153 views

Is there any cryptographic reason to sign over the signature algID and params?

It seems to be common-practice for a signature protocol to include the algorithmID and params (if any) in the data being signed. For example: RSA PKCS#1 v1.5 includes the digest alg in the data being ...
0
votes
0answers
38 views

Is there a name for this simple identity verification scheme?

Once, while idly wondering, I came up with a simple scheme to prove the authenticity of a chain of messages given the authenticity of the first. It consists of putting a hash at the end of each ...
0
votes
0answers
25 views

Few questions about setting up SuperCop primitives

Have a couple of questions about the supercop library. I've refrained from asking this question for a considerable amount of time because every time I thought about asking it, it sounded stupid in my ...
0
votes
1answer
64 views

Is this protocol secure?

Before anyone freaks out, this is purely speculative and I am not developing a cryptosystem! I can't see anything wrong with this protocol, but my knowledge of cryptography is rather superficial: ...
1
vote
2answers
159 views

Is it safe to say that a XOR with an unknown input provides a random output?

I am wondering if you have an input $x_{1}$ and you XOR it with an unknown random second input $x_{2}$, is it safe to say that the resulting $x_{1}\oplus x_{2}$ will be random ? The final idea would ...
2
votes
0answers
30 views

Failure of parallel composition [duplicate]

Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of ...
1
vote
1answer
63 views

what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?

Related question here. I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
1
vote
3answers
125 views

How can a recipient recognize which encrypted messages are intended for them?

Let's say there's a decentralized email service where parties' public keys are known. A sender sends a message to a recipient by encrypting via RSA with the recipient's public key and posting the ...

1
2 3 4 5
14