Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
0 votes
1 answer
44 views

Honest programming language for malicious adversaries in MPC protocols

One method to create a secure MPC protocol against malicious adversaries is to create a secure protocol against semi-honest adversaries and then add some zero-knowledge proofs to ensure that the ...
1 vote
0 answers
22 views

Does the private blockchain have to follow client-server model when considering BFT?

I'm a newbie, currently interested in data security & integrity. I'm quite new to blockchain and distributed system theories, and suffering from some unclear doubts/questions on the fault-tolerant ...
  • 11
0 votes
0 answers
13 views

Will this RSA-based cross-signing schema work for preventing forgery?

I am a web developer and a newbie in cryptography, so my question may sound not very related to this community, let me know if so, and where to ask. Context is a distributed application, to exchange ...
1 vote
1 answer
48 views

Public key fingerprint verification for large groups

If you were designing: An open source client that offered E2E encryption for e.g. folder sharing between users Each user had public keys for signing (and separate public keys for encryption of ...
3 votes
0 answers
55 views

How to create an encryption such that we need two keys to decrypt, while one key is derivable from the other if I have the secret

Suppose I have some plaintext $M$, and I want to have some process $f$ to make ciphertext $M':=f(M,s)$, where $s$ is some secret. The ciphertext $M'$ can be decrypted by using some decryption process $...
1 vote
0 answers
30 views

Is there a scheme for voting on decrypting a message with a variable voter count?

I am wondering if there might be a scheme for the following scenario: Let's suppose a government wants a truly democratic intelligence agency. For this the government publishes all intelligence ...
0 votes
0 answers
45 views

Oblivious transfer protocol to retrieve k elements

The sever holds the N encrypted elements, each element is associated with an index (unencrypted). The receiver wants to retrieve only k-out-N elements using k-out-N OT. The motivation for using OT is ...
1 vote
1 answer
35 views

How would you design an API server to store user sercrets?

This is not for a production application, but just my exploration to help me understand cryptography. At the simplest level, I want to design a key-value store for user secrets. This is exposed over ...
user avatar
0 votes
1 answer
96 views

Shamir Secret Sharing over an unsecure channel for a protocol design

Let's suppose that we have two parties, $A$ and $B$ that are using a Shamir Secret Sharing scheme with $k=3$. $A$ holds the points $[x_1, f(x_1)]$ and $[x_2, f(x_2)]$ while $B$ holds $[x_3, f(x_3)]$ ...
  • 13
1 vote
0 answers
51 views

Using multiple asymmetric keys as backups for one another

I've been thinking about ways to take advantage of multiple asymmetric encryption schemes so that each key could be a backup to the others in case of cryptanalysis of one given scheme. Those public ...
0 votes
0 answers
50 views

Bloackchain e-voting: verfiy that voter is allowed to vote but didnt already voted, without reaviling his identity

I am trying to make a e-voting system based on blockchain and I am trying to think about a way that i can verify that a vote is legal without reavling the identity of the voter. One of the solutions ...
0 votes
0 answers
80 views

How to encrypt keys in a content-addressable store, for lookup and enumeration

I'm implementing a content-addressable file store - similar to a key/value store, but the key is always a hash of the value. I'd like to build an encryption layer for it, to hide what data is being ...
0 votes
1 answer
41 views

Would a consensus algorithm like the one I describe work?

Given n nodes(miners/validators), Every unspent transaction output is broadcasted to all n nodes. Each node will select a batch of transactions and add it to their block. The specific mechanism of ...
1 vote
1 answer
171 views

How should I interpret this definition of the Dolev Yao Closure?

Please see the image below which represents an algebraic definition of the Dolev Yao Closure. From reading around, it appears this is BAN logic and that the lines mean "If you believe the above ...
  • 113
0 votes
1 answer
47 views

How to know who is an attacker in byzantine broadcast?

2 requirements of Byzantine broadcast (consistency and validity) only state honest node should output certain bit without mentioning what should malicious nodes do. How do we know the identity of each ...
1 vote
1 answer
102 views

Why lattice based cryptographic schemes usually are not bandwidth efficient?

The question is mainly stated in the title. I am new to lattices and I have a basic understanding of them but not something in depth. I was watching a presentation of of a VSS (Verifiable Secret ...
  • 816
0 votes
2 answers
85 views

Encryption algorithm where proving the decryption is equal to spoiling the key?

Is there an encryption algorithm or MAC algorithm for which NO zero-knowledge-proof exists, provably? I want people who want to prove that a ciphertext decrypts into some plaintext to have to spoil ...
  • 115
1 vote
1 answer
143 views

Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?

Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
  • 14.4k
0 votes
0 answers
32 views

Verifying meeting by sending same signed random number to central authority?

I am trying to develop a simple protocol for two users to verify (with respect to a trusted central authority) that they have (intentionally) met/communicated with each other. My idea was this: Users ...
  • 101
0 votes
1 answer
68 views

Short description of encryption methods? [closed]

I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them. Hash then encrypt MAC then encrypt Encrypt and MAC Encrypt then MAC
  • 1
0 votes
0 answers
33 views

How is there a $\frac{1}{poly(n)}$ bias in a multiple-round coin tossing protocol with commitment?

On p.2, Example 1.1 (in this paper), there is a description of a coin tossing protocol with bias 1/4. In the paragraph below the example, they note that for a protocol with $r$ rounds (assume for the ...
  • 311
1 vote
2 answers
144 views

Is there a winning strategy based on this coin-flipping protocol?

Given the coin flipping protocol: A chooses $a \in_R \{0,1\}$ and computes $commit(a,r)$. She sends $commit(a,r)$ to B. B chooses $b \in_R \{0,1\}$ and sends $b$ to A. A sends $open(a,r)$ and B ...
  • 311
1 vote
2 answers
135 views

Proving that a protocol is not attackable

Consider the following protocol: $A\rightarrow B: \{N_A,A\}_{pk(B)}$ $B\rightarrow A: \{N_B,N_A\}_{pk(A)}$ $A\rightarrow B: hash(N_B, A, B)$ where it is intended that when either $A$ or $B$ has ...
0 votes
0 answers
125 views

PSK based resumption vs session ID/ticket based resumption in TLS

I was reading about TLS 1.3, and noticed how session resumption was done via PSKs instead of Session IDs/Session Tickets. But from what I've understood, PSKs just seem like a combination of Session ...
3 votes
1 answer
108 views

What is the purpose of the WireGuard handshake mac1 field?

The mac1 field in the WireGuard handshake messages is populated as: ...
1 vote
1 answer
69 views

Version rollback attack prevention in TLS 1.2?

Are there any methods to prevent version rollback attack while using TLS 1.2 (apart from disabling lower versions)? I've read about how TLS 1.3 provides a downgrade protection mechanism which is ...
4 votes
3 answers
655 views

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
1 vote
0 answers
31 views

Developing a Simmetric Key Distribution protocol to use with rfc6238

I'm trying to develop a Key Distribution Protocol to share symmetric keys in RFC 6238 (OTP). I started with RFC 6063, but this protocol is developed over old and known insecure algorithms like PBKDF ...
0 votes
0 answers
33 views

Password Authenticated Key Exchange Protocol

This problem appeared in a past exam paper. In PAKE (password authenticated key exchange) protocols, $A$ and $B$ authenticate each other by knowledge of a shared password that is too weak to allow an ...
1 vote
1 answer
65 views

Create an or-proof for a given list of elements with public input

Let $g\in G$ and $h\in H$ be two group generators. Given a list L of m group elements, where $L=(L_1,...,L_m)$, a prover wants to convince a public verifier (namely, a verifier who only has public ...
  • 79
1 vote
1 answer
87 views

Anonymous PAKE using two party computation

Let's say client side has a secret password $\pi$. The server has a series of indices $0..n-1$ and a salt associated value $s_i$ for all $i \in \{0,n-1\}$ call it set $S=\{s_i | i \in \{0,n-1\}\}$ ...
3 votes
1 answer
89 views

Implementation of a "running hash" on constrained devices

The following link documents a proposal for a TLS-like alternative for constrained devices. https://github.com/lake-wg/edhoc/blob/4f56898808989e449cc412a8b136674202a0ddce/draft-ietf-lake-edhoc.md#...
  • 2,056
2 votes
1 answer
111 views

Does TLS use use two symmetric keys in the same way SSH does? One for client to server and one for server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
  • 73
5 votes
1 answer
2k views

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
  • 73
0 votes
0 answers
97 views

Difference between WhatsApp and Signal implementation of the Open Whisper Protocol

WhatsApp has taken the step of using the Open Whisper Protocol for their message encryption, borrowed from the Signal application. I was wondering if there was any obvious, high level, difference in ...
2 votes
1 answer
91 views

Question about malicious security in protocol using OT

I was studying a protocol that used an OT and suddenly and suddenly I realize that I fail to imagine how a protocol using an OT could be malicious secure. Suppose we have a protocol P that use an OT ...
  • 21
0 votes
2 answers
185 views

How can I use a secret sharing scheme when the secret is not a number but a statement?

I want to use a secret sharing scheme, where every player $i\in N$ has to share a pair of secrets $(l_i,\nu_{l_i})$, where $l_i$ is a unique code (positive integer) for every player, but $\nu_{l_i}$ ...
1 vote
1 answer
120 views

Mathematical formulation for a cryptosystem

I will try to define easily the cryptographic system of this paper. The author designs a communication game for $N$ players. The private information of every player is denoted as $t_i\in T_i$ and ...
  • 131
1 vote
1 answer
96 views

Could someone explain the protocol of Yevgeniy Dodis, Shai Halevi, and Tal Rabin in details?

This is from the paper of Yevgeniy Dodis, Shai Halevi, and Tal Rabin Could anyone provide some help about understanding how the following protocol is executed? The game is played based on the sequel ...
  • 131
0 votes
1 answer
53 views

Is this a well defined sharing scheme to propose

A proposed secret sharing scheme: Suppose that $p:S\times Y\to X$, with $|Y|\geq|S|$ is a cipher where, $y\in Y$ is the key and $x\in X$ the code, $p$ is bijective, namely $(x,y)$ is associated with ...
1 vote
0 answers
54 views

Could anybody help by applying a secure multiparty secret sharing scheme?

Suppose that we have a multi-secret sharing scheme as it is described in the literature Let there be $I$ agents and say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\...
2 votes
0 answers
93 views

Secure multiparty scheme in key (splitting) distribution among the players

Suppose that we have a game with $I$ players and each of them has a private secret say $e_i$. Every player wants to share her secret with the rest of the players but in such a way that she will not be ...
1 vote
0 answers
142 views

xChaCha20 Block Keys for Poly1305

So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
  • 123
1 vote
0 answers
35 views

Looking for an E2EE protocol

I'm working on an application that allows people to share different types of data with other people that are in the same group. Group limit is 16 people. Logic behind it is very similar to group chats....
1 vote
0 answers
87 views

Classic secret sharing schemes vs Homomorphic secret sharing schemes

What is the difference between the classic secret sharing schemes that are used in the protocols of Ben-or and Rabin, Ben-Or, M., Goldwasser, S., Wigderson (that is the Shamir's secret sharing scheme) ...
2 votes
1 answer
107 views

Why do we always assume that the functions that the protocols can replicate are of the form $f:\{0,1\}^*\to\{0,1\}^*$?

Taking into account the vast literature of secure multiparty computation and secret sharing, there is a specific assumption that is made for the calculation of a rule function. The latter function ...
1 vote
1 answer
81 views

How should you manage keys to prevent lateral movement?

Let's say I'm designing a communications protocol that will be used by many pairs of devices to communicate amongst each other (between the pairs only). Assuming the devices in the pair can ...
2 votes
1 answer
169 views

Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation?

Can anybody explain the proof of Rabin and Ben-or of secure multiparty computation? The idea is that every player $i$, of $N<+\infty$ players, holds a secret say $s_i$. All of them want to share ...
5 votes
2 answers
285 views

Cheapest way to prove that two different private keys are known to the same person?

Say that there are two unrelated ECC keypairs ($Pub_1$, $Priv_1$) and ($Pub_2$, $Priv_2$). Alice claims that she knows both $Priv_1$ and $Priv_2$, but Bob doesn't trust her, and thinks that $Priv_2$ ...
4 votes
1 answer
207 views

Is there a difference between the strength of Telgram's (MTproto) forward secrecy and Signal's?

If I understood correctly, the Signal protocol generates a new key after every message sent and forgets the previous one. Telegram, on the other hand, renews the key only after 100 messages or one ...
  • 41

1
2 3 4 5
14