Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

-1
votes
0answers
23 views

MAC/IP address hiding [migrated]

I am doing some experiments with wireless protocols on ns3. What I want to ask is how can I hide MAC address/IP address, because I need it for my experiments? Is it possible to use encryption on these ...
3
votes
3answers
207 views

RSA - What's to stop someone from using the same ciphertext to mimic private key holder?

I've recently looked into fundamentals of RSA and think I understand how it works. However, there's one basic problem I can't seem to figure out. If someone received ciphertext for a given message, ...
8
votes
3answers
1k views

Examples of protocols that are insecure when run concurrently

I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
0
votes
1answer
42 views

Is the following non-interactive zero-knowledge set membership protocol provable secure?

Given the following Zero-knowledge set-membership protocol https://infoscience.epfl.ch/record/128718/files/CCS08.pdf]. That is given in the following steps (Please refer to page 9). The Verifier -...
1
vote
1answer
97 views

Could time lock encryption be implemented through indistinguishable obfuscation?

In the paper "How to build time-lock encryption", the authors give a theoretical solution to build time-lock encryption using multi-linear based witness encryption and blockchain. However, an ...
0
votes
1answer
68 views

Time-release Protocol Implementation

“How to Build Time-Lock Encryption” by Jager “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan I looked through the references, googled, searched GitHub ...
8
votes
1answer
182 views

Obfuscating functions that are mostly zero

Let $f_k(x)$ be a boolean function of two arguments with two properties: The function $f$ can be efficiently computed. The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
2
votes
2answers
60 views

Choice between appending or prepending nonces to ciphertexts

I understand that when using CTR mode it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant. However, ...
1
vote
1answer
98 views

Does such a cryptographic protocol exist?

Persons A, B and C put x€, y€ and z€ in a pot, respectively. Suppose that anyone can make a withdrawal from the pot as long as they prove they have such a right and that the y€ that B deposited is ...
104
votes
5answers
65k views

Should we sign-then-encrypt, or encrypt-then-sign?

We often want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
1
vote
1answer
41 views

Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags(non-deterministic)?

If we use non-deterministic MACs in encrypt-and-authenticate approach, is it secure?
0
votes
0answers
17 views

Efficient interactive proof of existence of path in a graph

Suppose Alice wants to convince Bob that she has found a path of length $M$ between vertices $v$ and $w$ in a certain graph. Bob can verify this claim in $O(M)$ time by having Alice send the list of ...
0
votes
0answers
66 views

Digital Signature Password verification

I currently have this TOFU protocol: First connection: Client generates salt and inputs a password Client saves salt Client hashes password with argon2 and salt Client generates Ed25519 keys Client ...
0
votes
0answers
32 views

When Shamir secret sharing used in one time pad scheme

In the following, all operations are defined over a finite field of prime order. Please note that what I'm explaining below is a part of a bigger protocol, however, to keep things simple I just ...
1
vote
1answer
66 views

Protocol Design for IoT devices having PSK using AES-GCM

Handshake: 1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv" 2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag ...
1
vote
1answer
77 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
1
vote
0answers
40 views

Acceptable points of failure when applying encryption in an application [closed]

I am working an a Windows application that will encrypt and decrypt files using AES Encryption. The 32 byte key which is diversified and derived using a ATSHA204 unique serial number and some addition ...
4
votes
2answers
127 views

MPC protocols for high school kids

I was explaining MPC to a high school student. He was excited and asked me for some examples. The only ones that I could think of are by using garbled circuits. Are there some simple MPC protocols for ...
2
votes
2answers
145 views

What's wrong with this digital signature scheme?

With regards to user authentication... The server sends Alice a randomly chosen number. Alice signs the number and sends the signature back to the server. The server checks the signature using Alice'...
-1
votes
1answer
101 views

When we use one time pad TWICE in two different ways

Assumption and Notations: All the values defined over the field $\mathbb{F}_p$, where $p$ is a large prime number. We denote multiplicative inverse of value $v$ by $v^{-1}$. All values are non-zero ...
0
votes
1answer
27 views

Needham–Schroeder fix by adding opponent's identity to the first message

Recap: Needham–Schroeder is as follows: $A \rightarrow B : \{A, N_a\}_{pk_B}$ $B \rightarrow A : \{N_a, N_b\}_{pk_A}$ $A \rightarrow B : \{N_b\}_{pk_B}$ Then, there is a MITM attack by Lowe ...
0
votes
1answer
97 views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
0
votes
2answers
48 views

cryptographically signed streaming data

On a high level the question is: how does one cryptographically sign streaming data? Here is the context: a number of people are continuously streaming data to me the data is public and does not ...
2
votes
1answer
107 views

X.509 strong authentication protocols

Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
4
votes
2answers
137 views

Why won't a BFT protocol using simple signing/voting work?

PBFT and most consensus algorithms are more complicated than a simple voting scheme. By simple voting I mean the following: we require all nodes to sign their local copy of the state and send this ...
1
vote
1answer
46 views

Facebook app-scoped identifiers and similar - implementing stateless ID obfuscation

After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is ...
1
vote
0answers
86 views

How to prevent reflection attack in Needham-Schroeder in ECB mode?

We know that Needham-Schroeder is vulnerable to a reflection attack as shown here. How can I make it secure using ECB and without using timestamps? I need to modify the protocol. Otwan-Rees is a ...
0
votes
0answers
37 views

Maximum key stream sequence per key/IV pair in communication protocols

In the paper "LIZARD – A Lightweight Stream Cipher for Power-constrained Devices", one of the design rational of Lizard cipher is key stream size per key/iv pair. A5/1 produces only 228 keystream ...
1
vote
1answer
167 views

Zero-knowledge transfer of value protocol II [closed]

This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
1
vote
0answers
47 views

How to create an ultra-secure connection between two clients with xor? [closed]

At work, I was asked to create ultra-secure connection over lan between two computers. It will be some kind of messager. I have a bunch of same random data in them(near 100mb). Also I can start a ...
3
votes
1answer
109 views

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme: generate random seed z using ...
13
votes
8answers
2k views

Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
3
votes
1answer
330 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
7
votes
2answers
327 views

Is there a cryptographic solution for this “dating protocol”?

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following dating protocol (due to Bert den Boer): Alice and Bob wish to ...
2
votes
1answer
66 views

Secure multi-party random number generation

This question is actually continuation of my previous one. Secure multi-party computation for digital signature to implement solution there, I have to generate random data for padding (I will use ...
5
votes
0answers
127 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
3
votes
1answer
559 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
3
votes
2answers
100 views

How to encrypt numeric data on a ticket

I have a customer with an existing ticketing system that generates tickets for events like theaters, movies, football and so on. The information in each ticket is encoded in a 16 decimal digit ...
0
votes
0answers
35 views

Dynamic accumulator with only non-membership witness

Goal: Construct a dynamic accumulator which can add elements and provide non-membership witnesses. I wanted to know if my construction is correct. Consider a group $Z_p$ where $p$ is prime number. ...
3
votes
0answers
304 views

Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
3
votes
1answer
548 views

Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
1
vote
1answer
65 views

Proof of ignorance to prevent “double-spend”?

Suppose I have some knowledge that I want to transfer securely from Alice's computer to Bob's computer, and prove that future breaches to Alice's computer will not reveal that information to someone ...
338
votes
13answers
107k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
1
vote
1answer
50 views

Validating a shared secret between two parties, one bit at a time

What is the following protocol known as? Is it considered secure? Would it work? Background Alice and Bob each have a secret. They wish to determine if they both know the same secret. If they do ...
2
votes
1answer
186 views

Zero Knowledge range proof

I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
1
vote
2answers
108 views

Zero-Knowledge Bingo

Bingo is the game of chance where each player matches the numbers on their card with the numbers that the caller draws at random. When the first player has collected enough called numbers on their ...
1
vote
1answer
43 views

Fairness in Multi party computation

Why for achieving the fairness, less than a half of the parties should be corrupted? ($t<m/2$, where $t$ is the number of corrupted parties and $m$ is the total number of the involved parties). How ...
0
votes
0answers
52 views

Simple but secure method to share secret (128 bit AES key) though an untrusted relay

I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
0
votes
0answers
22 views

Is my reasoning sound in the included scenario?

There is a package that contains a device, the device is activated/deactivated over a short range radio signal - it's function is to detect any unauthorised tampering of the package during the time it ...
1
vote
0answers
100 views

Key Distribution Center Key Protocol Analysis

As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture From my understanding, Notation B in ...