Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
338
votes
13answers
108k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
49
votes
6answers
8k views

Kerckhoffs’ principles – Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
106
votes
5answers
66k views

Should we sign-then-encrypt, or encrypt-then-sign?

We often want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
81
votes
8answers
11k views

Guarding against cryptanalytic breakthroughs: combining multiple hash functions

Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
32
votes
4answers
6k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
28
votes
4answers
3k views

How to fairly select a random number for a game without trusting a third party?

Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.) Can this be done such that each player has the power to be ...
17
votes
1answer
2k views

Why choose an authenticated encryption mode instead of a separate MAC?

What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ...
19
votes
2answers
7k views

Is TrueCrypt's multiple/cascading encryption safe?

Is TrueCrypt use of cascading encryption safe? Is it useful? TrueCrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very ...
13
votes
8answers
2k views

Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
21
votes
3answers
2k views

Is using slow password hashing on the client side easier attackable than on the server side?

As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
7
votes
1answer
4k views

Is a known plaintext, ciphertext, and public-key a viable attack on RSA?

Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key. Alice and Bob each have their public- and private-key pairs ($\left[...
27
votes
1answer
7k views

Zero knowledge proof protocol example?

Alice is color blind. She never knows if her gloves are matched. Her brother Bob always teases her saying her gloves are mismatched and she should go change them. Alice wants to know if Bob ...
21
votes
2answers
24k views

Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
9
votes
3answers
353 views

Can a device prove the identity of its own code?

Say you have a computing system that has some functionality that is not in itself cryptographically secure, but you want to make sure is executed as specified, and, e.g. an adversary hasn't re-flashed ...
50
votes
7answers
7k views

One Encryption, Many Decryption Keys

I would like to share access to encrypted data among many recipients. I do not know the recipients ahead of time (when encrypting the data). Once the data is encrypted, I do not have access to the ...
27
votes
3answers
2k views

Is this password migration strategy secure?

I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
12
votes
2answers
1k views

What is a “rewinding argument”?

I've been reading a bit about cryptographic protocols and I keep seeing the phrase "rewinding argument". I've been unable to find a good source that would explain what is meant by this. It seems like ...
11
votes
3answers
2k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
8
votes
1answer
2k views

Can I use a HMAC for Replay Attack protection?

I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
20
votes
2answers
6k views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
6
votes
2answers
2k views

Zero-knowledge proof of a product

I have non-negative integers $x,y,z$. I'm going to give you commitments $C(x),C(y),C(z)$ to them. Then, I would like to prove in zero knowledge that $xy=z$. I can choose the commitment scheme to ...
5
votes
1answer
514 views

Is it a requirement to understand mathematics when implementing (or breaking) cryptography? [duplicate]

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology In the context of putting crypto into ...
8
votes
1answer
2k views

A fair peer-based coin-flipping protocol?

I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight. This is how my idea ...
8
votes
1answer
1k views

Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
5
votes
1answer
648 views

Security of zero knowledge proof protocols

When designing a protocol based on zero knowledge proofs, be it based on the discrete log problem, or on a Hamiltonian cycle in a graph, or something else, I assume there are security considerations, ...
4
votes
2answers
107 views

Protocol to identify zone of potential agreement without revealing reservation prices and having to trust third parties?

A wants to buy a company from B. Before A and B enter negotiations, they want to make sure that there actually is a zone of potential agreement. Obviously, they don't want to communicate their ...
5
votes
2answers
630 views

Provable Encryption

Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key? Alice chooses some plaintext, then she encrypts it with a certain scheme. She also ...
4
votes
1answer
499 views

One ciphertext, multiple keys, multiple messages

I recently came across following idea, does anyone know a name and if it is actually used? A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (...
3
votes
3answers
319 views

Zero-knowledge transfer of value protocol inspired by EC El Gamal

This is a follow up on the question I asked here. I designed a scheme that allows the following: Alice has a value $a$ which she wants to keep secret Bob has a value $b$ which he wants to keep secret ...
2
votes
2answers
177 views

How to contruct a pseudorandom with a specific property

How to construct a pseudorandom function $PRF$ with the following property: Probability that $PRF(k_1,i)=PRF(k_2,i)$ is negligible, for all keys $k_1,k_2$ such that $k_1\neq k_2$ Does the PRF with ...
2
votes
2answers
1k views

Benefit of combining classical substitution ciphers with modern cryptography

I know that a simple monoalphabetic substitution cipher is considered extremely weak, on account of linguistic frequency-analysis attacks. However, assume the following: cleartext is encrypted (with ...
1
vote
2answers
189 views

Why is there a counter in CSPRNGs?

This is probably one of those embarrassingly simple questions, but here goes. Consider the following two constructs: CSPRNG made out of a block cipher (AES) with a counter such as CSPRNG made ...
0
votes
1answer
541 views

How to secure a mental poker protocol? [closed]

I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
0
votes
1answer
92 views

How To prove Any Change to $v=a\cdot y+b$ maks $y=(a)^{−1}\cdot (v−b)$ Uni. random value [closed]

This question is related to data integrity. Let a finite field be $\mathbb{F}_p$, where $p$ is a prime number. I have a fixed value $y$ and two uniformly random values $a$ and $b$. Hypothesis: $a,...
50
votes
3answers
12k views

Signal vs Telegram in terms of protocols?

Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective ...
6
votes
2answers
2k views

Tools for modelling and analysis of cryptographic protocols

I am designing some cryptographic protocols and I am new to it. Are there any well-known tools that can be used to model and design these protocols? And also verify or analyze their validity? If not ...
17
votes
3answers
23k views

How does a rolling code work?

I have general questions regarding rolling codes. Basically there is a sender and a receiver. Both have a sequence generator. The receiver checks if the received sequence matches the newly generated. ...
22
votes
3answers
1k views

Cryptographic Challenge: How to Say Something Confidentially to Snowden?

The Snowden situation raises an intereting cryptograpic problem. At present, how can something be sent confidentially to Snowden? Claim: I have no particular political orientation. The above ...
11
votes
5answers
2k views

How to use proof of lack of knowledge?

This is a purely hypothetical example but is provable ignorance useful in cryptography? For example, let's say I have a trapdoor collision resistant function. I know the trapdoor and therefore some $...
9
votes
1answer
738 views

Is there a formal language to define a cryptographic protocol?

I wanted to work on a personal project where I would attempt to identify the flaws in a cryptographic protocol. Now for that to work properly, the program should understand the syntax of protocol ...
8
votes
1answer
2k views

Replay attack prevention in connectionless UDP encrypted communication

What are the options for replay attack prevention when two parties exchange UDP messages. No connection or session is estabilished. Communicating parties have pre shared key that is used for ...
14
votes
1answer
2k views

In which situations is a length-extension attack a problem?

A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem? I guess certain naive ...
5
votes
1answer
843 views

Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
4
votes
0answers
237 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
1
vote
1answer
1k views

Is this scheme a provably fair random number generation?

I have thought up a method for generating random numbers between a client and a server which I hope is fair: The client and server decide on a range in advance, $0$ trough $n-1$. The server generates ...
9
votes
1answer
240 views

Secure multiparty computation of conjunction

Suppose Alice and Bob each have bits a and b, respectively. How can Alice and Bob compute the function ...
7
votes
2answers
332 views

Is there a cryptographic solution for this “dating protocol”?

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following dating protocol (due to Bert den Boer): Alice and Bob wish to ...
7
votes
4answers
296 views

Changing algorithms during encryption

Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption. For example,...
6
votes
1answer
2k views

If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
6
votes
1answer
156 views

How to improve long-term duration of standard checksum for authenticity purposes?

Official CMS's of Government gazettes (in the third world), need to publish the checksum of each article and each cited external documentin (eg. full-text contracts) in a permanent support medium like ...