Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

6
votes
1answer
153 views

In coin flipping protocols, why aborting is allowed, and why the non-aborting party flips a coin at the end?

To convey how an adversary can bias the coin, most often a simple commitment-based two party coin-tossing protocol is given, as in [1]: Alice sends Bob the commitment $c = commit(x)$ Bob sends Alice ...
1
vote
0answers
145 views

Leak information (new setting)

This question is similar to Leak Information?, but with new settings. Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at ...
3
votes
1answer
94 views

shared symmetric key

Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify ...
0
votes
1answer
39 views

How can I prove I'm the recipient of an encrypted message without revealing my identity and the message?

Alice wants to leave a message for Bob. So she encrypt a signed message with Bob's public key. Then leaves it at a dead drop service. Then later Bob arrives and checks the messages and attempts to ...
2
votes
1answer
51 views

Would it be possible to negotiate a key of 128 or 256 bits strength using Merkle puzzles?

One can be fascinated by the simplicity of the schemes created by Ralf Merkle; like the Merkle tree or his key negociation protocol over an insecure channel. Wikipedia has some material on "Merkle ...
1
vote
1answer
224 views

Storing Salt in Ciphertext?

I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
2
votes
1answer
147 views

Key establishment from secret answer to a question using Socialist Millionaire Protocol

I have read this as telling that two parties sharing a low-entropy secret (such as a secret answer to a question) can use it to establish a high-entropy shared secret key across a classical insecure ...
3
votes
3answers
134 views

How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...
2
votes
2answers
300 views

Doing RSA-KEM with RSA-OAEP

I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/...
1
vote
1answer
47 views

Does semi-honest adversary eavesdrop honest parties communication?

Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to ...
0
votes
1answer
55 views

Conditional $k,n$ secret sharing

I would like to know if there is a way to place a condition on $k$-out-of-$n$ secret sharing such that out of $k$ participants who can pool their shares to reconstruct a secret, one of them should ...
3
votes
1answer
90 views

X.509 strong authentication protocols

Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
4
votes
0answers
96 views

Proof of knowledge of exponentiations

I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of ...
3
votes
1answer
65 views

Robust combiner for preimage resistance

My question is about chaining two hash functions to create a robust combiner for preimage resistance. @Zooko already gave a detailed answer here: $$H_{\circ}(x) = H_0(H_1(x))$$ is as strong as ...
4
votes
2answers
122 views

Why won't a BFT protocol using simple signing/voting work?

PBFT and most consensus algorithms are more complicated than a simple voting scheme. By simple voting I mean the following: we require all nodes to sign their local copy of the state and send this ...
2
votes
2answers
106 views

Bellovin ESP Attack on UDP Packets

In Bellovin's ESP Attack, it is stated that: If $L_A$, $L_B$ are using UDP, attack is easier: Wait till session ends Allocate $L_B$'s UDP port to $X_B$ Replay all packets So, how ...
6
votes
1answer
568 views

Secure group chat with large groups

I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group. Whatsapp also limits group size to ...
1
vote
1answer
79 views

Multi User limited Time Encryption of big Datasets

Updated Question: New Thread Original Question: (Thanks cypherfox for answering that one) I am in need to store data > 100 TB on a local network share (NAS/SAN) and grant individuals access to the ...
1
vote
1answer
43 views

Algorithm design to verify an assertion on encrypted values

I'm trying to design some kind of protocol but I'm stuck, need some help please.. Given $ (a,b,c)\in \mathbb{N}^+$ with $ a + b = c $ I need to send an asymmetric encrypted version of a,b and c ...
1
vote
1answer
218 views

mbed tls DTLS v1.2 system with -ECDHE-ECDSA, mutual auth and pre-installed public/private keys, no unnecessary messages or ASN.1/X.509 decoding

I am designing an IoT system based on Silicon Labs EFR32 MCUs with hardware accelerated support for SHA-256, AES-128-CBC and ECC (m255) computation. The system will communicate over a proprietary ...
2
votes
0answers
43 views

Unanimity for three (or more) players

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following unanimity protocol for three players: Three players want to ...
4
votes
2answers
153 views

Role of session identifier in Otway-Rees protocol

According to Wikipedia, Otway-Ress protocol is as follow: The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$...
0
votes
1answer
64 views

Analysing communication complexity of a protocol

My question is more about the practical side of designing crypto. protocols and it is related to complexity. So, if you think it's irrelevant to this forum please kindly let me know and I will remove ...
2
votes
2answers
90 views

Fully homomorphic encryption with polynomials

I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea. Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
7
votes
2answers
313 views

Is there a cryptographic solution for this “dating protocol”?

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following dating protocol (due to Bert den Boer): Alice and Bob wish to ...
2
votes
1answer
75 views

Homomorphic encryption of logical OR/AND

Are there any ways to perform homomorphic encryption of logical OR (or logical AND) without using fully homomorphic encryption?
6
votes
0answers
1k views

Has Telegram security been significantly improved with MTProto 2.0?

Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...
0
votes
2answers
100 views

Decentralised blind leader election

I am looking for a decentralised leader election protocol where each node knows whether or not they were elected leader, but nothing else. In particular, this "blindness" property means a node that ...
0
votes
1answer
199 views

What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user?

What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user? For example say I have a database table with 50 columns ...
5
votes
1answer
515 views

Challenge / Response to Prevent Replay Attack - Using nonce as challenge

I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other. My plan ...
1
vote
0answers
95 views

Zero Knowledge Proof

In the following protocol $(P,V)$, prover $P$ and verifier $V $have common input $(N,X) \epsilon QR$ while the prover also has private input $x \epsilon SR(N,X)$. Let $SR(N,X) = \{x \epsilon$ $Z_{n}^{*...
1
vote
2answers
175 views

Why is there a counter in CSPRNGs?

This is probably one of those embarrassingly simple questions, but here goes. Consider the following two constructs: CSPRNG made out of a block cipher (AES) with a counter such as CSPRNG made ...
0
votes
1answer
241 views

Is there an application of fully homomorphic encryption scheme such that encryption key and evaluation key are different?

I want know if there is an application of FHE contains three kinds of users such that: $A$ is the data owner and she has the secret key. $B$ only has the permissions to encrypt (just like a general ...
2
votes
1answer
75 views

How do quantum key distribution systems tolerate noise?

It seems to me that any noise in the signal would result in Alice and Bob generating different keys, without a simple way to tell the difference. How do quantum key distribution systems tolerate ...
2
votes
0answers
74 views

Plaintext DH keys in the message header in the Double Ratchet Algorithm

I've been reading details about the Double Ratchet algorithm, and I wanted some clarification regarding the aspect of the DH public keys going out in the plain in the header of every message. Quoting ...
3
votes
1answer
2k views

Equal sign with a “c”

I am not sure whether this is common sense, but I really don't know what this $c$ means in an equivalent sign, from Lindell's How to Simulate It: $$\big\{(S_1(1^n, x, f_1(x,y)), f(x,y))\big\}\...
0
votes
1answer
90 views

RSA Protocol/Generating Primes

So, Alice wants to use the RSA protocol and pays Cindy to generate the two (odd) primes p and w so she can use e=65537 and n=pw as her public key. Alice will then, upon receipt of p and w, privately, ...
0
votes
1answer
55 views

Proving knowledge of a value and computation that uses it

Alice picks random points P and Q in a group where DLP w.r.t. a base point G is hard (I am ...
1
vote
3answers
217 views

Generating OTP using Digital Dead Drop

I've had a thought and I'm wondering if this would be a useful way to devise and distribute a one-time pad. It relies on a digital dead drop and a hash function. The digital dead drop could take a ...
2
votes
3answers
170 views

RSA - What's to stop someone from using the same ciphertext to mimic private key holder?

I've recently looked into fundamentals of RSA and think I understand how it works. However, there's one basic problem I can't seem to figure out. If someone received ciphertext for a given message, ...
2
votes
3answers
448 views

Security concern with TOTP

I am pretty new to cryptography and I have been studying up on TOTP (Time Based OTP) and while I have learnt how the computation works, I'm unable to figure out why using TOTP makes a system more ...
1
vote
1answer
130 views

How to generate two different keys out of a single password?

I'm designing a system in which a password is used both for logging in as well as for encrypting some payload. To encrypt a payload I derive a key from the password. Very straightforward so far. ...
1
vote
1answer
158 views

The parameters included in TLS 1.2 server signature in the ServerKeyExchange

In TLS 1.2, section 7.4.3 in the standard documentation on Server Key Exchange Message, it says that the parameters covered by ...
3
votes
3answers
184 views

Can cryptography help create tamper proof voting systems?

After hearing about what happened with the election in Kenya and the related discussion about a “tamper proof voting system”, I was wondering how the use of cryptography could be used to make a tamper ...
11
votes
1answer
322 views

Why was WEP apparently not reviewed by many cryptographers?

According to this analysis of WEP, These attacks point to the importance of inviting public review from people with expertise in cryptographic protocol design; had this been done, the problems ...
2
votes
1answer
62 views

Is it generally okay to substitute “like for like”?

Is it generally okay to substitute “like for like” in cryptographic protocols? For example, many lattice protocols use SHAKE and SHA3 for various purposes. However, both of those are relatively slow ...
5
votes
1answer
133 views

How to compute result in last step of Socialist millionaires problem?

I was trying to understand Socialist millionaires problem and solution in OTR protocol, but I'm stuck at figuring out how and who computes $(Q_{a}Q_b{}^{-1})^{\alpha\beta}$. If I'm Bob then I ...
2
votes
1answer
122 views

Byzantine agreement implies Broadcast channel [Consesus]

I am not sure if this is the right place to ask but I will give it a try. If not, let me know and I will ask somewhere else :) We discussed the byzantine agreement and broadcast channel in class. We ...
0
votes
2answers
92 views

Signing an exchanged symmetric key that is asymmetrically encrypted

Consider the following implementation: Bob wants to communicate long-term with his team over an unsecured channel. Bob and all members of the team generate individual public/private keypairs (ex. ...