Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

5
votes
1answer
607 views

Security of zero knowledge proof protocols

When designing a protocol based on zero knowledge proofs, be it based on the discrete log problem, or on a Hamiltonian cycle in a graph, or something else, I assume there are security considerations, ...
3
votes
1answer
160 views

Challenge to prove possession of file

Suppose Bob wants to give Alice a large file, in such a way that: Bob cannot keep the file, but is able to use it to precompute anything he needs before he gives it to Alice Bob must be able to ...
5
votes
0answers
125 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
4
votes
0answers
59 views

Draw/Lottery with hidden but provable outcome?

I have a scenario in which one of n participants is to be assigned a positive value and all other participants a negative value. The outcome of the draw is to be known only by the respective ...
3
votes
0answers
55 views

Efficiently formatting data so that each byte is critical

I'm experimenting with implementing a Fair Exchange Protocol that assumes there is a trusted third party to provide a hash-checksum of the two files for each missing byte, (so that the exchange can ...
3
votes
1answer
101 views

Is it possible to prove the time a message was produced?

Say Bob wants to tell Alice a secret message, then they start some message exchanges protocol. At the end, Alice will receive the secret message and can be convinced that the message was not produced ...
0
votes
0answers
139 views

Proving Sigma Protocol on a Schnorr Protocol Variant

Let p, q be chosen as in Schnorr's protocol, and let g1, g2, h be elements in $Z^*_P$ of order q. Assume that the prover P gets as input w1,w2 where $h = (g1^{w1}g2^{w2}) mod p$. Consider the ...
5
votes
2answers
2k views

DRM simple clone

I have been trying to encrypt media(Video and audio content) from a nodejs server to a client like android or iOS. I heard of DRM but could not get a reliable implementation of DRM. I wanted to make ...
1
vote
0answers
181 views

Design a simplified version of the protocol for secure addition

To learn secure multiparty communication, I want to design a simplified protocol for secure addition, where instead of receiving two (random) numbers in $Z_p$, a player only receives a single (random) ...
-6
votes
1answer
91 views

Is a symmetric cryptographic code secure if only the sender and recipient know the method used to encrypt? [closed]

I recently designed an encoding method that I'm fairly sure is unique. Is it universally secure, provided that anyone intercepting the message doesn't know anything about how it was encrypted? Could ...
4
votes
0answers
75 views

High-latency anonymous communication minimum delay?

High-latency anonymous communication (e.g. Mixmaster and Mixminion) delay messages for a long time using mixers to anonymous communications. I understand that it has applications for email and p2p but ...
3
votes
1answer
53 views

Definition of randomly generate in the parallelepiped

I am reading the [CLT13] paper regarding multilinear maps over the integers and I have some troubles in understanding what the following random generation means: The vectors of the matrix $r_i \in \...
4
votes
0answers
97 views

What's the difference between game-based and simulation-based security? [duplicate]

What's the difference between game-based and simulation-based security? When we use the simulation-based, how to construct the simulator based on the adversary?
5
votes
1answer
582 views

What is Byzantine Agreement?

This was mentioned in a different question. However Wikipedia states it is proven to be unsolvable. So I would like to know what it is in this context and - since it is unsolvable - what the ...
1
vote
1answer
270 views

Byzantine agreement and PBFT

I have just gone through Feldman-Micali, Dolev-Strong, KatzKoo (basically, most of the literature behind Byzantine agreement), however all of their protocols take a really incredible amount of rounds. ...
1
vote
1answer
86 views

Would reuse of the symmetric key in a hybrid cryptosystem between files be inherently insecure?

This question stems from a UX problem where I want to allow the user to input their PIN only one single time when they open up an mobile app. Here are some properties of the application to provide ...
10
votes
3answers
346 views

Can a device prove the identity of its own code?

Say you have a computing system that has some functionality that is not in itself cryptographically secure, but you want to make sure is executed as specified, and, e.g. an adversary hasn't re-flashed ...
0
votes
1answer
106 views

Elgamal Protocol Failure

I'm having a difficult time trying to solve this problem. Suppose Alice uses the Elgamal signature scheme with $(\alpha, \beta, p) = (2, 33384, 65539)$. She publishes the two signed messages:...
7
votes
1answer
804 views

Can an U2F public/private key-pair for signatures be used for encryption?

I understand that this might be more a process question: Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device ...
8
votes
1answer
225 views

Is a key ratchet effective against replay attacks?

In the answer to this question, a message counter is used to protect against replay attacks. Could a key ratchet be used instead? The basic idea is that with every message sent, the symmetric ...
1
vote
1answer
471 views

Sigma protocol to prove that the prover knows how open a commitment

Sigma protocol to prove that the prover knows how open a commitment. Consider the unconditionally hiding commitment scheme based on discrete log, i.e., the public key $p_k = (p,g,y)$, where $\langle ...
6
votes
1answer
153 views

How to improve long-term duration of standard checksum for authenticity purposes?

Official CMS's of Government gazettes (in the third world), need to publish the checksum of each article and each cited external documentin (eg. full-text contracts) in a permanent support medium like ...
2
votes
1answer
165 views

Bit Commitment - from any One Way Permutations

In the Wiki Page on Commitments, it is given that a commitment scheme may be perfectly binding or perfectly concealing but not ...
3
votes
1answer
60 views

Is it feasible to design a crypto scheme for centralised reporting of anonymized data?

I would like to find out if it is feasible to design a cryptographic scheme that would allow several "reporting parties" to independently transfer information to the same centralised "authority", ...
2
votes
1answer
110 views

linkable tokens

Is it possible for $n$ parties for each to perform operations $f_1$,$f_2$,...,$f_n$ (they can all be the same function) on $x$. Now, another party $A$ given all $n$ values of $f(x)$s should know they ...
4
votes
1answer
73 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
3
votes
2answers
171 views

How to contruct a pseudorandom with a specific property

How to construct a pseudorandom function $PRF$ with the following property: Probability that $PRF(k_1,i)=PRF(k_2,i)$ is negligible, for all keys $k_1,k_2$ such that $k_1\neq k_2$ Does the PRF with ...
5
votes
1answer
242 views

Geometric Cryptography and Zero-Knowledge Proofs

Trying to understand zero-knowledge proofs, I came across this page, which provides an excellent example of a simple cryptographic protocol. I will reproduce the protocol here for the sake of ...
4
votes
0answers
116 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
3
votes
3answers
242 views

Are there historical examples of Occam's Razor being useful to cryptography research?

Previously, I asked what is the simplest digital signature scheme known, under the assumption simpler implementations could provide valuable insights on the nature of the problem. Among competing ...
2
votes
2answers
220 views

Collision-resistant Pseudorandom function

Assume we have a pseudorandom function: PRF(.) We want the following property holds with a high probability: $\forall i, 0\leq i \leq n: PRF(k_1, i)\neq PRF(k_2,i)$ where $k_1$ and $k_2$ are two ...
4
votes
1answer
131 views

Piggyback on Bitcoin for independent data verification?

The recent threats to EPA data integrity have me wondering if it's possible to archive data in a way such that one can later check whether the data have been tampered with since the original archival. ...
5
votes
1answer
463 views

One ciphertext, multiple keys, multiple messages

I recently came across following idea, does anyone know a name and if it is actually used? A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (...
1
vote
1answer
38 views

Efficient protocol to give out N known items randomly to k>=3 parties without independent bodies

There are $N$ items which are to be uniformly randomly distributed (every possibility has equal probability) to $k\geq 3$ parties, such that no individual party can change the probability of getting ...
5
votes
2answers
131 views

What requirements would lead to the development of a new security protocol?

I recently completed a semester studying some basic amount of cryptography. So my knowledge is not very broad/deep. What I currently see is that we have a bunch of fairly secure encryption modes to ...
1
vote
1answer
81 views

Is battery usage an important parameter for mobile based key exchange protocol?

I am studying a key exchange protocol based on public key cryptography technique specifically designed for mobile devices. I noticed there is no importance given to battery usage by these protocols. ...
9
votes
2answers
1k views

Alternative for RFC 6238/4226 - one time password via SMS (single-factor authentication)

Currently we have implemented One Time Passwords (OTP) as second authentication which works well. We use TOTP - RFC 6238 Some clients would like to have a "sms only" login, so it's single factor ...
1
vote
1answer
326 views

Use Cases of Otway Rees key exchange protocol

I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is ...
1
vote
1answer
325 views

Speeding up the Denning-Sacco protocol?

I have started to study cryptography and I have come across Denning-Sacco protocol. I understand multiplicity vulnerability. My question is why Denning-Sacco protocol choose to generate key on ...
1
vote
1answer
894 views

Why does appending a message to a key before hashing not guarantee integrity? [duplicate]

I want to guarantee the integrity of a message $m$. My first thought is to append the message to an integrity key $k$ and hash it as $H(k\,||\,m)$. However, I have been told that this is not totally ...
0
votes
1answer
67 views

What does this protocol mean?

Does this mean that the message is being added onto the hashed(message, tag) ? m || H(m, "secret") So the output would be something like: "RandomMessage"+...
-1
votes
1answer
68 views

Need Help with understanding authentication process

I want to develop an app which allows to pair between pc using bluetooth then you can send the signal from the phone to unlock the PC(on the same network). I need help with the process after ...
9
votes
1answer
715 views

Is there a formal language to define a cryptographic protocol?

I wanted to work on a personal project where I would attempt to identify the flaws in a cryptographic protocol. Now for that to work properly, the program should understand the syntax of protocol ...
8
votes
1answer
1k views

Replay attack prevention in connectionless UDP encrypted communication

What are the options for replay attack prevention when two parties exchange UDP messages. No connection or session is estabilished. Communicating parties have pre shared key that is used for ...
4
votes
1answer
123 views

Why is cryptographic model not considered formal methods?

I have just started looking at different methods for analyzing the security of cryptographic protocols. According to my reading, there are two main approaches in this area. The first approach is so-...
3
votes
1answer
109 views

Secure instant messaging protocol and implementation for an anonymous end-to-end chat?

all is said in the title but I will go further. First question : I searched here and I found Tox to be the most powerful protocol. It uses Curve25519, XSalsa20 and Poly1305. They seem to be good ...
5
votes
1answer
184 views

Why is does the protocol of Ding et al. produce biased bits and does it relate to passive security?

I am not understanding the following from "Lattice Cryptography for the Internet" by C. Peikert (pages 9): We remark that a work of Ding et al. DXL14 proposes a different reconciliation method ...
0
votes
1answer
123 views

Whether hash function of two values $h(a,b)=h(b,a)$ are same?

If two messages $M_1$ and $M_2$ are given as input to a hash function $h$ is it then true that $h(M_1,M_2) = h(M_2,M_1)$? I have two messages. I want to know, Is it possible to apply a hash ...
2
votes
0answers
28 views

Can “PrivateKey+MagicValue” decode pre-encoded data without intermediate key?

Let's say I want to build a public repository of encrypted files. EncA(FileA) EncB(FileB) ...
5
votes
1answer
379 views

Implementing Secure multi-party computation for online website

I need to know if the following is feasible: I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the ...