Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

3
votes
1answer
101 views

Is it possible to prove the time a message was produced?

Say Bob wants to tell Alice a secret message, then they start some message exchanges protocol. At the end, Alice will receive the secret message and can be convinced that the message was not produced ...
0
votes
0answers
122 views

Proving Sigma Protocol on a Schnorr Protocol Variant

Let p, q be chosen as in Schnorr's protocol, and let g1, g2, h be elements in $Z^*_P$ of order q. Assume that the prover P gets as input w1,w2 where $h = (g1^{w1}g2^{w2}) mod p$. Consider the ...
5
votes
2answers
2k views

DRM simple clone

I have been trying to encrypt media(Video and audio content) from a nodejs server to a client like android or iOS. I heard of DRM but could not get a reliable implementation of DRM. I wanted to make ...
1
vote
0answers
169 views

Design a simplified version of the protocol for secure addition

To learn secure multiparty communication, I want to design a simplified protocol for secure addition, where instead of receiving two (random) numbers in $Z_p$, a player only receives a single (random) ...
-6
votes
1answer
90 views

Is a symmetric cryptographic code secure if only the sender and recipient know the method used to encrypt? [closed]

I recently designed an encoding method that I'm fairly sure is unique. Is it universally secure, provided that anyone intercepting the message doesn't know anything about how it was encrypted? Could ...
4
votes
0answers
74 views

High-latency anonymous communication minimum delay?

High-latency anonymous communication (e.g. Mixmaster and Mixminion) delay messages for a long time using mixers to anonymous communications. I understand that it has applications for email and p2p but ...
3
votes
1answer
53 views

Definition of randomly generate in the parallelepiped

I am reading the [CLT13] paper regarding multilinear maps over the integers and I have some troubles in understanding what the following random generation means: The vectors of the matrix $r_i \in \...
4
votes
0answers
87 views

What's the difference between game-based and simulation-based security? [duplicate]

What's the difference between game-based and simulation-based security? When we use the simulation-based, how to construct the simulator based on the adversary?
5
votes
1answer
575 views

What is Byzantine Agreement?

This was mentioned in a different question. However Wikipedia states it is proven to be unsolvable. So I would like to know what it is in this context and - since it is unsolvable - what the ...
1
vote
1answer
263 views

Byzantine agreement and PBFT

I have just gone through Feldman-Micali, Dolev-Strong, KatzKoo (basically, most of the literature behind Byzantine agreement), however all of their protocols take a really incredible amount of rounds. ...
1
vote
1answer
79 views

Would reuse of the symmetric key in a hybrid cryptosystem between files be inherently insecure?

This question stems from a UX problem where I want to allow the user to input their PIN only one single time when they open up an mobile app. Here are some properties of the application to provide ...
10
votes
3answers
342 views

Can a device prove the identity of its own code?

Say you have a computing system that has some functionality that is not in itself cryptographically secure, but you want to make sure is executed as specified, and, e.g. an adversary hasn't re-flashed ...
0
votes
1answer
103 views

Elgamal Protocol Failure

I'm having a difficult time trying to solve this problem. Suppose Alice uses the Elgamal signature scheme with $(\alpha, \beta, p) = (2, 33384, 65539)$. She publishes the two signed messages:...
7
votes
1answer
756 views

Can an U2F public/private key-pair for signatures be used for encryption?

I understand that this might be more a process question: Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device ...
8
votes
1answer
220 views

Is a key ratchet effective against replay attacks?

In the answer to this question, a message counter is used to protect against replay attacks. Could a key ratchet be used instead? The basic idea is that with every message sent, the symmetric ...
1
vote
1answer
436 views

Sigma protocol to prove that the prover knows how open a commitment

Sigma protocol to prove that the prover knows how open a commitment. Consider the unconditionally hiding commitment scheme based on discrete log, i.e., the public key $p_k = (p,g,y)$, where $\langle ...
6
votes
1answer
146 views

How to improve long-term duration of standard checksum for authenticity purposes?

Official CMS's of Government gazettes (in the third world), need to publish the checksum of each article and each cited external documentin (eg. full-text contracts) in a permanent support medium like ...
2
votes
1answer
137 views

Bit Commitment - from any One Way Permutations

In the Wiki Page on Commitments, it is given that a commitment scheme may be perfectly binding or perfectly concealing but not ...
3
votes
1answer
59 views

Is it feasible to design a crypto scheme for centralised reporting of anonymized data?

I would like to find out if it is feasible to design a cryptographic scheme that would allow several "reporting parties" to independently transfer information to the same centralised "authority", ...
2
votes
1answer
110 views

linkable tokens

Is it possible for $n$ parties for each to perform operations $f_1$,$f_2$,...,$f_n$ (they can all be the same function) on $x$. Now, another party $A$ given all $n$ values of $f(x)$s should know they ...
4
votes
1answer
71 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
3
votes
2answers
169 views

How to contruct a pseudorandom with a specific property

How to construct a pseudorandom function $PRF$ with the following property: Probability that $PRF(k_1,i)=PRF(k_2,i)$ is negligible, for all keys $k_1,k_2$ such that $k_1\neq k_2$ Does the PRF with ...
5
votes
1answer
235 views

Geometric Cryptography and Zero-Knowledge Proofs

Trying to understand zero-knowledge proofs, I came across this page, which provides an excellent example of a simple cryptographic protocol. I will reproduce the protocol here for the sake of ...
4
votes
0answers
108 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
3
votes
3answers
240 views

Are there historical examples of Occam's Razor being useful to cryptography research?

Previously, I asked what is the simplest digital signature scheme known, under the assumption simpler implementations could provide valuable insights on the nature of the problem. Among competing ...
2
votes
2answers
215 views

Collision-resistant Pseudorandom function

Assume we have a pseudorandom function: PRF(.) We want the following property holds with a high probability: $\forall i, 0\leq i \leq n: PRF(k_1, i)\neq PRF(k_2,i)$ where $k_1$ and $k_2$ are two ...
4
votes
1answer
128 views

Piggyback on Bitcoin for independent data verification?

The recent threats to EPA data integrity have me wondering if it's possible to archive data in a way such that one can later check whether the data have been tampered with since the original archival. ...
5
votes
1answer
444 views

One ciphertext, multiple keys, multiple messages

I recently came across following idea, does anyone know a name and if it is actually used? A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (...
1
vote
1answer
38 views

Efficient protocol to give out N known items randomly to k>=3 parties without independent bodies

There are $N$ items which are to be uniformly randomly distributed (every possibility has equal probability) to $k\geq 3$ parties, such that no individual party can change the probability of getting ...
5
votes
2answers
130 views

What requirements would lead to the development of a new security protocol?

I recently completed a semester studying some basic amount of cryptography. So my knowledge is not very broad/deep. What I currently see is that we have a bunch of fairly secure encryption modes to ...
1
vote
1answer
80 views

Is battery usage an important parameter for mobile based key exchange protocol?

I am studying a key exchange protocol based on public key cryptography technique specifically designed for mobile devices. I noticed there is no importance given to battery usage by these protocols. ...
0
votes
0answers
50 views

Per-account iteration count for key derivation functions?

I'm working on an open protocol for the standardization of notes at my website “standardnotes.org”. Notes should be encrypted on the client device based on a key derived from the user's password. ...
9
votes
2answers
981 views

Alternative for RFC 6238/4226 - one time password via SMS (single-factor authentication)

Currently we have implemented One Time Passwords (OTP) as second authentication which works well. We use TOTP - RFC 6238 Some clients would like to have a "sms only" login, so it's single factor ...
1
vote
1answer
314 views

Use Cases of Otway Rees key exchange protocol

I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is ...
0
votes
0answers
40 views

Issues with just using symmetric key as a protocol design for sending messages?

What are common issues with only using a symmetric key (distributed to all users) as part of a messaging protocol? So for example, you have the following: Alice -> Bob: {m}k, Bob -> Alice: {m}k What ...
1
vote
1answer
284 views

Speeding up the Denning-Sacco protocol?

I have started to study cryptography and I have come across Denning-Sacco protocol. I understand multiplicity vulnerability. My question is why Denning-Sacco protocol choose to generate key on ...
1
vote
1answer
766 views

Why does appending a message to a key before hashing not guarantee integrity? [duplicate]

I want to guarantee the integrity of a message $m$. My first thought is to append the message to an integrity key $k$ and hash it as $H(k\,||\,m)$. However, I have been told that this is not totally ...
0
votes
1answer
66 views

What does this protocol mean?

Does this mean that the message is being added onto the hashed(message, tag) ? m || H(m, "secret") So the output would be something like: "RandomMessage"+...
-1
votes
1answer
68 views

Need Help with understanding authentication process

I want to develop an app which allows to pair between pc using bluetooth then you can send the signal from the phone to unlock the PC(on the same network). I need help with the process after ...
9
votes
1answer
703 views

Is there a formal language to define a cryptographic protocol?

I wanted to work on a personal project where I would attempt to identify the flaws in a cryptographic protocol. Now for that to work properly, the program should understand the syntax of protocol ...
7
votes
1answer
1k views

Replay attack prevention in connectionless UDP encrypted communication

What are the options for replay attack prevention when two parties exchange UDP messages. No connection or session is estabilished. Communicating parties have pre shared key that is used for ...
4
votes
1answer
117 views

Why is cryptographic model not considered formal methods?

I have just started looking at different methods for analyzing the security of cryptographic protocols. According to my reading, there are two main approaches in this area. The first approach is so-...
0
votes
0answers
36 views

Is there any way for a client application to prove to a server that it hasn't been tampered with?

I have a client application C, and a server application S. I have a secret, X, that I want to pass from S to C, but I want to make sure that C is legitimately my client application, not an imposter. ...
3
votes
1answer
104 views

Secure instant messaging protocol and implementation for an anonymous end-to-end chat?

all is said in the title but I will go further. First question : I searched here and I found Tox to be the most powerful protocol. It uses Curve25519, XSalsa20 and Poly1305. They seem to be good ...
5
votes
1answer
179 views

Why is does the protocol of Ding et al. produce biased bits and does it relate to passive security?

I am not understanding the following from "Lattice Cryptography for the Internet" by C. Peikert (pages 9): We remark that a work of Ding et al. DXL14 proposes a different reconciliation method ...
0
votes
1answer
123 views

Whether hash function of two values $h(a,b)=h(b,a)$ are same?

If two messages $M_1$ and $M_2$ are given as input to a hash function $h$ is it then true that $h(M_1,M_2) = h(M_2,M_1)$? I have two messages. I want to know, Is it possible to apply a hash ...
2
votes
0answers
28 views

Can “PrivateKey+MagicValue” decode pre-encoded data without intermediate key?

Let's say I want to build a public repository of encrypted files. EncA(FileA) EncB(FileB) ...
5
votes
1answer
358 views

Implementing Secure multi-party computation for online website

I need to know if the following is feasible: I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the ...
3
votes
1answer
111 views

Secure communication protocol for equality test

I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ. Easy solution is ...
3
votes
0answers
224 views

Shared-secret authentication with implicit session keys?

Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which ...