The 2024 Developer Survey results are live! See the results

Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

126 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2k views

Has Telegram security been significantly improved with MTProto 2.0?

Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...
• 161
1k views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
• 131
193 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
• 221
580 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kinds of keys: RSA public/private, AES, ...
• 203
901 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
• 1,583
102 views

OTR AKE protocol implementations security

While looking at the different versions of OTR protocol I discovered a strange thing: there is no trace of the patch for the weaknesses that were noted in “Finite-State Security Analysis of OTR ...
• 171
194 views

Efficient proof of knowledge using Carter-Wegman hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
• 143k
143 views

Build set with PKI from reliable broadcast / random beacon

I am trying to build a protocol (or find an existing one) for creating a set $S_2$ with PKI from a set of parties $S_1$ that initially does not know anything about the other parties. We assume end-to-...
• 51
80 views

On the Adaptive Security of MPC Protocols

In adversarial context of MPC, the corruption behavior refers to the assumptions about the corrupted parties’ deviation level from the protocol specification. Three main types of corruption behaviors ...
• 640
70 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
• 141
299 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
• 36.5k
77 views

114 views

Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?

While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
• 255
120 views

Proof of knowledge of exponentiations

I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of ...
71 views

Draw/Lottery with hidden but provable outcome?

I have a scenario in which one of n participants is to be assigned a positive value and all other participants a negative value. The outcome of the draw is to be known only by the respective ...
• 371
120 views

High-latency anonymous communication minimum delay?

High-latency anonymous communication (e.g. Mixmaster and Mixminion) delay messages for a long time using mixers to anonymous communications. I understand that it has applications for email and p2p but ...
• 507
283 views

Shared-secret authentication with implicit session keys?

Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which ...
• 453
262 views

Simultaneous 2 way exchange without trusted third party

Stakeholders: Alice - has a message, M containing a secret, SA that Bob wants, where H(SA) is a hash which may be used by Bob to redeem some Bitcoin time-locked transaction sent previously by Alice. ...
• 131
1k views

Why does encryption in STS protocol protect against identity attacks?

The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ...
• 359
734 views

Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
• 265
135 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
212 views

Relaxed trust criterion for mental poker server?

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
344 views

Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
54 views

Proof of knowledge of big message

Say party A wants to prove that it has seen the entirety of a public, big message m. Providing the hash of m is not good enough, ...
• 121
195 views

Parameters needed for Chaum-Pedersen Protocol

I've came across a Stackexchange question about the Chaum-Pedersen Protocol which is based on the generalised schnorr protocol. As I understand it, it uses discrete logs and cyclic groups of prime ...
99 views

Secure multiparty scheme in key (splitting) distribution among the players

Suppose that we have a game with $I$ players and each of them has a private secret say $e_i$. Every player wants to share her secret with the rest of the players but in such a way that she will not be ...
• 279
106 views

Why can proverif not find value that I just created?

I have a really simple ProVerif problem. My current proverif code looks like this: ...
• 131
23 views

• 143
117 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
211 views

encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
• 21
188 views

Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
• 285
99 views

Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
• 153
1 vote