Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
1
vote
0answers
20 views

What is the main difference between anonymous authentication and using an anonymous credential?

What is the main difference between anonymous authentication and the use of an anonymous credential? And when we should use them?
50
votes
1answer
10k views

Why do 5G, 4G, etc., use non-conventional algorithms?

Looking up information about 5G and the previous 3GPP standards, why have they been incorporating non-conventional algorithms into the standards? For example, AES has been considered secure for ages ...
2
votes
2answers
277 views

QKD - Does BB84 Protocol rely on a prearranged code?

First of all, sorry if the title is not that clear, I'll provide an in-depth explanation behind my question. So, basically, I was reading about quantum cryptography and came across BB84. The protocol ...
6
votes
0answers
522 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kinds of keys: RSA public/private, AES, ...
0
votes
1answer
106 views

Is the following non-interactive zero-knowledge set membership protocol provable secure?

Given the following Zero-knowledge set-membership protocol https://infoscience.epfl.ch/record/128718/files/CCS08.pdf]. That is given in the following steps (Please refer to page 9). The Verifier -...
18
votes
0answers
733 views

Crypto AG (Switzerland) - Which algorithms were used and how did the backdoors work?

Backstory Crypto AG was a company located in Switzerland that specialized in communication security. They produced a number of encryption machines (some similar to the infamous Enigma) used for ...
1
vote
0answers
25 views

Signature algorithm for constrained environment, curve25512 already present for ECDH

I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no ...
0
votes
0answers
15 views

Unilateral authentication with implicit key authentication

Is it possible to design a cryptography protocol with achieving unilateral authentication of one party A by party B using implicit key authentication? Key authentication is the property whereby one ...
5
votes
1answer
422 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
0
votes
0answers
60 views

Is this a reasonable design for encrypting records in a key/value database?

A while back I designed a protocol for en encrypted key/value service. My main goal was to minimize the value of a breached database by using cryptographic algorithms where a brute-force cracking ...
0
votes
0answers
30 views

What are different types of signature properties?

I am reading about digital signatures these days. I read about blind signatures, group signatures and ring signatures. Are there other type of signatures as well?
4
votes
2answers
143 views

MAC-then-encrypt in SIGMA protocol for authenticated key exchange

The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption. The SIGMA-I variant illustrated below ...
3
votes
2answers
96 views

Anonymizing a group chat

I wonder if it's possible to have a peer-to-peer group chat protocol, where anybody is free to join the chat and broadcast with a chosen username to all others who have joined it, but with a strong ...
4
votes
1answer
1k views

SHA-256-based stream cipher

Can anyone comment if the stream cipher described here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced ...
2
votes
1answer
51 views

Using crypto_sign then crypto_box_seal for anonymous messages

If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do? ...
0
votes
0answers
39 views

How to formally define the security of Random Oblivious Transfer

Assume that there is a protocol $(A,B)$ such that receives no input and satisfies: $A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$ $B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$...
1
vote
1answer
79 views

Securing communication between limited embedded systems

I am currently trying to harden communication over a limited physical communication channel on an embedded system. The Scenario I think the system is rather typical for small embedded applications: ...
1
vote
0answers
26 views

Construct an Oblivious Transfer protocol using a secure protocol that outputs random bits between two sides

Assume that there is a protocol $(A,B)$ such that receives no input and satisfies: $A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$ $B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$...
2
votes
1answer
46 views

How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol

I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin. I ...
1
vote
1answer
214 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
0
votes
2answers
95 views

Designing a simple challenge-response symmetric mutual authentication protocol

I am designing a protocol that 2 devices will use to mutually authenticate over an unreliable, unsecure channel. The system must be fast and low-power, so symmetric cryptography is a requirement. I ...
0
votes
1answer
626 views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
6
votes
3answers
890 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
2
votes
1answer
61 views

How to securely deal cards?

Thanks to a certain pandemic going around I was wondering whether there is any cryptographic way to remotely deal cards without the dealer being able to know them and without requiring to trust a ...
2
votes
1answer
90 views

How do quantum key distribution systems tolerate noise?

It seems to me that any noise in the signal would result in Alice and Bob generating different keys, without a simple way to tell the difference. How do quantum key distribution systems tolerate ...
1
vote
0answers
16 views

Are there any mutual-distance bounding protocols in RFID context?

Distance-bounding algorithms are a classical solution for the Relay Attack, wherein a verifier can determine an upper bound on its distance from the prover. However, recent literature is discussing ...
2
votes
2answers
97 views

Prove that you have the data when hash is public

I am designing an online service where users can upload files (3d models) for processing. I want to speed up things when the same file is uploaded by many different users by allowing them to post a ...
0
votes
1answer
68 views

Byzantine Agreement: Why does OM need f+1 rounds in a synchronous setting?

To get Byzantine Fault Tolerance in a synchronous model you can use an Oral Message Algorithm. For n > 3f+1 it gets an Byzantine agreement in ...
3
votes
2answers
146 views

One-time token to decrypt a local file

I am trying to achieve the following: Encrypted files are stored on users filesystem. The user uses my client to authenticate against a server. Once he is authenticated successfully he gets a token ...
0
votes
1answer
24 views

Is establishing a secret key possible given this characteristic primitive?

I am wondering if there are any readily available solutions for the following problem: I have a ring-topology network with several devices connected to it, some malicious, some legitimate. I want to ...
0
votes
1answer
62 views

How to securely share AES key between two remote devices (client and server) through UDP protocol?

I have two separate system (client) and (server). I am having a problem which is to encrypt a message from the client and decrypt at the server. In order to do that, I am required to transmit my key ...
2
votes
0answers
20 views

Is there an interactive proof protocol for proving that a preimage in a map $g: Z_{q}^{n} → G_{T}$ is mapped to a given public value, say y?

There already exist interactive proof protocols with logarithmic communication for proving that a secret multi-exponent $x ∈ Z^{n}_{q}$ for a public multi-exponentiation $P = \textbf{g}^{\textbf{x}} ∈ ...
3
votes
0answers
71 views

Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?

While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
124
votes
6answers
84k views

Should we sign-then-encrypt, or encrypt-then-sign?

We regularly want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active ...
15
votes
5answers
6k views

Is it easy to crack a hashed phone number?

I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?
0
votes
1answer
59 views

Can two traitors safely reveal themselves to each other?

Suppose Alice is a traitor and suspects Bob might also be a traitor. If Bob is a traitor, she would like to conspire with him together, if not she doesn't want to reveal that she is a traitor. Is ...
0
votes
0answers
26 views

Corona Contact Tracing message exchange

For a university project, I have to design a contact tracing protocol. In my approach, a blockchain is used. Every participant has to generate 3 nonces for every contact. They are hashed in multiple ...
1
vote
1answer
78 views

Question of proving the opening of Pedersen Commitment

Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
0
votes
0answers
56 views

Computational Binding of Pedersen Commitment

Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen ...
5
votes
1answer
892 views

One ciphertext, multiple keys, multiple messages

I recently came across following idea, does anyone know a name and if it is actually used? A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (...
0
votes
0answers
38 views

Diffie-Hellman Key Exchange - Key Derivation before Execution

I am dealing with protocol design regarding the Diffie-Hellman Key Exchange (DHKE). The DHKE is performed by the Key Master and some Slave Component. Afterwards, a session key is transmitted using the ...
3
votes
1answer
180 views

How are initialization vectors used in TLS 1.1?

From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this ...
0
votes
0answers
20 views

Do EMV log contain any dangerous data?

I accidentally leaked EMV log taken from application Credit Card Reader of my Credit card. I want to know if anybody can use it for harm (I haven't entered PIN). Thank you so much. Also I couldn't ...
12
votes
0answers
978 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
1
vote
0answers
55 views

Can two anonymous parties determine whether they interacted before, without being able to link encounters?

Assume an anonymous communication system in which anonymous parties randomly meet in pairs to exchange information. How could two anonymous parties determine whether they have interacted before, ...
1
vote
0answers
27 views

How does one ensure that a handshake protocol is secure assuming all underlying cryptography used are secure

Suppose one have to design handshake protocol using known secure cryptographic algorithm. The designer of implementer can assume that crypotography is secure but how would they ensure protocol itself ...
0
votes
1answer
61 views

How modern messengers encryption keys can't be hacked [closed]

I dont know is this question more like reverse-engineering or cryptographic. Why governments are hunting for encryptions keys? Aren't they delievering by the network the same as the encypted messages? ...
0
votes
0answers
33 views

Append-only log with secret metadata?

I need sets of encrypted records which need to be stored in an append-only log. It should be possible to efficiently recover just the headers of each record, so that specific records can be retrieved ...
0
votes
0answers
102 views

Importance of Backward and forward secrecy

Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy
1
vote
2answers
475 views

Use Cases of Otway Rees key exchange protocol

I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is ...

1
2 3 4 5
13