Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
0
votes
1answer
26 views

Secret community forming based on zero-knowledge proof (IOT)

I want to discuss a simplistic scheme that comes to my mind, after I read about zero-knowledge proof and some fermentation time. I should mention that this is not born out of a business need or ...
1
vote
1answer
104 views

How to play Mental Skull

"Skull" or "Skull and Roses" is a table top game. The rules can be found here. I was thinking of how I could play this game P2P. At first it seemed easy: Each time I had to place a card face down I ...
0
votes
1answer
36 views

A modified question of Hazay & Lindell's Efficient Secure Two-Party protocols Book

Based on the question proposed on page 27, we propose a modified question as follows: Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($...
0
votes
0answers
30 views

Simulation-based proof in a particular scenario

Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public ...
1
vote
1answer
83 views

Simulator in semi-honest model in real/model paradigm

Does a simulator in the semi-honest model in IDEAL/REAL model paradigm necessarily make use of the corrupted party's input? For example, suppose a simulator given an input named $I$ and an output ...
1
vote
0answers
22 views

How to design a moderated, group for private messages?

I’m trying to figure out how I could create a private group that was P2P yet still allowed someone to moderate members (no public access to messages). I’m assuming standard hybrid encryption (RSA/EC + ...
7
votes
1answer
354 views

How does one design a traffic analysis resistant protocol?

I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
1
vote
1answer
31 views

Difference between Verification and Public Key for Signature Schemes

This is a semantics Question. Typically, in many asymmetric schemes, for this question specifically, digital signatures, we see that designers describe the key given to the verifier as Public Key. ...
3
votes
3answers
142 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
0
votes
0answers
39 views

Protocol for leader election [duplicate]

A leader should be selected by randomly choosing one of three parties A, B and C. The parties use the following protocol: $A → B: N_A$ (where $N_A$ is a nonce) $B → C:$ $N_{AB}$ $= N_A$ ^ $N_B$ (...
1
vote
1answer
119 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
0
votes
1answer
45 views

What's the utility of the last two messages of Needham Schroeder Symmetric key protocol

The protocol works like this But I can't understand what's the utility of message 4 and 5, what do they protect from? They do not protect from replay attack if Ks gets compromised because B won't be ...
28
votes
3answers
3k views

Is this password migration strategy secure?

I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
5
votes
0answers
174 views

Efficient proof of knowledge using Carter-Wegman hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
3
votes
1answer
199 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
0
votes
1answer
216 views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
34
votes
4answers
6k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
1
vote
1answer
71 views

Is there value in performing signature during key exchange?

I looked around the net, however I couldn't see anything authoritative on this. If one is using something like libsodium to perform key exchange (using x25519), is there value in using Ed25519/...
5
votes
1answer
128 views

Build set with PKI from reliable broadcast / random beacon

I am trying to build a protocol (or find an existing one) for creating a set $S_2$ with PKI from a set of parties $S_1$ that initially does not know anything about the other parties. We assume end-to-...
2
votes
1answer
48 views

Total anonymity against malicious agents

Suppose we have $N$ parties, two of whom are Alice and Bob, while some fraction of the remainder are malicious agents working together. We form a network where each party can pass an encrypted message ...
0
votes
1answer
47 views

Byzantine Agreement: Why does OM need f+1 rounds in a synchronous setting?

To get Byzantine Fault Tolerance in a synchronous model you can use an Oral Message Algorithm. For n > 3f+1 it gets an Byzantine agreement in ...
1
vote
0answers
40 views

Did key-wrap modes see actual use?

Is there an IETF standard-track protocol have IANA-registered IDs for deterministic authenticated encryption yet? If not, what's preventing their adoption? What changes to protocols will DAEs likely ...
2
votes
3answers
273 views

What's wrong with this digital signature scheme?

With regards to user authentication... The server sends Alice a randomly chosen number. Alice signs the number and sends the signature back to the server. The server checks the signature using Alice'...
1
vote
1answer
188 views

Getting unlimited amount of signatures - Risk?

Lets suppose we have a communication protocol given where messages $(1)$ and $(2)$ are send over an unsecure network. There are some prerequisites like distributed certificates etc., but they should ...
2
votes
0answers
40 views

No freshness protection for single messages, but for the overall protocol

I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for ...
0
votes
1answer
35 views

Can I Implement a Well-Trusted Protocol with Well-Trusted Libraries in JavaScript securely?

Just for anyone reading this: DO NOT ROLL YOUR OWN ALGORITHM. Besides that, is implementing a well-trusted protocol with well-trusted algorithms and libraries a good idea? Is this likely to ...
11
votes
1answer
2k views

Is the “New Hope” Lattice Key Exchange vulnerable to a lattice analog of the Bernstein BADA55 Attack?

In the paper, "Post Quantum Key Exhange - A New Hope," the authors present a lattice-based key exchange based on the work of Chris Peikert. In this "New Hope" key exchange the authors try to gain ...
4
votes
0answers
66 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
0
votes
1answer
41 views

Reference books in security and privacy preservation [closed]

I am looking for books or reference guides to learn and teach "cryptography, security and privacy preservation techniques"? I need some advice to good resources that I can use.
1
vote
1answer
48 views

Is there an algorithm that allows to distribute elements securely between parties?

Let's say we have a set of numbers $n = \{ 1, 2, 3, 4, 5, \ldots \}$ and $m$ players ($m < \operatorname{sizeof}(n)$, of course). I want to know if there's a way for all $m$'s to pick different ...
6
votes
2answers
130 views

Protocol to identify zone of potential agreement without revealing reservation prices and having to trust third parties?

A wants to buy a company from B. Before A and B enter negotiations, they want to make sure that there actually is a zone of potential agreement. Obviously, they don't want to communicate their ...
1
vote
0answers
144 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...
1
vote
1answer
108 views

Station-to-Station protocol questions

Basic Station-to-Station protocol which authenticates Bob and Alice if they safely shared their long-term asymmetric public keys. Alice sends Bob her public key $A_K$ Bob receives $A_K$ and computes ...
2
votes
1answer
108 views

Key derivation for AES-GCM using HKDF?

I have a system comprising N >1000 nodes. At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random ...
3
votes
3answers
362 views

Existing works on pre-computing ElGamal ephermal keys

I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
2
votes
1answer
100 views

Are two keys derived from the same password vulnerable to a related key attack?

Background I am currently writing a password manager application. As usual, the passwords are put in a file encrypted using a user-entered password. I'm using the NaCl library but actually it's not ...
1
vote
1answer
149 views

Commitment to a polynomial

$A(x) \bmod B(x) = C(x)$ and $A(x) \bmod D(x) = E(x)$: A dealer knows $A(x)$ polynomial, which is a secret. He distributes $C(x)$ and $E(x)$ privately to $X$ and $Y$, respectively. $B(x)$ and $D(x)$ ...
2
votes
0answers
71 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
0
votes
1answer
56 views

Needham–Schroeder fix by adding opponent's identity to the first message

Recap: Needham–Schroeder is as follows: $A \rightarrow B : \{A, N_a\}_{pk_B}$ $B \rightarrow A : \{N_a, N_b\}_{pk_A}$ $A \rightarrow B : \{N_b\}_{pk_B}$ Then, there is a MITM attack by Lowe ...
0
votes
1answer
45 views

specific scenario question relating to using NACL crypto_box in a protocol

Scenario 1: SenderA sends message1 to ReceiverB message1 is encrypted using NACL crypto_box using SenderA secret key and ReceiverB public key. we understand that the NACL crypto_box authenticator ...
23
votes
3answers
2k views

Selective format-compliant JPEG encryption?

I am working towards building a format-compliant encryption system for pictures. The aim of it is to be able to obscure specific areas of a picture (i.e. faces, car license numbers...) while keeping ...
2
votes
1answer
66 views

What time is used in a TOTP counter?

I am currently working on a desktop TOTP client. From the TOTP spec at https://tools.ietf.org/html/rfc6238#section-4.1, the 6 digit OTP is generated from counter (in this case time). But what is "...
4
votes
3answers
2k views

HMAC key storage for a web app?

If one is going to use an HMAC, I.E: http://php.net/manual/en/function.hash-hmac.php, where exactly are they storing the key? Without some sort of secure storage (i.e not in a local file or code), I ...
6
votes
1answer
208 views

How to construct a yes/no election protocol, such that only the result is revealed?

Can we use a threshold scheme to construct a (yes/no)-election protocol, such that every voter can give a positive or negative vote or he can abstain, and such that only the result of the election is ...
0
votes
1answer
81 views

Dynamic accumulator with only non-membership witness

Goal: Construct a dynamic accumulator which can add elements and provide non-membership witnesses. I wanted to know if my construction is correct. Consider a group $Z_p$ where $p$ is prime number. ...
22
votes
3answers
1k views

Cryptographic Challenge: How to Say Something Confidentially to Snowden?

The Snowden situation raises an intereting cryptograpic problem. At present, how can something be sent confidentially to Snowden? Claim: I have no particular political orientation. The above ...
1
vote
1answer
183 views

Proving Sigma Protocol on a Schnorr Protocol Variant

Let p, q be chosen as in Schnorr's protocol, and let $g_1, g_2, h$ be elements in $Z^*_P$ of order q. Assume that the prover P gets as input $w_1,w_2$ where $h = (g_1^{w_1}g_2^{w_2}) \mod q$. ...
7
votes
0answers
144 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
5
votes
1answer
218 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...
-1
votes
2answers
98 views

How to sell a piece of data through blockchain?

User A attempts to sell a piece of data D (byte level) to user B at price C through the blockchain. A and B do not trust each other. A worry: After the data D is delivered, B does not complete the ...