Questions tagged [protocol-design]
Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).
679
questions
1
vote
0
answers
46
views
Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$
Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order.
Assume that I know how to construct an efficiently computable ...
- 327
1
vote
0
answers
41
views
Pseudo-isomorphic graphs
Some famous cryptographical protocols rely on the construction of graphs $G_i= (V_i, E_i)$ for $i=0,1$ that are not isomorphic. For the safety of this protocol, it is central that one can not easily ...
1
vote
0
answers
52
views
How to compute the absolute value of a float number using only addition and multiplication (or using an and-xor circuit)?
Hi I am trying to calculate the abs or a float number $x$, however, I want to apply this operation when $x$ is under fully homomorphic encryption (typically CKKS ...
- 11
1
vote
1
answer
77
views
Question about Secure Multi-Party Computation
I am doing research about Non-interactive Secure Multi-party Computation and encounter a dilemma that I am not quite sure if it is possible and wonder if there are better thoughts that could help.
...
- 13
0
votes
1
answer
48
views
Honest programming language for malicious adversaries in MPC protocols
One method to create a secure MPC protocol against malicious adversaries is to create a secure protocol against semi-honest adversaries and then add some zero-knowledge proofs to ensure that the ...
- 25
1
vote
0
answers
25
views
Does the private blockchain have to follow client-server model when considering BFT?
I'm a newbie, currently interested in data security & integrity.
I'm quite new to blockchain and distributed system theories, and suffering from some unclear doubts/questions on the fault-tolerant ...
- 11
0
votes
0
answers
14
views
Will this RSA-based cross-signing schema work for preventing forgery?
I am a web developer and a newbie in cryptography, so my question may sound not very related to this community, let me know if so, and where to ask.
Context is a distributed application, to exchange ...
- 101
1
vote
1
answer
53
views
Public key fingerprint verification for large groups
If you were designing:
An open source client that offered E2E encryption for e.g. folder sharing between users
Each user had public keys for signing (and separate public keys for encryption of ...
- 11
3
votes
0
answers
58
views
How to create an encryption such that we need two keys to decrypt, while one key is derivable from the other if I have the secret
Suppose I have some plaintext $M$, and I want to have some process $f$ to make ciphertext $M':=f(M,s)$, where $s$ is some secret. The ciphertext $M'$ can be decrypted by using some decryption process $...
- 31
1
vote
0
answers
30
views
Is there a scheme for voting on decrypting a message with a variable voter count?
I am wondering if there might be a scheme for the following scenario: Let's suppose a government wants a truly democratic intelligence agency. For this the government publishes all intelligence ...
- 11
0
votes
0
answers
47
views
Oblivious transfer protocol to retrieve k elements
The sever holds the N encrypted elements, each element is associated with an index (unencrypted). The receiver wants to retrieve only k-out-N elements using k-out-N OT.
The motivation for using OT is ...
- 1
1
vote
1
answer
36
views
How would you design an API server to store user sercrets?
This is not for a production application, but just my exploration to help me understand cryptography.
At the simplest level, I want to design a key-value store for user secrets.
This is exposed over ...
user104510
0
votes
1
answer
99
views
Shamir Secret Sharing over an unsecure channel for a protocol design
Let's suppose that we have two parties, $A$ and $B$ that are using a Shamir Secret Sharing scheme with $k=3$. $A$ holds the points $[x_1, f(x_1)]$ and $[x_2, f(x_2)]$ while $B$ holds $[x_3, f(x_3)]$ ...
- 13
1
vote
0
answers
53
views
Using multiple asymmetric keys as backups for one another
I've been thinking about ways to take advantage of multiple asymmetric encryption schemes so that each key could be a backup to the others in case of cryptanalysis of one given scheme.
Those public ...
- 11
0
votes
0
answers
52
views
Bloackchain e-voting: verfiy that voter is allowed to vote but didnt already voted, without reaviling his identity
I am trying to make a e-voting system based on blockchain and I am trying to think about a way that i can verify that a vote is legal without reavling the identity of the voter.
One of the solutions ...
- 21
0
votes
0
answers
90
views
How to encrypt keys in a content-addressable store, for lookup and enumeration
I'm implementing a content-addressable file store - similar to a key/value store, but the key is always a hash of the value.
I'd like to build an encryption layer for it, to hide what data is being ...
0
votes
1
answer
43
views
Would a consensus algorithm like the one I describe work?
Given n nodes(miners/validators),
Every unspent transaction output is broadcasted to all n nodes.
Each node will select a batch of transactions and add it to their
block. The specific mechanism of ...
- 1
1
vote
1
answer
190
views
How should I interpret this definition of the Dolev Yao Closure?
Please see the image below which represents an algebraic definition of the Dolev Yao Closure. From reading around, it appears this is BAN logic and that the lines mean "If you believe the above ...
- 113
0
votes
1
answer
48
views
How to know who is an attacker in byzantine broadcast?
2 requirements of Byzantine broadcast (consistency and validity) only state honest node should output certain bit without mentioning what should malicious nodes do.
How do we know the identity of each ...
- 3
1
vote
1
answer
109
views
Why lattice based cryptographic schemes usually are not bandwidth efficient?
The question is mainly stated in the title. I am new to lattices and I have a basic understanding of them but not something in depth. I was watching a presentation of of a VSS (Verifiable Secret ...
- 826
0
votes
2
answers
88
views
Encryption algorithm where proving the decryption is equal to spoiling the key?
Is there an encryption algorithm or MAC algorithm for which NO zero-knowledge-proof exists, provably? I want people who want to prove that a ciphertext decrypts into some plaintext to have to spoil ...
- 115
1
vote
1
answer
150
views
Is it necessary to (length) pad a fixed length one time pad in the presence of a HMAC?
Imagine a protocol where all one time pad messages are of a fixed length. And they're textual only, à la Truths/Tweets. So a short message would be padded with spaces (ASCII 32) up to the protocol's ...
- 14.5k
0
votes
0
answers
32
views
Verifying meeting by sending same signed random number to central authority?
I am trying to develop a simple protocol for two users to verify (with respect to a trusted central authority) that they have (intentionally) met/communicated with each other.
My idea was this: Users ...
- 101
0
votes
1
answer
68
views
Short description of encryption methods? [closed]
I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them.
Hash then encrypt
MAC then encrypt
Encrypt and MAC
Encrypt then MAC
- 1
0
votes
0
answers
36
views
How is there a $\frac{1}{poly(n)}$ bias in a multiple-round coin tossing protocol with commitment?
On p.2, Example 1.1 (in this paper), there is a description of a coin tossing protocol with bias 1/4. In the paragraph below the example, they note that for a protocol with $r$ rounds (assume for the ...
- 321
1
vote
2
answers
146
views
Is there a winning strategy based on this coin-flipping protocol?
Given the coin flipping protocol:
A chooses $a \in_R \{0,1\}$ and computes $commit(a,r)$. She sends $commit(a,r)$ to B.
B chooses $b \in_R \{0,1\}$ and sends $b$ to A.
A sends $open(a,r)$ and B ...
- 321
1
vote
2
answers
137
views
Proving that a protocol is not attackable
Consider the following protocol:
$A\rightarrow B: \{N_A,A\}_{pk(B)}$
$B\rightarrow A: \{N_B,N_A\}_{pk(A)}$
$A\rightarrow B: hash(N_B, A, B)$
where it is intended that when either $A$ or $B$ has ...
- 151
0
votes
0
answers
147
views
PSK based resumption vs session ID/ticket based resumption in TLS
I was reading about TLS 1.3, and noticed how session resumption was done via PSKs instead of Session IDs/Session Tickets. But from what I've understood, PSKs just seem like a combination of Session ...
3
votes
1
answer
131
views
What is the purpose of the WireGuard handshake mac1 field?
The mac1 field in the WireGuard handshake messages is populated as:
...
1
vote
1
answer
101
views
Version rollback attack prevention in TLS 1.2?
Are there any methods to prevent version rollback attack while using TLS 1.2 (apart from disabling lower versions)? I've read about how TLS 1.3 provides a downgrade protection mechanism which is ...
4
votes
3
answers
658
views
Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?
Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
- 327
1
vote
0
answers
32
views
Developing a Simmetric Key Distribution protocol to use with rfc6238
I'm trying to develop a Key Distribution Protocol to share symmetric keys in RFC 6238 (OTP).
I started with RFC 6063, but this protocol is developed over old and known insecure algorithms like PBKDF ...
0
votes
0
answers
33
views
Password Authenticated Key Exchange Protocol
This problem appeared in a past exam paper.
In PAKE (password authenticated key exchange) protocols, $A$ and $B$ authenticate each
other by knowledge of a shared password that is too weak to allow an ...
- 151
1
vote
1
answer
65
views
Create an or-proof for a given list of elements with public input
Let $g\in G$ and $h\in H$ be two group generators. Given a list L of m group elements, where $L=(L_1,...,L_m)$, a prover wants to convince a public verifier (namely, a verifier who only has public ...
- 79
1
vote
1
answer
89
views
Anonymous PAKE using two party computation
Let's say client side has a secret password $\pi$. The server has a series of indices $0..n-1$ and a salt associated value $s_i$ for all $i \in \{0,n-1\}$ call it set $S=\{s_i |
i \in \{0,n-1\}\}$ ...
- 561
3
votes
1
answer
93
views
Implementation of a "running hash" on constrained devices
The following link documents a proposal for a TLS-like alternative for constrained devices.
https://github.com/lake-wg/edhoc/blob/4f56898808989e449cc412a8b136674202a0ddce/draft-ietf-lake-edhoc.md#...
- 2,073
2
votes
1
answer
122
views
Does TLS use use two symmetric keys in the same way SSH does? One for client to server and one for server to client communication?
As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
- 73
5
votes
1
answer
2k
views
Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?
As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
- 73
0
votes
0
answers
109
views
Difference between WhatsApp and Signal implementation of the Open Whisper Protocol
WhatsApp has taken the step of using the Open Whisper Protocol for their message encryption, borrowed from the Signal application.
I was wondering if there was any obvious, high level, difference in ...
- 145
2
votes
1
answer
96
views
Question about malicious security in protocol using OT
I was studying a protocol that used an OT and suddenly and suddenly I realize that I fail to imagine how a protocol using an OT could be malicious secure.
Suppose we have a protocol P that use an OT ...
- 21
0
votes
2
answers
205
views
How can I use a secret sharing scheme when the secret is not a number but a statement?
I want to use a secret sharing scheme, where every player $i\in N$ has to share a pair of secrets $(l_i,\nu_{l_i})$, where $l_i$ is a unique code (positive integer) for every player, but $\nu_{l_i}$ ...
- 279
1
vote
1
answer
124
views
Mathematical formulation for a cryptosystem
I will try to define easily the cryptographic system of this paper. The author designs a communication game for $N$ players. The private information of every player is denoted as $t_i\in T_i$ and ...
- 137
1
vote
1
answer
99
views
Could someone explain the protocol of Yevgeniy Dodis, Shai Halevi, and Tal Rabin in details?
This is from the paper of Yevgeniy Dodis, Shai Halevi, and Tal Rabin
Could anyone provide some help about understanding how the following protocol is executed? The game is played based on the sequel ...
- 137
0
votes
1
answer
54
views
Is this a well defined sharing scheme to propose
A proposed secret sharing scheme: Suppose that $p:S\times Y\to X$, with $|Y|\geq|S|$ is a cipher where, $y\in Y$ is the key and $x\in X$ the code, $p$ is bijective, namely $(x,y)$ is associated with ...
- 279
1
vote
0
answers
54
views
Could anybody help by applying a secure multiparty secret sharing scheme?
Suppose that we have a multi-secret sharing scheme as it is described in the literature
Let there be $I$ agents and say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\...
- 279
2
votes
0
answers
94
views
Secure multiparty scheme in key (splitting) distribution among the players
Suppose that we have a game with $I$ players and each of them has a private secret say $e_i$. Every player wants to share her secret with the rest of the players but in such a way that she will not be ...
- 279
1
vote
0
answers
158
views
xChaCha20 Block Keys for Poly1305
So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
- 123
1
vote
0
answers
35
views
Looking for an E2EE protocol
I'm working on an application that allows people to share different types of data with other people that are in the same group. Group limit is 16 people. Logic behind it is very similar to group chats....
- 111
1
vote
0
answers
104
views
Classic secret sharing schemes vs Homomorphic secret sharing schemes
What is the difference between the classic secret sharing schemes that are used in the protocols of Ben-or and Rabin, Ben-Or, M., Goldwasser, S., Wigderson (that is the Shamir's secret sharing scheme) ...
- 279
2
votes
1
answer
108
views
Why do we always assume that the functions that the protocols can replicate are of the form $f:\{0,1\}^*\to\{0,1\}^*$?
Taking into account the vast literature of secure multiparty computation and secret sharing, there is a specific assumption that is made for the calculation of a rule function. The latter function ...
- 279