Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

75 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
0answers
692 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
8
votes
0answers
1k views

Has Telegram security been significantly improved with MTProto 2.0?

Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...
7
votes
0answers
141 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
5
votes
0answers
75 views

OTR AKE protocol implementations security

While looking at the different versions of OTR protocol I discovered a strange thing: there is no trace of the patch for the weaknesses that were noted in “Finite-State Security Analysis of OTR ...
5
votes
0answers
161 views

Efficient proof of knowledge using Carter-Wegman hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
5
votes
0answers
478 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
4
votes
0answers
65 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
4
votes
0answers
246 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
3
votes
0answers
102 views

Proof of knowledge of exponentiations

I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of ...
3
votes
0answers
62 views

Draw/Lottery with hidden but provable outcome?

I have a scenario in which one of n participants is to be assigned a positive value and all other participants a negative value. The outcome of the draw is to be known only by the respective ...
3
votes
0answers
85 views

High-latency anonymous communication minimum delay?

High-latency anonymous communication (e.g. Mixmaster and Mixminion) delay messages for a long time using mixers to anonymous communications. I understand that it has applications for email and p2p but ...
3
votes
0answers
144 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
3
votes
0answers
246 views

Shared-secret authentication with implicit session keys?

Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which ...
3
votes
0answers
835 views

Why does encryption in STS protocol protect against identity attacks?

The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ...
3
votes
0answers
511 views

Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
3
votes
0answers
133 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
3
votes
0answers
309 views

Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
2
votes
0answers
39 views

No freshness protection for single messages, but for the overall protocol

I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for ...
2
votes
0answers
70 views

Security of MAC-Then-Encrypt without MAC key authentication

We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
2
votes
0answers
26 views

Is there a scheme to force a party to generate a fresh key?

Is there a way to force one party to generate a fresh key, such that another party can be convinced that the key was freshly generated, without that party also knowing the key? I'm motivated by a ...
2
votes
0answers
62 views

Concept for a RSA “repeater”. Is it sensible?

I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my ...
2
votes
0answers
54 views

Can “X3DH” instead of HMQV be used for OPAQUE?

So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether ...
2
votes
0answers
48 views

breaking anonymous key exchange protocol

An anonymous key exchange protocol $P$ is pair of probabilistic machines $(A,B)$ that sends messages to each other and at the end, both $A$ and $B$ will share the same key $k$. The attacker can see ...
2
votes
0answers
45 views

Unanimity for three (or more) players

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following unanimity protocol for three players: Three players want to ...
2
votes
0answers
76 views

Plaintext DH keys in the message header in the Double Ratchet Algorithm

I've been reading details about the Double Ratchet algorithm, and I wanted some clarification regarding the aspect of the DH public keys going out in the plain in the header of every message. Quoting ...
2
votes
0answers
56 views

Efficiently formatting data so that each byte is critical

I'm experimenting with implementing a Fair Exchange Protocol that assumes there is a trusted third party to provide a hash-checksum of the two files for each missing byte, (so that the exchange can ...
2
votes
0answers
30 views

Can “PrivateKey+MagicValue” decode pre-encoded data without intermediate key?

Let's say I want to build a public repository of encrypted files. EncA(FileA) EncB(FileB) ...
2
votes
0answers
206 views

Simultaneous 2 way exchange without trusted third party

Stakeholders: Alice - has a message, M containing a secret, SA that Bob wants, where H(SA) is a hash which may be used by Bob to redeem some Bitcoin time-locked transaction sent previously by Alice. ...
2
votes
0answers
120 views

Designing a secure protocol to avoid MITM?

Imagine that you are designing an online game, the framework consists of a player A, a game host H and a trusted central server S. The player A has a symmetric key KAS and id A that is known to ...
2
votes
0answers
32 views

Publishing only items your subscriber previously subscribed to, without you knowing which those items are

Let's say you were given a dump from a security breach. You want to share the email addresses affected by the breach with a separate company who pays you for this service so that they can protect ...
2
votes
0answers
245 views

Security of a lightweight heartbeat protocol

I am implementing a heartbeat protocol so that a server can send notifications to clients. The notifications are not occurring so often, so I don't want to keep an open TCP+TLS session for each client,...
2
votes
0answers
62 views

How to force an adversary to call a certain oracle?

Consider there is a protocol in real world, which uses a random oracle $\mathcal{H}$. In the ideal world, after the calling of $\mathcal{H}$ by some parties, intuitively I want the simulator gets some ...
2
votes
0answers
157 views

Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate ...
2
votes
0answers
164 views

A question or few about Mental Poker

I have spent some time studying the "Mental Poker" protocol (sometimes called SRA), initially proposed by Shamir, Rivest, and Adleman -- http://people.csail.mit.edu/~rivest/ShamirRivestAdleman-...
2
votes
0answers
130 views

Common pitfalls of session key activation?

Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly ...
2
votes
0answers
105 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
2
votes
0answers
191 views

encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
2
votes
0answers
180 views

Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
2
votes
0answers
91 views

Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
2
votes
0answers
204 views

Relaxed trust criterion for mental poker server?

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
1
vote
0answers
38 views

Did key-wrap modes see actual use?

Is there an IETF standard-track protocol have IANA-registered IDs for deterministic authenticated encryption yet? If not, what's preventing their adoption? What changes to protocols will DAEs likely ...
1
vote
0answers
104 views

How to prevent reflection attack in Needham-Schroeder in ECB mode?

We know that Needham-Schroeder is vulnerable to a reflection attack as shown here. How can I make it secure using ECB and without using timestamps? I need to modify the protocol. Otwan-Rees is a ...
1
vote
0answers
51 views

Is it necessary to transmit two or three points of an elliptic curve?

Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
1
vote
1answer
102 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
1
vote
0answers
145 views

Leak information (new setting)

This question is similar to Leak Information?, but with new settings. Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at ...
1
vote
0answers
96 views

Zero Knowledge Proof

In the following protocol $(P,V)$, prover $P$ and verifier $V $have common input $(N,X) \epsilon QR$ while the prover also has private input $x \epsilon SR(N,X)$. Let $SR(N,X) = \{x \epsilon$ $Z_{n}^{*...
1
vote
0answers
210 views

Design a simplified version of the protocol for secure addition

To learn secure multiparty communication, I want to design a simplified protocol for secure addition, where instead of receiving two (random) numbers in $Z_p$, a player only receives a single (random) ...
1
vote
0answers
27 views

Digital Dead Drops or guaranteed significant uncertainty of identity over TCP/IP for a large set of users

Client is part of a Set members. Every distinct object in members has in common, that they do want to communicate to the Server without the Server or other objects of members knowing the origin of ...
1
vote
0answers
74 views

Secure Communication Protocol Design using oblivious transfer?

I have a problem I need to solve with the following scenario and I hope someone can help me find an approach or direction to start tackling it. Consider Alice as a sender who has $n$ strings which ...
1
vote
0answers
135 views

Encrypted comms between devices on LAN

I'm trying to encrypt a protocol that shares data between devices on a local area network (i.e.no connection to the internet). I don't want to use predefined keys because they're too easy to read from ...