Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
5
votes
1answer
339 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
-1
votes
0answers
32 views

Difference between a Cryptosystem and a Protocol

Could you please describe the difference between a cryptosystem and a protocol?
2
votes
0answers
20 views

Is there an interactive proof protocol for proving that a preimage in a map $g: Z_{q}^{n} → G_{T}$ is mapped to a given public value, say y?

There already exist interactive proof protocols with logarithmic communication for proving that a secret multi-exponent $x ∈ Z^{n}_{q}$ for a public multi-exponentiation $P = \textbf{g}^{\textbf{x}} ∈ ...
1
vote
1answer
185 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
3
votes
0answers
62 views

Use of nonces in the SIGMA protocol and not in C(2e, 2s) of NIST SP800-56a?

While reading the paper on the SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols (Krawczyk,2003), I noticed that in the "full-fledge" ...
0
votes
1answer
396 views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
119
votes
6answers
79k views

Should we sign-then-encrypt, or encrypt-then-sign?

We regularly want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active ...
0
votes
1answer
58 views

Byzantine Agreement: Why does OM need f+1 rounds in a synchronous setting?

To get Byzantine Fault Tolerance in a synchronous model you can use an Oral Message Algorithm. For n > 3f+1 it gets an Byzantine agreement in ...
13
votes
5answers
6k views

Is it easy to crack a hashed phone number?

I want to SHA256 hash phone numbers in order to hide them. Is this a good idea? Are there any other ways I could make this safe?
48
votes
1answer
10k views

Why do 5G, 4G, etc. use non-conventional algorithms?

Looking up information about 5G and the previous 3GPP standards, why have they been incorporating non-conventional algorithms into the standards? For example AES has been considered secure for ages ...
0
votes
1answer
52 views

Can two traitors safely reveal themselves to each other?

Suppose Alice is a traitor and suspects Bob might also be a traitor. If Bob is a traitor, she would like to conspire with him together, if not she doesn't want to reveal that she is a traitor. Is ...
0
votes
1answer
90 views

Is the following non-interactive zero-knowledge set membership protocol provable secure?

Given the following Zero-knowledge set-membership protocol https://infoscience.epfl.ch/record/128718/files/CCS08.pdf]. That is given in the following steps (Please refer to page 9). The Verifier -...
0
votes
0answers
26 views

Corona Contact Tracing message exchange

For a university project, I have to design a contact tracing protocol. In my approach, a blockchain is used. Every participant has to generate 3 nonces for every contact. They are hashed in multiple ...
1
vote
1answer
62 views

Question of proving the opening of Pedersen Commitment

Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
0
votes
0answers
41 views

Computational Binding of Pedersen Commitment

Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen ...
5
votes
1answer
770 views

One ciphertext, multiple keys, multiple messages

I recently came across following idea, does anyone know a name and if it is actually used? A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (...
0
votes
0answers
35 views

Diffie-Hellman Key Exchange - Key Derivation before Execution

I am dealing with protocol design regarding the Diffie-Hellman Key Exchange (DHKE). The DHKE is performed by the Key Master and some Slave Component. Afterwards, a session key is transmitted using the ...
3
votes
1answer
145 views

How are initialization vectors used in TLS 1.1?

From my understanding, TLS 1.0 can use CBC to encrypt data. To do so, it creates one initialization vector (IV), and then uses the previous ciphertext block as the IV for the next record. I made this ...
0
votes
0answers
20 views

Do EMV log contain any dangerous data?

I accidentally leaked EMV log taken from application Credit Card Reader of my Credit card. I want to know if anybody can use it for harm (I haven't entered PIN). Thank you so much. Also I couldn't ...
11
votes
0answers
893 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
1
vote
0answers
54 views

Can two anonymous parties determine whether they interacted before, without being able to link encounters?

Assume an anonymous communication system in which anonymous parties randomly meet in pairs to exchange information. How could two anonymous parties determine whether they have interacted before, ...
1
vote
0answers
23 views

How does one ensure that a handshake protocol is secure assuming all underlying cryptography used are secure

Suppose one have to design handshake protocol using known secure cryptographic algorithm. The designer of implementer can assume that crypotography is secure but how would they ensure protocol itself ...
0
votes
1answer
61 views

How modern messengers encryption keys can't be hacked [closed]

I dont know is this question more like reverse-engineering or cryptographic. Why governments are hunting for encryptions keys? Aren't they delievering by the network the same as the encypted messages? ...
0
votes
0answers
20 views

Append-only log with secret metadata?

I need sets of encrypted records which need to be stored in an append-only log. It should be possible to efficiently recover just the headers of each record, so that specific records can be retrieved ...
0
votes
0answers
60 views

Importance of Backward and forward secrecy

Which security feature is more important in security protocols being used in different applications? Forward Secrecy or Backward Secrecy
1
vote
2answers
434 views

Use Cases of Otway Rees key exchange protocol

I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is ...
4
votes
3answers
389 views

Role of session identifier in Otway-Rees protocol

According to Wikipedia, Otway-Ress protocol is as follow: The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$...
1
vote
1answer
114 views

Non-repudiation and digital signature of a dishonest participant

Let's assume a dishonest Alice who sends, encrypts & digitally signs a message to Bob. Bob stores the decrypted message and the digital signature in a database. However, Alice is a bad girl and ...
377
votes
13answers
129k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
1
vote
0answers
25 views

Why isn't Kerberos using temporary keys to avoid dictionary attacks?

In the Kerberos protocol, the user sends his ID, the server (Or ticket granting server) ID and a nonce value. The Key Distribution Center uses a key (I assume symmetrical) derived from the client's ...
1
vote
2answers
170 views

How to design a secure challange-response authentication protocol?

I am implementing a custom challenge-response protocol to authenticate a client to a server. Mutual authentication is not required, i.e. the server doesn't need to be authenticated to the client. The ...
14
votes
0answers
631 views

Crypto AG (Switzerland) - Which algorithms were used and how did the backdoors work?

Backstory Crypto AG was a company located in Switzerland that specialized in communication security. They produced a number of encryption machines (some similar to the infamous Enigma) used for ...
0
votes
0answers
39 views

Conditioning access to private key?

I would like to provide a public/private keypair to a user, but require that the user obtain an authorizing key before being allowed to use the private key. I don't want the authorizing party to have ...
0
votes
0answers
39 views

Secure equivalent for giving an unknown card, applied to magician's card tricks

I suspect that this is already something trivial, but I can't find the answer, probably because I don't know how to search the cryptographic primitive that refers to my problem. Imagine the typical ...
0
votes
1answer
72 views

Secret community forming based on zero-knowledge proof (IOT)

I want to discuss a simplistic scheme that comes to my mind, after I read about zero-knowledge proof and some fermentation time. I should mention that this is not born out of a business need or ...
1
vote
1answer
145 views

How to play Mental Skull

"Skull" or "Skull and Roses" is a table top game. The rules can be found here. I was thinking of how I could play this game P2P. At first it seemed easy: Each time I had to place a card face down I ...
0
votes
1answer
44 views

A modified question of Hazay & Lindell's Efficient Secure Two-Party protocols Book

Based on the question proposed on page 27, we propose a modified question as follows: Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($...
0
votes
0answers
32 views

Simulation-based proof in a particular scenario

Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public ...
1
vote
1answer
100 views

Simulator in semi-honest model in real/model paradigm

Does a simulator in the semi-honest model in IDEAL/REAL model paradigm necessarily make use of the corrupted party's input? For example, suppose a simulator given an input named $I$ and an output ...
1
vote
0answers
24 views

How to design a moderated, group for private messages?

I’m trying to figure out how I could create a private group that was P2P yet still allowed someone to moderate members (no public access to messages). I’m assuming standard hybrid encryption (RSA/EC + ...
7
votes
1answer
362 views

How does one design a traffic analysis resistant protocol?

I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
1
vote
1answer
41 views

Difference between Verification and Public Key for Signature Schemes

This is a semantics Question. Typically, in many asymmetric schemes, for this question specifically, digital signatures, we see that designers describe the key given to the verifier as Public Key. ...
3
votes
3answers
147 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
0
votes
0answers
39 views

Protocol for leader election [duplicate]

A leader should be selected by randomly choosing one of three parties A, B and C. The parties use the following protocol: $A → B: N_A$ (where $N_A$ is a nonce) $B → C:$ $N_{AB}$ $= N_A$ ^ $N_B$ (...
0
votes
1answer
89 views

What's the utility of the last two messages of Needham Schroeder Symmetric key protocol

The protocol works like this But I can't understand what's the utility of message 4 and 5, what do they protect from? They do not protect from replay attack if Ks gets compromised because B won't be ...
28
votes
3answers
3k views

Is this password migration strategy secure?

I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
5
votes
0answers
174 views

Efficient proof of knowledge using Carter-Wegman hash

A verifier wants to ensure, with only little exchange of data with other systems, that a large block of data $M$ that the verifier holds is also available to some other system(s). It is not an ...
35
votes
4answers
7k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
1
vote
1answer
81 views

Is there value in performing signature during key exchange?

I looked around the net, however I couldn't see anything authoritative on this. If one is using something like libsodium to perform key exchange (using x25519), is there value in using Ed25519/...
5
votes
1answer
129 views

Build set with PKI from reliable broadcast / random beacon

I am trying to build a protocol (or find an existing one) for creating a set $S_2$ with PKI from a set of parties $S_1$ that initially does not know anything about the other parties. We assume end-to-...

1
2 3 4 5
12