Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
1
vote
1answer
51 views

Instead of sending a set of random values, send a key for a PRF

Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and ...
4
votes
1answer
622 views

Challenge / Response to Prevent Replay Attack - Using nonce as challenge

I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other. My plan ...
0
votes
1answer
42 views

Economically Rational as a security proof

Is it possible to prove the security of a cryptocurrency payment protocol by saying that the actors will seek to maximize their profits. Would I need to set this up as a game and prove it that way or ...
6
votes
1answer
190 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
0
votes
1answer
68 views

Is function Deterministic or Probabilistic in the malicious security definition?

As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
1
vote
1answer
60 views

How can process algebra help to design security protocols?

Would you please tell me how process algebra could help me to design security protocols? More specifically, can I use it for proving the security of protocols? Is process algebra used for any ...
2
votes
1answer
342 views

Getting a Keeloq manufacturer key

I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-...
-1
votes
1answer
53 views

Which of these deductions are true about the simulator and the adversary?

Which of these deductions make sense? The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
1
vote
1answer
69 views

A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
0
votes
1answer
55 views

Using the security definition in the malicious model to prove security in the semi honest model

Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm) Would you ...
2
votes
1answer
91 views

How to use Real-Ideal model in a specific scenario (two party with cloud)

I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
5
votes
1answer
114 views

How do mix networks work with server downtime?

I am looking for an analysis of practical mix networks with server downtime. For example, if a message is supposed to go from A -> B -> C -> D, what happens if B wants to send the message but C is ...
9
votes
3answers
368 views

Can a device prove the identity of its own code?

Say you have a computing system that has some functionality that is not in itself cryptographically secure, but you want to make sure is executed as specified, and, e.g. an adversary hasn't re-flashed ...
4
votes
1answer
133 views

shared symmetric key

Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify ...
3
votes
2answers
4k views

Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
-2
votes
1answer
29 views

Should I use failed decryptings to handle multiple session keys?

I feel like this question is specific enough to stand on its own. Say I have a set of clients each with a unique ID and already established pair of session keys for each client. When a client ...
0
votes
1answer
156 views

Basic encrypted custom protocol

I've been suggested to ask here instead of stackoverflow, so here I am. I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols ...
2
votes
0answers
54 views

Can “X3DH” instead of HMQV be used for OPAQUE?

So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether ...
10
votes
2answers
980 views

Shared secret: Generating Random Permutation

-- or: How to Play Poker Without a Dealer I know this question is long but it's a really interesting theoretical problem about shared secrets and multi-party computation. General Problem: "Shared ...
2
votes
0answers
51 views

breaking anonymous key exchange protocol

An anonymous key exchange protocol $P$ is pair of probabilistic machines $(A,B)$ that sends messages to each other and at the end, both $A$ and $B$ will share the same key $k$. The attacker can see ...
3
votes
3answers
331 views

Zero-knowledge transfer of value protocol inspired by EC El Gamal

This is a follow up on the question I asked here. I designed a scheme that allows the following: Alice has a value $a$ which she wants to keep secret Bob has a value $b$ which he wants to keep secret ...
6
votes
1answer
172 views

In coin flipping protocols, why aborting is allowed, and why the non-aborting party flips a coin at the end?

To convey how an adversary can bias the coin, most often a simple commitment-based two party coin-tossing protocol is given, as in [1]: Alice sends Bob the commitment $c = commit(x)$ Bob sends Alice ...
5
votes
3answers
1k views

Is it usual for a signed message to contain the public key of the signer?

In protocols/systems which use ECDSA, is it common for the message to contain the public key of the message signer? If not, how do recipients know that the message has been signed by the correct ...
1
vote
0answers
145 views

Leak information (new setting)

This question is similar to Leak Information?, but with new settings. Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at ...
0
votes
1answer
42 views

How can I prove I'm the recipient of an encrypted message without revealing my identity and the message?

Alice wants to leave a message for Bob. So she encrypt a signed message with Bob's public key. Then leaves it at a dead drop service. Then later Bob arrives and checks the messages and attempts to ...
2
votes
1answer
51 views

Would it be possible to negotiate a key of 128 or 256 bits strength using Merkle puzzles?

One can be fascinated by the simplicity of the schemes created by Ralf Merkle; like the Merkle tree or his key negociation protocol over an insecure channel. Wikipedia has some material on "Merkle ...
1
vote
1answer
366 views

Storing Salt in Ciphertext?

I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
4
votes
3answers
170 views

How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...
2
votes
1answer
176 views

Key establishment from secret answer to a question using Socialist Millionaire Protocol

I have read this as telling that two parties sharing a low-entropy secret (such as a secret answer to a question) can use it to establish a high-entropy shared secret key across a classical insecure ...
3
votes
2answers
436 views

Doing RSA-KEM with RSA-OAEP

I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/...
1
vote
1answer
85 views

Does semi-honest adversary eavesdrop honest parties communication?

Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to ...
0
votes
1answer
69 views

Conditional $k,n$ secret sharing

I would like to know if there is a way to place a condition on $k$-out-of-$n$ secret sharing such that out of $k$ participants who can pool their shares to reconstruct a secret, one of them should ...
3
votes
0answers
102 views

Proof of knowledge of exponentiations

I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of ...
2
votes
1answer
75 views

Robust combiner for preimage resistance

My question is about chaining two hash functions to create a robust combiner for preimage resistance. @Zooko already gave a detailed answer here: $$H_{\circ}(x) = H_0(H_1(x))$$ is as strong as ...
2
votes
2answers
126 views

Bellovin ESP Attack on UDP Packets

In Bellovin's ESP Attack, it is stated that: If $L_A$, $L_B$ are using UDP, attack is easier: Wait till session ends Allocate $L_B$'s UDP port to $X_B$ Replay all packets So, how ...
6
votes
1answer
825 views

Secure group chat with large groups

I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group. Whatsapp also limits group size to ...
1
vote
1answer
83 views

Multi User limited Time Encryption of big Datasets

Updated Question: New Thread Original Question: (Thanks cypherfox for answering that one) I am in need to store data > 100 TB on a local network share (NAS/SAN) and grant individuals access to the ...
1
vote
1answer
115 views

One-time token to decrypt a local file

I am trying to achieve the following: Encrypted files are stored on users filesystem. The user uses my client to authenticate against a server. Once he is authenticated successfully he gets a token ...
3
votes
2answers
112 views

Fully homomorphic encryption with polynomials

I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea. Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
1
vote
1answer
319 views

mbed tls DTLS v1.2 system with -ECDHE-ECDSA, mutual auth and pre-installed public/private keys, no unnecessary messages or ASN.1/X.509 decoding

I am designing an IoT system based on Silicon Labs EFR32 MCUs with hardware accelerated support for SHA-256, AES-128-CBC and ECC (m255) computation. The system will communicate over a proprietary ...
1
vote
1answer
48 views

Algorithm design to verify an assertion on encrypted values

I'm trying to design some kind of protocol but I'm stuck, need some help please.. Given $ (a,b,c)\in \mathbb{N}^+$ with $ a + b = c $ I need to send an asymmetric encrypted version of a,b and c ...
2
votes
0answers
45 views

Unanimity for three (or more) players

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following unanimity protocol for three players: Three players want to ...
0
votes
1answer
77 views

Analysing communication complexity of a protocol

My question is more about the practical side of designing crypto. protocols and it is related to complexity. So, if you think it's irrelevant to this forum please kindly let me know and I will remove ...
27
votes
1answer
7k views

Zero knowledge proof protocol example?

Alice is color blind. She never knows if her gloves are matched. Her brother Bob always teases her saying her gloves are mismatched and she should go change them. Alice wants to know if Bob ...
2
votes
1answer
97 views

Homomorphic encryption of logical OR/AND

Are there any ways to perform homomorphic encryption of logical OR (or logical AND) without using fully homomorphic encryption?
56
votes
3answers
13k views

Signal vs Telegram in terms of protocols?

Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective ...
8
votes
0answers
2k views

Has Telegram security been significantly improved with MTProto 2.0?

Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...
0
votes
2answers
116 views

Decentralised blind leader election

I am looking for a decentralised leader election protocol where each node knows whether or not they were elected leader, but nothing else. In particular, this "blindness" property means a node that ...
5
votes
2answers
274 views

Ways to make a “doomsday” cryptocurrency which becomes untradable

As a social experiment (not a money-making scheme), I'm interested in developing a crazy cryptocurrency which, by its very design, will become worthless and untradable after a certain point. Ideally, ...