Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
31
votes
2answers
3k views

Prevent double-spending with decentralized digital currencies without all transactions being public?

A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
2
votes
1answer
78 views

How do quantum key distribution systems tolerate noise?

It seems to me that any noise in the signal would result in Alice and Bob generating different keys, without a simple way to tell the difference. How do quantum key distribution systems tolerate ...
0
votes
1answer
210 views

What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user?

What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user? For example say I have a database table with 50 columns ...
6
votes
1answer
382 views

Private set intersection, using a semi-trusted server

Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
5
votes
1answer
719 views

Security of zero knowledge proof protocols

When designing a protocol based on zero knowledge proofs, be it based on the discrete log problem, or on a Hamiltonian cycle in a graph, or something else, I assume there are security considerations, ...
5
votes
1answer
188 views

Why is does the protocol of Ding et al. produce biased bits and does it relate to passive security?

I am not understanding the following from "Lattice Cryptography for the Internet" by C. Peikert (pages 9): We remark that a work of Ding et al. DXL14 proposes a different reconciliation method ...
1
vote
0answers
96 views

Zero Knowledge Proof

In the following protocol $(P,V)$, prover $P$ and verifier $V $have common input $(N,X) \epsilon QR$ while the prover also has private input $x \epsilon SR(N,X)$. Let $SR(N,X) = \{x \epsilon$ $Z_{n}^{*...
1
vote
1answer
93 views

Is container format relevant to security of encrypted message inside?

Still trying to design a fully binary cryptography container format for my mobile app, I am here asking if container is ever relevant. Thanks to Apple, I cannot use GPG directly because I can neither ...
2
votes
1answer
185 views

Is this ECC based messaging method secure?

I developing an encrypted messaging for ZeroNet (aP2P file-based network, website: zeronet.io) and would like to have some guidelines if any of this could work. My first idea: In ZeroNet every user ...
3
votes
2answers
1k views

How to implement 1-out-of-n OT from 1-out-of-2 OT?

How can I implement a 1-out-of-$n$ oblivious transfer protocol from 1-out-of-2 OT protocol which is resistant against passive corruption? Assume we can access 1-out-of-2 OT $n$ times.
1
vote
2answers
214 views

Why is there a counter in CSPRNGs?

This is probably one of those embarrassingly simple questions, but here goes. Consider the following two constructs: CSPRNG made out of a block cipher (AES) with a counter such as CSPRNG made ...
0
votes
1answer
281 views

Is there an application of fully homomorphic encryption scheme such that encryption key and evaluation key are different?

I want know if there is an application of FHE contains three kinds of users such that: $A$ is the data owner and she has the secret key. $B$ only has the permissions to encrypt (just like a general ...
2
votes
3answers
589 views

Security concern with TOTP

I am pretty new to cryptography and I have been studying up on TOTP (Time Based OTP) and while I have learnt how the computation works, I'm unable to figure out why using TOTP makes a system more ...
50
votes
6answers
8k views

Kerckhoffs’ principles – Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
2
votes
0answers
76 views

Plaintext DH keys in the message header in the Double Ratchet Algorithm

I've been reading details about the Double Ratchet algorithm, and I wanted some clarification regarding the aspect of the DH public keys going out in the plain in the header of every message. Quoting ...
3
votes
1answer
2k views

Equal sign with a “c”

I am not sure whether this is common sense, but I really don't know what this $c$ means in an equivalent sign, from Lindell's How to Simulate It: $$\big\{(S_1(1^n, x, f_1(x,y)), f(x,y))\big\}\...
0
votes
1answer
97 views

RSA Protocol/Generating Primes

So, Alice wants to use the RSA protocol and pays Cindy to generate the two (odd) primes p and w so she can use e=65537 and n=pw as her public key. Alice will then, upon receipt of p and w, privately, ...
0
votes
1answer
60 views

Proving knowledge of a value and computation that uses it

Alice picks random points P and Q in a group where DLP w.r.t. a base point G is hard (I am ...
5
votes
6answers
368 views

Is it possible to ensure security with zero pre-shared information?

Is it possible to secure a communications channel against both passive (sniffing) and active (injecting / MitM) attackers without either legitimate party knowing any pre-shared information? I know ...
1
vote
3answers
255 views

Generating OTP using Digital Dead Drop

I've had a thought and I'm wondering if this would be a useful way to devise and distribute a one-time pad. It relies on a digital dead drop and a hash function. The digital dead drop could take a ...
2
votes
1answer
112 views

linkable tokens

Is it possible for $n$ parties for each to perform operations $f_1$,$f_2$,...,$f_n$ (they can all be the same function) on $x$. Now, another party $A$ given all $n$ values of $f(x)$s should know they ...
1
vote
1answer
154 views

How to generate two different keys out of a single password?

I'm designing a system in which a password is used both for logging in as well as for encrypting some payload. To encrypt a payload I derive a key from the password. Very straightforward so far. ...
19
votes
2answers
8k views

Is TrueCrypt's multiple/cascading encryption safe?

Is TrueCrypt use of cascading encryption safe? Is it useful? TrueCrypt is arguably one of the most popular and widely used encryption applications in use today, yet it seems to use a very ...
1
vote
1answer
214 views

The parameters included in TLS 1.2 server signature in the ServerKeyExchange

In TLS 1.2, section 7.4.3 in the standard documentation on Server Key Exchange Message, it says that the parameters covered by ...
3
votes
3answers
193 views

Can cryptography help create tamper proof voting systems?

After hearing about what happened with the election in Kenya and the related discussion about a “tamper proof voting system”, I was wondering how the use of cryptography could be used to make a tamper ...
11
votes
1answer
336 views

Why was WEP apparently not reviewed by many cryptographers?

According to this analysis of WEP, These attacks point to the importance of inviting public review from people with expertise in cryptographic protocol design; had this been done, the problems ...
1
vote
1answer
63 views

Is it generally okay to substitute “like for like”?

Is it generally okay to substitute “like for like” in cryptographic protocols? For example, many lattice protocols use SHAKE and SHA3 for various purposes. However, both of those are relatively slow ...
14
votes
1answer
2k views

In which situations is a length-extension attack a problem?

A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem? I guess certain naive ...
5
votes
2answers
682 views

What are the standard procedures in cryptanalysis to analyze unknown ciphertext?

What are the "standard procedures in cryptanalysis" to analyze unknown ciphertext? In other words: Are there any protocols, officially acknowledged checklists or something like that which represent a ...
5
votes
1answer
155 views

How to compute result in last step of Socialist millionaires problem?

I was trying to understand Socialist millionaires problem and solution in OTR protocol, but I'm stuck at figuring out how and who computes $(Q_{a}Q_b{}^{-1})^{\alpha\beta}$. If I'm Bob then I ...
2
votes
1answer
145 views

Byzantine agreement implies Broadcast channel [Consesus]

I am not sure if this is the right place to ask but I will give it a try. If not, let me know and I will ask somewhere else :) We discussed the byzantine agreement and broadcast channel in class. We ...
0
votes
2answers
111 views

Signing an exchanged symmetric key that is asymmetrically encrypted

Consider the following implementation: Bob wants to communicate long-term with his team over an unsecured channel. Bob and all members of the team generate individual public/private keypairs (ex. ...
2
votes
1answer
167 views

Challenge to prove possession of file

Suppose Bob wants to give Alice a large file, in such a way that: Bob cannot keep the file, but is able to use it to precompute anything he needs before he gives it to Alice Bob must be able to ...
3
votes
1answer
203 views

Could eVoting on the bitcoin blockchain be done?

I'm basically a crypto noob (and not an english native), so please be indulgent :) I thought about if you could realize an eVoting system with bitcoin. I see 2 major requirements: each citizen can ...
6
votes
1answer
1k views

Can an U2F public/private key-pair for signatures be used for encryption?

I understand that this might be more a process question: Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device ...
16
votes
1answer
763 views

Salary Negotiation Problem

Imagine Alice is applying for a new job. Alice has an idea of the minimum salary that she is willing to accept—let's call this value A. Bob, the hiring manager for ...
3
votes
0answers
62 views

Draw/Lottery with hidden but provable outcome?

I have a scenario in which one of n participants is to be assigned a positive value and all other participants a negative value. The outcome of the draw is to be known only by the respective ...
2
votes
1answer
74 views

Definition of randomly generate in the parallelepiped

I am reading the [CLT13] paper regarding multilinear maps over the integers and I have some troubles in understanding what the following random generation means: The vectors of the matrix $r_i \in \...
2
votes
0answers
56 views

Efficiently formatting data so that each byte is critical

I'm experimenting with implementing a Fair Exchange Protocol that assumes there is a trusted third party to provide a hash-checksum of the two files for each missing byte, (so that the exchange can ...
4
votes
1answer
678 views

What is Byzantine Agreement?

This was mentioned in a different question. However Wikipedia states it is proven to be unsolvable. So I would like to know what it is in this context and - since it is unsolvable - what the ...
2
votes
1answer
104 views

Is it possible to prove the time a message was produced?

Say Bob wants to tell Alice a secret message, then they start some message exchanges protocol. At the end, Alice will receive the secret message and can be convinced that the message was not produced ...
6
votes
2answers
2k views

DRM simple clone

I have been trying to encrypt media(Video and audio content) from a nodejs server to a client like android or iOS. I heard of DRM but could not get a reliable implementation of DRM. I wanted to make ...
3
votes
1answer
89 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
1
vote
0answers
220 views

Design a simplified version of the protocol for secure addition

To learn secure multiparty communication, I want to design a simplified protocol for secure addition, where instead of receiving two (random) numbers in $Z_p$, a player only receives a single (random) ...
1
vote
1answer
39 views

Efficient protocol to give out N known items randomly to k>=3 parties without independent bodies

There are $N$ items which are to be uniformly randomly distributed (every possibility has equal probability) to $k\geq 3$ parties, such that no individual party can change the probability of getting ...
5
votes
1answer
441 views

Implementing Secure multi-party computation for online website

I need to know if the following is feasible: I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the ...
-5
votes
1answer
95 views

Is a symmetric cryptographic code secure if only the sender and recipient know the method used to encrypt? [closed]

I recently designed an encoding method that I'm fairly sure is unique. Is it universally secure, provided that anyone intercepting the message doesn't know anything about how it was encrypted? Could ...
3
votes
0answers
85 views

High-latency anonymous communication minimum delay?

High-latency anonymous communication (e.g. Mixmaster and Mixminion) delay messages for a long time using mixers to anonymous communications. I understand that it has applications for email and p2p but ...
4
votes
0answers
121 views

What's the difference between game-based and simulation-based security? [duplicate]

What's the difference between game-based and simulation-based security? When we use the simulation-based, how to construct the simulator based on the adversary?
1
vote
1answer
294 views

Byzantine agreement and PBFT

I have just gone through Feldman-Micali, Dolev-Strong, KatzKoo (basically, most of the literature behind Byzantine agreement), however all of their protocols take a really incredible amount of rounds. ...