Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
6
votes
2answers
2k views

DRM simple clone

I have been trying to encrypt media(Video and audio content) from a nodejs server to a client like android or iOS. I heard of DRM but could not get a reliable implementation of DRM. I wanted to make ...
3
votes
1answer
90 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
1
vote
0answers
221 views

Design a simplified version of the protocol for secure addition

To learn secure multiparty communication, I want to design a simplified protocol for secure addition, where instead of receiving two (random) numbers in $Z_p$, a player only receives a single (random) ...
1
vote
1answer
39 views

Efficient protocol to give out N known items randomly to k>=3 parties without independent bodies

There are $N$ items which are to be uniformly randomly distributed (every possibility has equal probability) to $k\geq 3$ parties, such that no individual party can change the probability of getting ...
5
votes
1answer
443 views

Implementing Secure multi-party computation for online website

I need to know if the following is feasible: I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the ...
-5
votes
1answer
95 views

Is a symmetric cryptographic code secure if only the sender and recipient know the method used to encrypt? [closed]

I recently designed an encoding method that I'm fairly sure is unique. Is it universally secure, provided that anyone intercepting the message doesn't know anything about how it was encrypted? Could ...
3
votes
0answers
87 views

High-latency anonymous communication minimum delay?

High-latency anonymous communication (e.g. Mixmaster and Mixminion) delay messages for a long time using mixers to anonymous communications. I understand that it has applications for email and p2p but ...
4
votes
0answers
126 views

What's the difference between game-based and simulation-based security? [duplicate]

What's the difference between game-based and simulation-based security? When we use the simulation-based, how to construct the simulator based on the adversary?
1
vote
1answer
295 views

Byzantine agreement and PBFT

I have just gone through Feldman-Micali, Dolev-Strong, KatzKoo (basically, most of the literature behind Byzantine agreement), however all of their protocols take a really incredible amount of rounds. ...
1
vote
1answer
108 views

Would reuse of the symmetric key in a hybrid cryptosystem between files be inherently insecure?

This question stems from a UX problem where I want to allow the user to input their PIN only one single time when they open up an mobile app. Here are some properties of the application to provide ...
0
votes
1answer
126 views

Elgamal Protocol Failure

I'm having a difficult time trying to solve this problem. Suppose Alice uses the Elgamal signature scheme with $(\alpha, \beta, p) = (2, 33384, 65539)$. She publishes the two signed messages:...
8
votes
1answer
258 views

Is a key ratchet effective against replay attacks?

In the answer to this question, a message counter is used to protect against replay attacks. Could a key ratchet be used instead? The basic idea is that with every message sent, the symmetric ...
3
votes
2answers
1k views

Deniability of OTR messaging

I've been looking at the off-the-record messaging protocol, and there is something about its deniability property that seems strange to me. Consider the following scenario: In the course of an OTR ...
4
votes
1answer
2k views

What does the Double Ratchet algorithm need the Root Key for?

One of the basic ideas of the Double Ratchet algorithm is that it performs DH exchanges in-band using a clever “half-DH” trick. For some reason, instead of directly deriving the Chain Key from the DH ...
4
votes
1answer
443 views

What is the lightweight key exchange protocol of choice?

Assume I have to implement a secure channel protocol by myself. Assume further that for some obscure reasons (library restrictions?) I can't use any of the pre-made libraries for SSH, TLS and such. ...
1
vote
1answer
508 views

Sigma protocol to prove that the prover knows how open a commitment

Sigma protocol to prove that the prover knows how open a commitment. Consider the unconditionally hiding commitment scheme based on discrete log, i.e., the public key $p_k = (p,g,y)$, where $\langle ...
6
votes
1answer
174 views

How to improve long-term duration of standard checksum for authenticity purposes?

Official CMS's of Government gazettes (in the third world), need to publish the checksum of each article and each cited external documentin (eg. full-text contracts) in a permanent support medium like ...
9
votes
1answer
1k views

What is the original SKID3 protocol?

While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it. The basic structure is the following: (1) $A \rightarrow B: r_A$ (...
2
votes
1answer
217 views

Bit Commitment - from any One Way Permutations

In the Wiki Page on Commitments, it is given that a commitment scheme may be perfectly binding or perfectly concealing but not ...
3
votes
1answer
61 views

Is it feasible to design a crypto scheme for centralised reporting of anonymized data?

I would like to find out if it is feasible to design a cryptographic scheme that would allow several "reporting parties" to independently transfer information to the same centralised "authority", ...
50
votes
7answers
8k views

One Encryption, Many Decryption Keys

I would like to share access to encrypted data among many recipients. I do not know the recipients ahead of time (when encrypting the data). Once the data is encrypted, I do not have access to the ...
2
votes
2answers
181 views

How to contruct a pseudorandom with a specific property

How to construct a pseudorandom function $PRF$ with the following property: Probability that $PRF(k_1,i)=PRF(k_2,i)$ is negligible, for all keys $k_1,k_2$ such that $k_1\neq k_2$ Does the PRF with ...
3
votes
1answer
81 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
5
votes
1answer
261 views

Geometric Cryptography and Zero-Knowledge Proofs

Trying to understand zero-knowledge proofs, I came across this page, which provides an excellent example of a simple cryptographic protocol. I will reproduce the protocol here for the sake of ...
2
votes
3answers
262 views

Are there historical examples of Occam's Razor being useful to cryptography research?

Previously, I asked what is the simplest digital signature scheme known, under the assumption simpler implementations could provide valuable insights on the nature of the problem. Among competing ...
2
votes
2answers
268 views

Collision-resistant Pseudorandom function

Assume we have a pseudorandom function: PRF(.) We want the following property holds with a high probability: $\forall i, 0\leq i \leq n: PRF(k_1, i)\neq PRF(k_2,i)$ where $k_1$ and $k_2$ are two ...
3
votes
1answer
138 views

Piggyback on Bitcoin for independent data verification?

The recent threats to EPA data integrity have me wondering if it's possible to archive data in a way such that one can later check whether the data have been tampered with since the original archival. ...
4
votes
1answer
630 views

One ciphertext, multiple keys, multiple messages

I recently came across following idea, does anyone know a name and if it is actually used? A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (...
5
votes
2answers
145 views

What requirements would lead to the development of a new security protocol?

I recently completed a semester studying some basic amount of cryptography. So my knowledge is not very broad/deep. What I currently see is that we have a bunch of fairly secure encryption modes to ...
1
vote
1answer
85 views

Is battery usage an important parameter for mobile based key exchange protocol?

I am studying a key exchange protocol based on public key cryptography technique specifically designed for mobile devices. I noticed there is no importance given to battery usage by these protocols. ...
9
votes
2answers
1k views

Alternative for RFC 6238/4226 - one time password via SMS (single-factor authentication)

Currently we have implemented One Time Passwords (OTP) as second authentication which works well. We use TOTP - RFC 6238 Some clients would like to have a "sms only" login, so it's single factor ...
1
vote
2answers
255 views

What is a simple information authentication protocol for constrained devices?

Background: I have an application where devices will poll information from some source on the network. These devices are very basic and have modest processing and memory capabilities. Hashing (and ...
1
vote
1answer
382 views

Use Cases of Otway Rees key exchange protocol

I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is ...
7
votes
2answers
363 views

Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
1
vote
1answer
425 views

Speeding up the Denning-Sacco protocol?

I have started to study cryptography and I have come across Denning-Sacco protocol. I understand multiplicity vulnerability. My question is why Denning-Sacco protocol choose to generate key on ...
1
vote
1answer
1k views

Why does appending a message to a key before hashing not guarantee integrity? [duplicate]

I want to guarantee the integrity of a message $m$. My first thought is to append the message to an integrity key $k$ and hash it as $H(k\,||\,m)$. However, I have been told that this is not totally ...
0
votes
1answer
73 views

What does this protocol mean?

Does this mean that the message is being added onto the hashed(message, tag) ? m || H(m, "secret") So the output would be something like: "RandomMessage"+...
13
votes
3answers
317 views

Is there a way to optimize a linear scan while preserving anonymity?

I've been wrestling with a problem, and I was hoping if someone else had a bright idea. Here's the problem: I have two sides, Alice and Bob. Alice has a single high entropy string $A$, and Bob has a ...
-1
votes
1answer
69 views

Need Help with understanding authentication process

I want to develop an app which allows to pair between pc using bluetooth then you can send the signal from the phone to unlock the PC(on the same network). I need help with the process after ...
8
votes
1answer
2k views

Replay attack prevention in connectionless UDP encrypted communication

What are the options for replay attack prevention when two parties exchange UDP messages. No connection or session is estabilished. Communicating parties have pre shared key that is used for ...
3
votes
2answers
298 views

Are formal methods used for cryptographic protocol design?

I decided to learn more about the application of formal methods to cryptographic protocols and found this interesting talk by Cathy Meadows at YouTube. After doing research about how people are using ...
4
votes
1answer
159 views

Why is cryptographic model not considered formal methods?

I have just started looking at different methods for analyzing the security of cryptographic protocols. According to my reading, there are two main approaches in this area. The first approach is so-...
9
votes
1answer
770 views

Is there a formal language to define a cryptographic protocol?

I wanted to work on a personal project where I would attempt to identify the flaws in a cryptographic protocol. Now for that to work properly, the program should understand the syntax of protocol ...
2
votes
1answer
120 views

Secure instant messaging protocol and implementation for an anonymous end-to-end chat?

all is said in the title but I will go further. First question : I searched here and I found Tox to be the most powerful protocol. It uses Curve25519, XSalsa20 and Poly1305. They seem to be good ...
6
votes
1answer
2k views

If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
0
votes
1answer
128 views

Whether hash function of two values $h(a,b)=h(b,a)$ are same?

If two messages $M_1$ and $M_2$ are given as input to a hash function $h$ is it then true that $h(M_1,M_2) = h(M_2,M_1)$? I have two messages. I want to know, Is it possible to apply a hash ...
2
votes
0answers
32 views

Can “PrivateKey+MagicValue” decode pre-encoded data without intermediate key?

Let's say I want to build a public repository of encrypted files. EncA(FileA) EncB(FileB) ...
3
votes
1answer
158 views

Secure communication protocol for equality test

I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ. Easy solution is ...
3
votes
0answers
259 views

Shared-secret authentication with implicit session keys?

Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which ...
3
votes
1answer
308 views

Using ChaCha20 on very short messages with high packet loss

I'm building a low power wireless network and need to transmit very small packets at regular intervals (10 bytes every minute or so). In order to secure the communications I'm considering using ...