Questions tagged [protocol-design]
Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).
118
questions
12
votes
5
answers
2k
views
How to use proof of lack of knowledge?
This is a purely hypothetical example but is provable ignorance useful in cryptography?
For example, let's say I have a trapdoor collision resistant function. I know the trapdoor and therefore some $...
- 737
11
votes
1
answer
364
views
Why was WEP apparently not reviewed by many cryptographers?
According to this analysis of WEP,
These attacks point to the importance of inviting public review from people with expertise in cryptographic protocol design; had this been done, the problems ...
- 211
10
votes
2
answers
4k
views
RSA-based authentication and key-agreement protocol
An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications.
To that ...
- 141k
9
votes
2
answers
722
views
What current authenticated key exchange standards exist?
If neither of the 'big two' of TLS Handshake and IKE are appropriate in a given situation, what alternative Authenticated Key Exchange (AKE) standards exist and are recommended?
Many protocols have ...
- 1,489
9
votes
1
answer
1k
views
Is there a formal language to define a cryptographic protocol?
I wanted to work on a personal project where I would attempt to identify the flaws in a cryptographic protocol. Now for that to work properly, the program should understand the syntax of protocol ...
- 417
9
votes
1
answer
3k
views
Replay attack prevention in connectionless UDP encrypted communication
What are the options for replay attack prevention when two parties exchange UDP messages. No connection or session is estabilished. Communicating parties have pre shared key that is used for ...
- 193
9
votes
1
answer
418
views
Secure multiparty computation of conjunction
Suppose Alice and Bob each have bits a and b, respectively. How can Alice and Bob compute the function ...
- 189
8
votes
4
answers
410
views
Changing algorithms during encryption
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.
For example,...
- 181
8
votes
2
answers
671
views
Is there a cryptographic solution for this “dating protocol”?
The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following dating protocol (due to Bert den Boer):
Alice and Bob wish to ...
- 558
8
votes
1
answer
589
views
Obfuscating functions that are mostly zero
Let $f_k(x)$ be a boolean function of two arguments with two properties:
The function $f$ can be efficiently computed.
The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
- 36.4k
8
votes
1
answer
2k
views
Secure group chat with large groups
I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group.
Whatsapp also limits group size to ...
- 11.8k
8
votes
1
answer
582
views
What functions allow for practical indistinguishability obfuscation?
Recently, there has been a major theoretical breakthrough in program obfuscation, in the area of indistinguishability obfuscation.
Background: Indistinguishability obfuscation is a form of program ...
- 36.4k
8
votes
3
answers
2k
views
Is it possible to create a "proof-of-upload" system for BitTorrent ratio tracking?
One issue that private BitTorrent trackers that track users' share ratios often run into is how to keep track of people who are screwing with their upload statistics, something known as "stat-hacking"....
- 408
7
votes
1
answer
236
views
How to improve long-term duration of standard checksum for authenticity purposes?
Official CMS's of Government gazettes (in the third world), need to publish the checksum of each article and each cited external documentin (eg. full-text contracts) in a permanent support medium like ...
- 193
7
votes
1
answer
1k
views
Blind signature with openssl
I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
- 71
6
votes
2
answers
320
views
Generating non-repeating N-bit IVs, which are indistinguishable from randomness
I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
- 785
6
votes
4
answers
262
views
Authenticating data generated by a particular build of an open source program
[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.]
My ...
- 181
6
votes
1
answer
619
views
Private set intersection, using a semi-trusted server
Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
- 36.4k
6
votes
1
answer
2k
views
If you had to implement the BGN Cryptosystem, how would you do it?
If you had to implement BGN, how would you do it?
I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
- 81
6
votes
2
answers
2k
views
Tools for modelling and analysis of cryptographic protocols
I am designing some cryptographic protocols and I am new to it.
Are there any well-known tools that can be used to model and design these protocols?
And also verify or analyze their validity?
If not ...
- 6,184
6
votes
2
answers
1k
views
Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
I am trying to find the protocol with the least overhead, which still meets the following requirements:
Server Authentication of server identity to client. The client has an authentic copy of the ...
- 10.4k
6
votes
2
answers
3k
views
How to implement 1-out-of-n OT from 1-out-of-2 OT?
How can I implement a 1-out-of-$n$ oblivious transfer protocol from 1-out-of-2 OT protocol which is resistant against passive corruption? Assume we can access 1-out-of-2 OT $n$ times.
- 63
5
votes
1
answer
331
views
How to compute result in last step of Socialist millionaires problem?
I was trying to understand Socialist millionaires problem and solution in OTR protocol, but I'm stuck at figuring out how and who computes $(Q_{a}Q_b{}^{-1})^{\alpha\beta}$.
If I'm Bob then I received ...
- 249
5
votes
1
answer
182
views
Do low-entropy fingerprints actually make any sense?
I'm thinking of ZRTP and OTR in particular here. From my understanding, after a Diffie-Hellman session is initiated, the shared secret is then hashed into a 4-digit number, which the two parties can ...
- 1,101
5
votes
4
answers
2k
views
Efficient Symmetric Mutual Entity Authentication Protocol
I am looking for an Authentication protocol for access control. Let's say both the client and server would share a symmetric secret (256 bit key) and the client wants to access the server. Access ...
5
votes
1
answer
1k
views
Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle?
I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
- 381
5
votes
3
answers
3k
views
Secret sharing scheme with possibility to change the secret
Here's a scenario I want to handle with a secret sharing scheme:
Alice wants to share the secret $S$ with Bob, Charlie and Dave. Alice generates private shares
based on $S$ for Bob, Charlie and Dave, ...
- 177
5
votes
1
answer
392
views
Implementing CD serial key system
I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
- 163
5
votes
1
answer
208
views
Why is does the protocol of Ding et al. produce biased bits and does it relate to passive security?
I am not understanding the following from "Lattice Cryptography for the Internet" by C. Peikert (pages 9):
We remark that a work of Ding et al. DXL14 proposes a different
reconciliation method ...
- 312
5
votes
0
answers
282
views
What's the difference between game-based and simulation-based security? [duplicate]
What's the difference between game-based and simulation-based security? When we use the simulation-based, how to construct the simulator based on the adversary?
- 353
4
votes
1
answer
448
views
Have I made any glaring mistakes in my use of Yao's garbled circuits?
I would like to use garbled circuits to provide a service that allows people to vote where they do not need to reveal their votes to my server or to anyone else. Let's assume that I have secure ways ...
- 215
4
votes
0
answers
299
views
Obfuscating point-like functions
There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely.
Definition 1. A ...
- 36.4k
4
votes
1
answer
2k
views
Recommended Books for Cryptography : Theory and Implementation [closed]
It is a great idea if experts in Cryptography from mathematicians to security engineers introduce books and textbooks which they think is helpful or instructive for all people interested in the field....
4
votes
1
answer
1k
views
Protocol for Randomized Oblivious Transfer?
If we define Oblivious Transfer as following:
Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about b),...
- 773
4
votes
1
answer
2k
views
SHA-256-based stream cipher
Can anyone comment if the stream cipher described here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced ...
- 273
4
votes
3
answers
286
views
How to thwart a cleartext message's size?
Here is a question I don't find addressed in my cryptography books:
let's say Alice want to send Bob a message of length N.
what is the proper way for Alice to hide N?
I am thinking Alice should do ...
- 385
4
votes
1
answer
272
views
Extending the Socialist millionaire problem to three parties
The usual solution of socialist millionaire problem allows to authenticate whether TWO parties have the same secret information. Are there any natural solution of the same problem for THREE parties?
- 558
3
votes
2
answers
6k
views
AES + CBC encryption for a stream of UDP packets
I am developing an application that is based on UDP, and I need to send a stream of packets. As you can imagine, packets can get lost or corrupted. I need to make sure that the content of those ...
- 1,407
3
votes
1
answer
494
views
Is creating a own protocol safe or should TLS always be used?
The more I start to learn about cryptography the more I hear it is unsafe to 'create' your own cryptographic protocol. With this I mean combining cryptographic primitives like HMAC, AES and RSA
...
- 966
3
votes
3
answers
428
views
What's wrong with this digital signature scheme?
With regards to user authentication...
The server sends Alice a randomly chosen number.
Alice signs the number and sends the signature back to the server.
The server checks the signature using Alice'...
user63149
3
votes
1
answer
722
views
Question of proving the opening of Pedersen Commitment
Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
- 73
3
votes
1
answer
191
views
Deriving user keys from ID
The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database.
But what if I use a keyed hash (like Blake2b) with a server key and then ...
3
votes
1
answer
2k
views
How do TLS 1.1 and 1.2 generate IVs (initialization vectors) for each record?
According to RFC 4346
Explicit IVs
[CBCATT] describes a chosen plaintext attack on TLS that depends on
knowing the IV for a record. Previous versions of TLS [TLS1.0] used
the CBC residue of the ...
- 591
3
votes
1
answer
444
views
Setting protocol parameters to achieve concrete security
Background
One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
- 1,073
3
votes
1
answer
111
views
Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?
Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org)
In particular, I want many Bobs to be able to ...
- 649
3
votes
1
answer
67
views
May I use Random Oracle for Inversed Look-up?
Consider there is a protocol in real world calling a random oracle $\mathcal{H}$ for a priavte input $k$. Then in the ideal world, after the calling of $r \leftarrow \mathcal{H}(k)$ by a honest party, ...
- 629
3
votes
1
answer
196
views
Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem
Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme:
generate random seed z using ...
- 92.6k
2
votes
0
answers
828
views
Elliptic Curve based blind signature implementation [closed]
I want to use Elliptic Curve based blind signature scheme for my research.
There is no proper implementation of ECC-based blind signatures.
Can someone describe to me which things I need to follow ...
- 121
2
votes
1
answer
3k
views
How often do I need to rotate AES 256 keys
I'm trying to design a protocol for a resource constrained environment. The device has to communicate with a server through an insecure node. My plan is to use AES 256 end to end for all ...
- 123
2
votes
2
answers
333
views
Alice's forgetful banking
Alice has a bank account number, but has forgotten which bank it is for. There are 4 banks, run by Bob, Carlos, David, and Eve.
She could find out by going to all of the banks and asking if they have ...
- 364