Questions tagged [protocol-design]
Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).
585
questions
2
votes
1answer
160 views
Could time lock encryption be implemented through indistinguishable obfuscation?
In the paper "How to build time-lock encryption", the authors give a theoretical solution to build time-lock encryption using multi-linear based witness encryption and blockchain. However, an ...
1
vote
1answer
110 views
Does such a cryptographic protocol exist?
Persons A, B and C put x€, y€ and z€ in a pot, respectively. Suppose that anyone can make a withdrawal from the pot as long as they prove they have such a right and that the y€ that B deposited is ...
2
votes
2answers
175 views
Choice between appending or prepending nonces to ciphertexts
I understand that when using CTR mode it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant.
However, ...
1
vote
1answer
78 views
Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tags（non-deterministic）？
If we use non-deterministic MACs in encrypt-and-authenticate approach， is it secure？
0
votes
0answers
87 views
Digital Signature Password verification
I currently have this TOFU protocol:
First connection:
Client generates salt and inputs a password
Client saves salt
Client hashes password with argon2 and salt
Client generates Ed25519 keys
Client ...
1
vote
0answers
68 views
Acceptable points of failure when applying encryption in an application [closed]
I am working an a Windows application that will encrypt and decrypt files using AES Encryption. The 32 byte key which is diversified and derived using a ATSHA204 unique serial number and some addition ...
5
votes
2answers
185 views
MPC protocols for high school kids
I was explaining MPC to a high school student. He was excited and asked me for some examples. The only ones that I could think of are by using garbled circuits. Are there some simple MPC protocols for ...
1
vote
1answer
95 views
Protocol Design for IoT devices having PSK using AES-GCM
Handshake:
1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv"
2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag
...
0
votes
2answers
99 views
cryptographically signed streaming data
On a high level the question is: how does one cryptographically sign streaming data?
Here is the context:
a number of people are continuously streaming data to me
the data is public and does not ...
1
vote
1answer
58 views
Facebook app-scoped identifiers and similar - implementing stateless ID obfuscation
After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is ...
1
vote
0answers
128 views
How to prevent reflection attack in Needham-Schroeder in ECB mode?
We know that Needham-Schroeder is vulnerable to a reflection attack as shown here.
How can I make it secure using ECB and without using timestamps? I need to modify the protocol. Otwan-Rees is a ...
0
votes
1answer
80 views
Needham–Schroeder fix by adding opponent's identity to the first message
Recap: Needham–Schroeder is as follows:
$A \rightarrow B : \{A, N_a\}_{pk_B}$
$B \rightarrow A : \{N_a, N_b\}_{pk_A}$
$A \rightarrow B : \{N_b\}_{pk_B}$
Then, there is a MITM attack by Lowe ...
1
vote
0answers
50 views
How to create an ultra-secure connection between two clients with xor? [closed]
At work, I was asked to create ultra-secure connection over lan between two computers. It will be some kind of messager. I have a bunch of same random data in them(near 100mb). Also I can start a ...
8
votes
1answer
275 views
Obfuscating functions that are mostly zero
Let $f_k(x)$ be a boolean function of two arguments with two properties:
The function $f$ can be efficiently computed.
The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
2
votes
1answer
126 views
Secure multi-party random number generation
This question is actually continuation of my previous one.
Secure multi-party computation for digital signature
to implement solution there, I have to generate random data for padding (I will use ...
0
votes
1answer
354 views
Signal protocol: when, and why, is X3DH run again between the same two users?
This question concerns the Signal protocol's X3DH key agreement protocol as documented here.
Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
3
votes
2answers
266 views
How to encrypt numeric data on a ticket
I have a customer with an existing ticketing system that generates tickets for events like theaters, movies, football and so on.
The information in each ticket is encoded in a 16 decimal digit ...
0
votes
1answer
106 views
Dynamic accumulator with only non-membership witness
Goal: Construct a dynamic accumulator which can add elements and provide non-membership witnesses. I wanted to know if my construction is correct.
Consider a group $Z_p$ where $p$ is prime number. ...
1
vote
1answer
89 views
Proof of ignorance to prevent “double-spend”?
Suppose I have some knowledge that I want to transfer securely from Alice's computer to Bob's computer, and prove that future breaches to Alice's computer will not reveal that information to someone ...
1
vote
1answer
52 views
Validating a shared secret between two parties, one bit at a time
What is the following protocol known as?
Is it considered secure? Would it work?
Background
Alice and Bob each have a secret.
They wish to determine if they both know the same secret.
If they do ...
2
votes
1answer
620 views
Zero Knowledge range proof
I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
1
vote
1answer
51 views
Fairness in Multi party computation
Why for achieving the fairness, less than a half of the parties should be corrupted? ($t<m/2$, where $t$ is the number of corrupted parties and $m$ is the total number of the involved parties). How ...
0
votes
0answers
57 views
Simple but secure method to share secret (128 bit AES key) though an untrusted relay
I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
2
votes
0answers
65 views
Concept for a RSA “repeater”. Is it sensible?
I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my ...
1
vote
0answers
52 views
Is it necessary to transmit two or three points of an elliptic curve?
Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
0
votes
1answer
102 views
Does Off-The-Record protocol provide future (backward) secrecy?
I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?
3
votes
1answer
148 views
Extending the Socialist millionaire problem to three parties
The usual solution of socialist millionaire problem allows to authenticate whether TWO parties have the same secret information. Are there any natural solution of the same problem for THREE parties?
11
votes
5answers
2k views
How to use proof of lack of knowledge?
This is a purely hypothetical example but is provable ignorance useful in cryptography?
For example, let's say I have a trapdoor collision resistant function. I know the trapdoor and therefore some $...
3
votes
1answer
301 views
In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?
According to KeyCDN, TLSv1.3 connections are established in a single round trip:
While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip
If ...
1
vote
1answer
89 views
rolling key with two keyfobs
Hy i just saw this Question: How does a rolling code work?
And I just wondered how it is possible that my Vehicle (A 2013 Mazda 6) has two key fobs? As i understand this shuld not be possible. ...
2
votes
1answer
187 views
Detect MITM with hashed session-key — Is my protocol secure?
I have the following setup:
An app ("client") wants to communicate securely with a device I created ("server").
The client has the public key of the server (and a hashed password) preinstalled.
I use ...
1
vote
1answer
169 views
Authentication protocol for communication with Arduino Uno
I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
2
votes
3answers
290 views
What's wrong with this digital signature scheme?
With regards to user authentication...
The server sends Alice a randomly chosen number.
Alice signs the number and sends the signature back to the server.
The server checks the signature using Alice'...
2
votes
2answers
215 views
What conditions does a provable secure cryptosystem satisfy?
A cryptosystem can be entirely dependent on its underlying problem or it can have a reduction to other known problems. Solvability can be affordable if there exists a reduction of the base problem to ...
0
votes
1answer
58 views
Computing/using RSA modulus without knowing its factors
There are some protocols, e.g. this, that require parties to compute/use RSA modulus: $N$ without knowing it's factors or $\phi(N)$.
One way of doing it is to use a trusted party.
Question: Is ...
1
vote
1answer
58 views
Instead of sending a set of random values, send a key for a PRF
Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and ...
0
votes
1answer
45 views
Economically Rational as a security proof
Is it possible to prove the security of a cryptocurrency payment protocol by saying that the actors will seek to maximize their profits. Would I need to set this up as a game and prove it that way or ...
0
votes
1answer
78 views
Time-release Protocol Implementation
“How to Build Time-Lock Encryption” by Jager
“Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan
I looked through the references, googled, searched GitHub ...
1
vote
1answer
61 views
How can process algebra help to design security protocols?
Would you please tell me how process algebra could help me to design security protocols?
More specifically, can I use it for proving the security of protocols?
Is process algebra used for any ...
-1
votes
1answer
55 views
Which of these deductions are true about the simulator and the adversary?
Which of these deductions make sense?
The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
0
votes
1answer
73 views
Is function Deterministic or Probabilistic in the malicious security definition?
As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
1
vote
1answer
75 views
A problem exists with the security proof in the secure AND example in the malicious model [closed]
Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
6
votes
1answer
216 views
Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh
OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS.
The TLS version
The openSSH version (and here)
The openSSH version uses two ...
2
votes
1answer
111 views
How to use Real-Ideal model in a specific scenario (two party with cloud)
I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
0
votes
1answer
68 views
Using the security definition in the malicious model to prove security in the semi honest model
Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm)
Would you ...
1
vote
2answers
128 views
Zero-Knowledge Bingo
Bingo is the game of chance where each player matches the numbers on their card with the numbers that the caller draws at random. When the first player has collected enough called numbers on their ...
2
votes
1answer
488 views
Getting a Keeloq manufacturer key
I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-...
5
votes
1answer
127 views
How do mix networks work with server downtime?
I am looking for an analysis of practical mix networks with server downtime.
For example, if a message is supposed to go from A -> B -> C -> D, what happens if B wants to send the message but C is ...
-2
votes
1answer
30 views
Should I use failed decryptings to handle multiple session keys?
I feel like this question is specific enough to stand on its own. Say I have a set of clients each with a unique ID and already established pair of session keys for each client.
When a client ...
0
votes
1answer
200 views
Basic encrypted custom protocol
I've been suggested to ask here instead of stackoverflow, so here I am.
I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols ...
