Questions tagged [protocol-design]
Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).
604
questions
1
vote
0answers
44 views
Did key-wrap modes see actual use?
Is there an IETF standard-track protocol have IANA-registered IDs for deterministic authenticated encryption yet? If not, what's preventing their adoption? What changes to protocols will DAEs likely ...
1
vote
1answer
190 views
Getting unlimited amount of signatures - Risk?
Lets suppose we have a communication protocol given where messages $(1)$ and $(2)$ are send over an unsecure network.
There are some prerequisites like distributed certificates etc., but they should ...
2
votes
0answers
49 views
No freshness protection for single messages, but for the overall protocol
I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for ...
0
votes
1answer
37 views
Can I Implement a Well-Trusted Protocol with Well-Trusted Libraries in JavaScript securely?
Just for anyone reading this: DO NOT ROLL YOUR OWN ALGORITHM.
Besides that, is implementing a well-trusted protocol with well-trusted algorithms and libraries a good idea? Is this likely to ...
0
votes
1answer
68 views
Byzantine Agreement: Why does OM need f+1 rounds in a synchronous setting?
To get Byzantine Fault Tolerance in a synchronous model you can use an Oral Message Algorithm. For n > 3f+1 it gets an Byzantine agreement in ...
0
votes
1answer
54 views
Reference books in security and privacy preservation [closed]
I am looking for books or reference guides to learn and teach "cryptography, security and privacy preservation techniques"? I need some advice to good resources that I can use.
1
vote
1answer
51 views
Is there an algorithm that allows to distribute elements securely between parties?
Let's say we have a set of numbers $n = \{ 1, 2, 3, 4, 5, \ldots \}$ and $m$ players ($m < \operatorname{sizeof}(n)$, of course).
I want to know if there's a way for all $m$'s to pick different ...
1
vote
1answer
473 views
Station-to-Station protocol questions
Basic Station-to-Station protocol which authenticates Bob and Alice if they safely shared their long-term asymmetric public keys.
Alice sends Bob her public key $A_K$
Bob receives $A_K$ and computes ...
2
votes
1answer
271 views
Key derivation for AES-GCM using HKDF?
I have a system comprising N >1000 nodes. At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random ...
3
votes
1answer
376 views
Commitment to a polynomial
$A(x) \bmod B(x) = C(x)$ and $A(x) \bmod D(x) = E(x)$:
A dealer knows $A(x)$ polynomial, which is a secret. He distributes $C(x)$ and $E(x)$ privately to $X$ and $Y$, respectively. $B(x)$ and $D(x)$ ...
2
votes
0answers
101 views
Security of MAC-Then-Encrypt without MAC key authentication
We have the following settings in our system: TLS 1.2 using legacy cipher suite - OFB mode (using 64 bit block cipher) and trunkated CBC-MAC (32 bit). The goal is to achieve authenticated encryption ...
0
votes
1answer
45 views
specific scenario question relating to using NACL crypto_box in a protocol
Scenario 1: SenderA sends message1 to ReceiverB
message1 is encrypted using NACL crypto_box using SenderA secret key and ReceiverB public key.
we understand that the NACL crypto_box authenticator ...
2
votes
1answer
176 views
What time is used in a TOTP counter?
I am currently working on a desktop TOTP client.
From the TOTP spec at https://tools.ietf.org/html/rfc6238#section-4.1, the 6 digit OTP is generated from counter (in this case time).
But what is "...
2
votes
1answer
134 views
Are two keys derived from the same password vulnerable to a related key attack?
Background
I am currently writing a password manager application. As usual, the passwords are put in a file encrypted using a user-entered password. I'm using the NaCl library but actually it's not ...
-1
votes
2answers
106 views
How to sell a piece of data through blockchain?
User A attempts to sell a piece of data D (byte level) to user B at price C through the blockchain. A and B do not trust each other. A worry: After the data D is delivered, B does not complete the ...
2
votes
0answers
27 views
Is there a scheme to force a party to generate a fresh key?
Is there a way to force one party to generate a fresh key, such that another party can be convinced that the key was freshly generated, without that party also knowing the key?
I'm motivated by a ...
8
votes
3answers
200 views
Is there any protocol for proving that a message was written at a certain time?
Does there exist a way to cryptographically prove that a message was written at a certain time? I know that one can write messages in bitcoin transactions to that the message is preserved in the ...
1
vote
1answer
64 views
Privacy and warrants to obtain information
How could a site issue a `warrant'*, a document which:
1) Others can verify was issued from that site
2) Contains a date stamp, a named site and instructions which can be presented to a third site by ...
9
votes
3answers
2k views
Examples of protocols that are insecure when run concurrently
I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
0
votes
1answer
107 views
Is the following non-interactive zero-knowledge set membership protocol provable secure?
Given the following Zero-knowledge set-membership protocol https://infoscience.epfl.ch/record/128718/files/CCS08.pdf]. That is given in the following steps (Please refer to page 9).
The Verifier
-...
2
votes
1answer
204 views
Could time lock encryption be implemented through indistinguishable obfuscation?
In the paper "How to build time-lock encryption", the authors give a theoretical solution to build time-lock encryption using multi-linear based witness encryption and blockchain. However, an ...
1
vote
1answer
113 views
Does such a cryptographic protocol exist?
Persons A, B and C put xā¬, yā¬ and zā¬ in a pot, respectively. Suppose that anyone can make a withdrawal from the pot as long as they prove they have such a right and that the yā¬ that B deposited is ...
2
votes
2answers
269 views
Choice between appending or prepending nonces to ciphertexts
I understand that when using CTR mode it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant.
However, ...
2
votes
1answer
102 views
Can the encrypt-and-authenticate method result in secure authenticated encryption if the MAC scheme has unique tagsļ¼non-deterministicļ¼ļ¼
If we use non-deterministic MACs in encrypt-and-authenticate approachļ¼ is it secureļ¼
0
votes
0answers
96 views
Digital Signature Password verification
I currently have this TOFU protocol:
First connection:
Client generates salt and inputs a password
Client saves salt
Client hashes password with argon2 and salt
Client generates Ed25519 keys
Client ...
1
vote
0answers
72 views
Acceptable points of failure when applying encryption in an application [closed]
I am working an a Windows application that will encrypt and decrypt files using AES Encryption. The 32 byte key which is diversified and derived using a ATSHA204 unique serial number and some addition ...
5
votes
2answers
207 views
MPC protocols for high school kids
I was explaining MPC to a high school student. He was excited and asked me for some examples. The only ones that I could think of are by using garbled circuits. Are there some simple MPC protocols for ...
1
vote
1answer
102 views
Protocol Design for IoT devices having PSK using AES-GCM
Handshake:
1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv"
2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag
...
0
votes
2answers
136 views
cryptographically signed streaming data
On a high level the question is: how does one cryptographically sign streaming data?
Here is the context:
a number of people are continuously streaming data to me
the data is public and does not ...
1
vote
1answer
68 views
Facebook app-scoped identifiers and similar - implementing stateless ID obfuscation
After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is ...
1
vote
0answers
139 views
How to prevent reflection attack in Needham-Schroeder in ECB mode?
We know that Needham-Schroeder is vulnerable to a reflection attack as shown here.
How can I make it secure using ECB and without using timestamps? I need to modify the protocol. Otwan-Rees is a ...
0
votes
1answer
156 views
NeedhamāSchroeder fix by adding opponent's identity to the first message
Recap: NeedhamāSchroeder is as follows:
$A \rightarrow B : \{A, N_a\}_{pk_B}$
$B \rightarrow A : \{N_a, N_b\}_{pk_A}$
$A \rightarrow B : \{N_b\}_{pk_B}$
Then, there is a MITM attack by Lowe ...
1
vote
0answers
50 views
How to create an ultra-secure connection between two clients with xor? [closed]
At work, I was asked to create ultra-secure connection over lan between two computers. It will be some kind of messager. I have a bunch of same random data in them(near 100mb). Also I can start a ...
8
votes
1answer
327 views
Obfuscating functions that are mostly zero
Let $f_k(x)$ be a boolean function of two arguments with two properties:
The function $f$ can be efficiently computed.
The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
2
votes
1answer
160 views
Secure multi-party random number generation
This question is actually continuation of my previous one.
Secure multi-party computation for digital signature
to implement solution there, I have to generate random data for padding (I will use ...
0
votes
1answer
632 views
Signal protocol: when, and why, is X3DH run again between the same two users?
This question concerns the Signal protocol's X3DH key agreement protocol as documented here.
Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
3
votes
2answers
404 views
How to encrypt numeric data on a ticket
I have a customer with an existing ticketing system that generates tickets for events like theaters, movies, football and so on.
The information in each ticket is encoded in a 16 decimal digit ...
0
votes
1answer
134 views
Dynamic accumulator with only non-membership witness
Goal: Construct a dynamic accumulator which can add elements and provide non-membership witnesses. I wanted to know if my construction is correct.
Consider a group $Z_p$ where $p$ is prime number. ...
2
votes
1answer
106 views
Proof of ignorance to prevent “double-spend”?
Suppose I have some knowledge that I want to transfer securely from Alice's computer to Bob's computer, and prove that future breaches to Alice's computer will not reveal that information to someone ...
1
vote
1answer
53 views
Validating a shared secret between two parties, one bit at a time
What is the following protocol known as?
Is it considered secure? Would it work?
Background
Alice and Bob each have a secret.
They wish to determine if they both know the same secret.
If they do ...
2
votes
1answer
748 views
Zero Knowledge range proof
I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
1
vote
1answer
55 views
Fairness in Multi party computation
Why for achieving the fairness, less than a half of the parties should be corrupted? ($t<m/2$, where $t$ is the number of corrupted parties and $m$ is the total number of the involved parties). How ...
0
votes
0answers
60 views
Simple but secure method to share secret (128 bit AES key) though an untrusted relay
I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
2
votes
0answers
68 views
Concept for a RSA “repeater”. Is it sensible?
I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my ...
1
vote
0answers
56 views
Is it necessary to transmit two or three points of an elliptic curve?
Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
0
votes
1answer
124 views
Does Off-The-Record protocol provide future (backward) secrecy?
I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?
3
votes
1answer
157 views
Extending the Socialist millionaire problem to three parties
The usual solution of socialist millionaire problem allows to authenticate whether TWO parties have the same secret information. Are there any natural solution of the same problem for THREE parties?
11
votes
5answers
2k views
How to use proof of lack of knowledge?
This is a purely hypothetical example but is provable ignorance useful in cryptography?
For example, let's say I have a trapdoor collision resistant function. I know the trapdoor and therefore some $...
3
votes
1answer
360 views
In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?
According to KeyCDN, TLSv1.3 connections are established in a single round trip:
While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip
If ...
1
vote
1answer
165 views
rolling key with two keyfobs
Hy i just saw this Question: How does a rolling code work?
And I just wondered how it is possible that my Vehicle (A 2013 Mazda 6) has two key fobs? As i understand this shuld not be possible. ...
