Questions tagged [protocol-design]
Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).
551
questions
1
vote
2answers
110 views
What conditions does a provable secure cryptosystem satisfy?
A cryptosystem can be entirely dependent on its underlying problem or it can have a reduction to other known problems. Solvability can be affordable if there exists a reduction of the base problem to ...
0
votes
1answer
49 views
Computing/using RSA modulus without knowing its factors
There are some protocols, e.g. this, that require parties to compute/use RSA modulus: $N$ without knowing it's factors or $\phi(N)$.
One way of doing it is to use a trusted party.
Question: Is ...
1
vote
1answer
49 views
Instead of sending a set of random values, send a key for a PRF
Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and ...
0
votes
1answer
42 views
Economically Rational as a security proof
Is it possible to prove the security of a cryptocurrency payment protocol by saying that the actors will seek to maximize their profits. Would I need to set this up as a game and prove it that way or ...
0
votes
1answer
71 views
Time-release Protocol Implementation
“How to Build Time-Lock Encryption” by Jager
“Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan
I looked through the references, googled, searched GitHub ...
1
vote
1answer
55 views
How can process algebra help to design security protocols?
Would you please tell me how process algebra could help me to design security protocols?
More specifically, can I use it for proving the security of protocols?
Is process algebra used for any ...
-1
votes
1answer
51 views
Which of these deductions are true about the simulator and the adversary?
Which of these deductions make sense?
The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
0
votes
1answer
56 views
Is function Deterministic or Probabilistic in the malicious security definition?
As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
1
vote
1answer
64 views
A problem exists with the security proof in the secure AND example in the malicious model [closed]
Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
6
votes
1answer
174 views
Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh
OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS.
The TLS version
The openSSH version (and here)
The openSSH version uses two ...
2
votes
1answer
78 views
How to use Real-Ideal model in a specific scenario (two party with cloud)
I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
0
votes
1answer
49 views
Using the security definition in the malicious model to prove security in the semi honest model
Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm)
Would you ...
1
vote
2answers
110 views
Zero-Knowledge Bingo
Bingo is the game of chance where each player matches the numbers on their card with the numbers that the caller draws at random. When the first player has collected enough called numbers on their ...
2
votes
1answer
291 views
Getting a Keeloq manufacturer key
I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-...
5
votes
1answer
109 views
How do mix networks work with server downtime?
I am looking for an analysis of practical mix networks with server downtime.
For example, if a message is supposed to go from A -> B -> C -> D, what happens if B wants to send the message but C is ...
-2
votes
1answer
28 views
Should I use failed decryptings to handle multiple session keys?
I feel like this question is specific enough to stand on its own. Say I have a set of clients each with a unique ID and already established pair of session keys for each client.
When a client ...
0
votes
1answer
139 views
Basic encrypted custom protocol
I've been suggested to ask here instead of stackoverflow, so here I am.
I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols ...
2
votes
0answers
52 views
Can “X3DH” instead of HMQV be used for OPAQUE?
So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether ...
1
vote
1answer
197 views
Zero-knowledge transfer of value protocol II [closed]
This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
2
votes
0answers
44 views
breaking anonymous key exchange protocol
An anonymous key exchange protocol $P$ is pair of probabilistic machines $(A,B)$ that sends messages to each other and at the end, both $A$ and $B$ will share the same key $k$.
The attacker can see ...
3
votes
3answers
328 views
Zero-knowledge transfer of value protocol inspired by EC El Gamal
This is a follow up on the question I asked here. I designed a scheme that allows the following:
Alice has a value $a$ which she wants to keep secret
Bob has a value $b$ which he wants to keep secret
...
6
votes
1answer
159 views
In coin flipping protocols, why aborting is allowed, and why the non-aborting party flips a coin at the end?
To convey how an adversary can bias the coin, most often a simple commitment-based two party coin-tossing protocol is given, as in [1]:
Alice sends Bob the commitment $c = commit(x)$
Bob sends Alice ...
1
vote
0answers
145 views
Leak information (new setting)
This question is similar to Leak Information?, but with new settings.
Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at ...
4
votes
1answer
124 views
shared symmetric key
Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify ...
0
votes
1answer
41 views
How can I prove I'm the recipient of an encrypted message without revealing my identity and the message?
Alice wants to leave a message for Bob. So she encrypt a signed message with Bob's public key.
Then leaves it at a dead drop service.
Then later Bob arrives and checks the messages and attempts to ...
2
votes
1answer
51 views
Would it be possible to negotiate a key of 128 or 256 bits strength using Merkle puzzles?
One can be fascinated by the simplicity of the schemes created by Ralf Merkle; like the Merkle tree or his key negociation protocol over an insecure channel.
Wikipedia has some material on "Merkle ...
1
vote
1answer
313 views
Storing Salt in Ciphertext?
I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
2
votes
1answer
160 views
Key establishment from secret answer to a question using Socialist Millionaire Protocol
I have read this as telling that two parties sharing a low-entropy secret (such as a secret answer to a question) can use it to establish a high-entropy shared secret key across a classical insecure ...
4
votes
3answers
156 views
How to thwart a cleartext message's size?
Here is a question I don't find addressed in my cryptography books:
let's say Alice want to send Bob a message of length N.
what is the proper way for Alice to hide N?
I am thinking Alice should do ...
2
votes
2answers
385 views
Doing RSA-KEM with RSA-OAEP
I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/...
1
vote
1answer
69 views
Does semi-honest adversary eavesdrop honest parties communication?
Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to ...
0
votes
1answer
66 views
Conditional $k,n$ secret sharing
I would like to know if there is a way to place a condition on $k$-out-of-$n$ secret sharing such that out of $k$ participants who can pool their shares to reconstruct a secret, one of them should ...
-1
votes
1answer
44 views
Does storing plain data length leak essential information about the cryptographic scheme?
Consider the function below:
...
2
votes
1answer
117 views
X.509 strong authentication protocols
Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
3
votes
0answers
100 views
Proof of knowledge of exponentiations
I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of ...
2
votes
1answer
71 views
Robust combiner for preimage resistance
My question is about chaining two hash functions to create a robust combiner
for preimage resistance. @Zooko already gave a detailed answer here:
$$H_{\circ}(x) = H_0(H_1(x))$$
is as strong as ...
4
votes
3answers
185 views
Why won't a BFT protocol using simple signing/voting work?
PBFT and most consensus algorithms are more complicated than a simple voting scheme. By simple voting I mean the following: we require all nodes to sign their local copy of the state and send this ...
2
votes
2answers
117 views
Bellovin ESP Attack on UDP Packets
In Bellovin's ESP Attack,
it is stated that:
If $L_A$, $L_B$ are using UDP, attack is easier:
Wait till session ends
Allocate $L_B$'s UDP port to $X_B$
Replay all packets
So, how ...
6
votes
1answer
744 views
Secure group chat with large groups
I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group.
Whatsapp also limits group size to ...
1
vote
1answer
82 views
Multi User limited Time Encryption of big Datasets
Updated Question: New Thread
Original Question: (Thanks cypherfox for answering that one)
I am in need to store data > 100 TB on a local network share (NAS/SAN) and grant individuals access to the ...
1
vote
1answer
46 views
Algorithm design to verify an assertion on encrypted values
I'm trying to design some kind of protocol but I'm stuck, need some help please..
Given
$ (a,b,c)\in \mathbb{N}^+$ with $ a + b = c $
I need to send an asymmetric encrypted version of a,b and c ...
1
vote
1answer
281 views
mbed tls DTLS v1.2 system with -ECDHE-ECDSA, mutual auth and pre-installed public/private keys, no unnecessary messages or ASN.1/X.509 decoding
I am designing an IoT system based on Silicon Labs EFR32 MCUs with hardware accelerated support for SHA-256, AES-128-CBC and ECC (m255) computation. The system will communicate over a proprietary ...
2
votes
0answers
45 views
Unanimity for three (or more) players
The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following unanimity protocol for three players:
Three players want to ...
4
votes
2answers
219 views
Role of session identifier in Otway-Rees protocol
According to Wikipedia, Otway-Ress protocol is as follow:
The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$...
0
votes
1answer
72 views
Analysing communication complexity of a protocol
My question is more about the practical side of designing crypto. protocols and it is related to complexity. So, if you think it's irrelevant to this forum please kindly let me know and I will remove ...
3
votes
2answers
104 views
Fully homomorphic encryption with polynomials
I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea.
Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
7
votes
2answers
339 views
Is there a cryptographic solution for this “dating protocol”?
The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following dating protocol (due to Bert den Boer):
Alice and Bob wish to ...
2
votes
1answer
90 views
Homomorphic encryption of logical OR/AND
Are there any ways to perform homomorphic encryption of logical OR (or logical AND) without using fully homomorphic encryption?
8
votes
0answers
1k views
Has Telegram security been significantly improved with MTProto 2.0?
Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...
0
votes
2answers
105 views
Decentralised blind leader election
I am looking for a decentralised leader election protocol where each node knows whether or not they were elected leader, but nothing else. In particular, this "blindness" property means a node that ...
