Questions tagged [protocol-design]
Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).
573
questions
1
vote
0answers
49 views
How to create an ultra-secure connection between two clients with xor? [closed]
At work, I was asked to create ultra-secure connection over lan between two computers. It will be some kind of messager. I have a bunch of same random data in them(near 100mb). Also I can start a ...
8
votes
1answer
238 views
Obfuscating functions that are mostly zero
Let $f_k(x)$ be a boolean function of two arguments with two properties:
The function $f$ can be efficiently computed.
The output is always 0 or 1, and for any fixed $k$, if we choose $x$ randomly, $\...
2
votes
1answer
99 views
Secure multi-party random number generation
This question is actually continuation of my previous one.
Secure multi-party computation for digital signature
to implement solution there, I have to generate random data for padding (I will use ...
0
votes
1answer
234 views
Signal protocol: when, and why, is X3DH run again between the same two users?
This question concerns the Signal protocol's X3DH key agreement protocol as documented here.
Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
3
votes
2answers
206 views
How to encrypt numeric data on a ticket
I have a customer with an existing ticketing system that generates tickets for events like theaters, movies, football and so on.
The information in each ticket is encoded in a 16 decimal digit ...
0
votes
1answer
84 views
Dynamic accumulator with only non-membership witness
Goal: Construct a dynamic accumulator which can add elements and provide non-membership witnesses. I wanted to know if my construction is correct.
Consider a group $Z_p$ where $p$ is prime number. ...
1
vote
1answer
84 views
Proof of ignorance to prevent “double-spend”?
Suppose I have some knowledge that I want to transfer securely from Alice's computer to Bob's computer, and prove that future breaches to Alice's computer will not reveal that information to someone ...
1
vote
1answer
52 views
Validating a shared secret between two parties, one bit at a time
What is the following protocol known as?
Is it considered secure? Would it work?
Background
Alice and Bob each have a secret.
They wish to determine if they both know the same secret.
If they do ...
2
votes
1answer
523 views
Zero Knowledge range proof
I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a ...
1
vote
1answer
49 views
Fairness in Multi party computation
Why for achieving the fairness, less than a half of the parties should be corrupted? ($t<m/2$, where $t$ is the number of corrupted parties and $m$ is the total number of the involved parties). How ...
0
votes
0answers
56 views
Simple but secure method to share secret (128 bit AES key) though an untrusted relay
I am creating an end-to-end encrypted group messenger, and am looking for a way for online members of the chat to a arrive at a shared secret that can be used as a cryptographic key. This will ...
2
votes
0answers
64 views
Concept for a RSA “repeater”. Is it sensible?
I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my ...
1
vote
0answers
52 views
Is it necessary to transmit two or three points of an elliptic curve?
Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
0
votes
1answer
83 views
Does Off-The-Record protocol provide future (backward) secrecy?
I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?
3
votes
1answer
144 views
Extending the Socialist millionaire problem to three parties
The usual solution of socialist millionaire problem allows to authenticate whether TWO parties have the same secret information. Are there any natural solution of the same problem for THREE parties?
11
votes
5answers
2k views
How to use proof of lack of knowledge?
This is a purely hypothetical example but is provable ignorance useful in cryptography?
For example, let's say I have a trapdoor collision resistant function. I know the trapdoor and therefore some $...
3
votes
1answer
258 views
In a TLS 1.3 connection, how do the client and server choose a mutual cipher suite?
According to KeyCDN, TLSv1.3 connections are established in a single round trip:
While TLS 1.2 requires two round-trips to complete the TLS handshake, 1.3 gets the job done in just one trip
If ...
1
vote
1answer
69 views
rolling key with two keyfobs
Hy i just saw this Question: How does a rolling code work?
And I just wondered how it is possible that my Vehicle (A 2013 Mazda 6) has two key fobs? As i understand this shuld not be possible. ...
2
votes
1answer
163 views
Detect MITM with hashed session-key — Is my protocol secure?
I have the following setup:
An app ("client") wants to communicate securely with a device I created ("server").
The client has the public key of the server (and a hashed password) preinstalled.
I use ...
1
vote
1answer
132 views
Authentication protocol for communication with Arduino Uno
I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
2
votes
3answers
277 views
What's wrong with this digital signature scheme?
With regards to user authentication...
The server sends Alice a randomly chosen number.
Alice signs the number and sends the signature back to the server.
The server checks the signature using Alice'...
2
votes
2answers
144 views
What conditions does a provable secure cryptosystem satisfy?
A cryptosystem can be entirely dependent on its underlying problem or it can have a reduction to other known problems. Solvability can be affordable if there exists a reduction of the base problem to ...
0
votes
1answer
53 views
Computing/using RSA modulus without knowing its factors
There are some protocols, e.g. this, that require parties to compute/use RSA modulus: $N$ without knowing it's factors or $\phi(N)$.
One way of doing it is to use a trusted party.
Question: Is ...
1
vote
1answer
53 views
Instead of sending a set of random values, send a key for a PRF
Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and ...
0
votes
1answer
42 views
Economically Rational as a security proof
Is it possible to prove the security of a cryptocurrency payment protocol by saying that the actors will seek to maximize their profits. Would I need to set this up as a game and prove it that way or ...
0
votes
1answer
75 views
Time-release Protocol Implementation
“How to Build Time-Lock Encryption” by Jager
“Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan
I looked through the references, googled, searched GitHub ...
1
vote
1answer
61 views
How can process algebra help to design security protocols?
Would you please tell me how process algebra could help me to design security protocols?
More specifically, can I use it for proving the security of protocols?
Is process algebra used for any ...
-1
votes
1answer
54 views
Which of these deductions are true about the simulator and the adversary?
Which of these deductions make sense?
The simulator is actually being run by the adversary. It makes sense that the adversary initializes the simulator (which is just a program) with the input that ...
0
votes
1answer
70 views
Is function Deterministic or Probabilistic in the malicious security definition?
As you see, according to the attached definitions from "Efficient Secure Two-Party Protocols", the definition of the security in the semi-honest world has two cases for $f=(f_1,f_2)$.(deterministic ...
1
vote
1answer
73 views
A problem exists with the security proof in the secure AND example in the malicious model [closed]
Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world ...
6
votes
1answer
201 views
Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh
OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS.
The TLS version
The openSSH version (and here)
The openSSH version uses two ...
2
votes
1answer
104 views
How to use Real-Ideal model in a specific scenario (two party with cloud)
I have designed a two-party protocol where two parties outsource their input to the cloud. For example, Alice and Bob have inputs $X$ and $Y$, respectively, after which Alice and Bob encrypt their ...
0
votes
1answer
62 views
Using the security definition in the malicious model to prove security in the semi honest model
Can I use the security definition in the malicious model in order to prove the security of a two-party protocol which is in the semi-honest model? (I am using IDEAL/REAL Model paradigm)
Would you ...
1
vote
2answers
125 views
Zero-Knowledge Bingo
Bingo is the game of chance where each player matches the numbers on their card with the numbers that the caller draws at random. When the first player has collected enough called numbers on their ...
2
votes
1answer
399 views
Getting a Keeloq manufacturer key
I have seen a lot of articles and research papers about breaking the Keeloq algorithm. My understanding is that the hardest part is getting the 64 bit manufacturer key. Some methods use crypto-...
5
votes
1answer
115 views
How do mix networks work with server downtime?
I am looking for an analysis of practical mix networks with server downtime.
For example, if a message is supposed to go from A -> B -> C -> D, what happens if B wants to send the message but C is ...
-2
votes
1answer
29 views
Should I use failed decryptings to handle multiple session keys?
I feel like this question is specific enough to stand on its own. Say I have a set of clients each with a unique ID and already established pair of session keys for each client.
When a client ...
0
votes
1answer
173 views
Basic encrypted custom protocol
I've been suggested to ask here instead of stackoverflow, so here I am.
I'd like to encrypt the data of my application that uses a custom protocol I've created. I know about TLS and other protocols ...
2
votes
0answers
58 views
Can “X3DH” instead of HMQV be used for OPAQUE?
So I recently re-read the OPAQUE paper and while reading it I found HMQV to be a bit "unnatural" / "unintuitive", which may just be because I didn't (yet) read the HMQV paper, so I wondered whether ...
1
vote
1answer
199 views
Zero-knowledge transfer of value protocol II [closed]
This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
2
votes
0answers
51 views
breaking anonymous key exchange protocol
An anonymous key exchange protocol $P$ is pair of probabilistic machines $(A,B)$ that sends messages to each other and at the end, both $A$ and $B$ will share the same key $k$.
The attacker can see ...
3
votes
3answers
341 views
Zero-knowledge transfer of value protocol inspired by EC El Gamal
This is a follow up on the question I asked here. I designed a scheme that allows the following:
Alice has a value $a$ which she wants to keep secret
Bob has a value $b$ which he wants to keep secret
...
6
votes
1answer
177 views
In coin flipping protocols, why aborting is allowed, and why the non-aborting party flips a coin at the end?
To convey how an adversary can bias the coin, most often a simple commitment-based two party coin-tossing protocol is given, as in [1]:
Alice sends Bob the commitment $c = commit(x)$
Bob sends Alice ...
1
vote
0answers
145 views
Leak information (new setting)
This question is similar to Leak Information?, but with new settings.
Let $a,b,c,d,e,f$ be selected at random from $\mathbb Z^*_q$. Also, let $r_1,r_2,r_3,z_1,z_2,z_3,p_1,p_2,p_3$ be selected at ...
4
votes
1answer
139 views
shared symmetric key
Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify ...
0
votes
1answer
43 views
How can I prove I'm the recipient of an encrypted message without revealing my identity and the message?
Alice wants to leave a message for Bob. So she encrypt a signed message with Bob's public key.
Then leaves it at a dead drop service.
Then later Bob arrives and checks the messages and attempts to ...
2
votes
1answer
51 views
Would it be possible to negotiate a key of 128 or 256 bits strength using Merkle puzzles?
One can be fascinated by the simplicity of the schemes created by Ralf Merkle; like the Merkle tree or his key negociation protocol over an insecure channel.
Wikipedia has some material on "Merkle ...
1
vote
1answer
426 views
Storing Salt in Ciphertext?
I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
2
votes
1answer
179 views
Key establishment from secret answer to a question using Socialist Millionaire Protocol
I have read this as telling that two parties sharing a low-entropy secret (such as a secret answer to a question) can use it to establish a high-entropy shared secret key across a classical insecure ...
4
votes
3answers
184 views
How to thwart a cleartext message's size?
Here is a question I don't find addressed in my cryptography books:
let's say Alice want to send Bob a message of length N.
what is the proper way for Alice to hide N?
I am thinking Alice should do ...
