Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
3
votes
2answers
485 views

Doing RSA-KEM with RSA-OAEP

I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/...
1
vote
1answer
90 views

Does semi-honest adversary eavesdrop honest parties communication?

Assume we have a multi-party computation protocol and the protocol definition, where both of them consider a semi-honest adversary, without explicitly assuming the type of channel the parties want to ...
0
votes
1answer
73 views

Conditional $k,n$ secret sharing

I would like to know if there is a way to place a condition on $k$-out-of-$n$ secret sharing such that out of $k$ participants who can pool their shares to reconstruct a secret, one of them should ...
-1
votes
1answer
44 views
2
votes
1answer
136 views

X.509 strong authentication protocols

Is there also a protocol definition in X.509? In "Handbook of Applied Cryptography" by A. Menezes there is a reference to X.509 strong authentication protocol, nevertheless, I could not find the ...
3
votes
0answers
104 views

Proof of knowledge of exponentiations

I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of ...
2
votes
1answer
76 views

Robust combiner for preimage resistance

My question is about chaining two hash functions to create a robust combiner for preimage resistance. @Zooko already gave a detailed answer here: $$H_{\circ}(x) = H_0(H_1(x))$$ is as strong as ...
4
votes
3answers
234 views

Why won't a BFT protocol using simple signing/voting work?

PBFT and most consensus algorithms are more complicated than a simple voting scheme. By simple voting I mean the following: we require all nodes to sign their local copy of the state and send this ...
2
votes
2answers
142 views

Bellovin ESP Attack on UDP Packets

In Bellovin's ESP Attack, it is stated that: If $L_A$, $L_B$ are using UDP, attack is easier: Wait till session ends Allocate $L_B$'s UDP port to $X_B$ Replay all packets So, how ...
6
votes
1answer
907 views

Secure group chat with large groups

I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group. Whatsapp also limits group size to ...
1
vote
1answer
83 views

Multi User limited Time Encryption of big Datasets

Updated Question: New Thread Original Question: (Thanks cypherfox for answering that one) I am in need to store data > 100 TB on a local network share (NAS/SAN) and grant individuals access to the ...
1
vote
1answer
52 views

Algorithm design to verify an assertion on encrypted values

I'm trying to design some kind of protocol but I'm stuck, need some help please.. Given $ (a,b,c)\in \mathbb{N}^+$ with $ a + b = c $ I need to send an asymmetric encrypted version of a,b and c ...
1
vote
1answer
346 views

mbed tls DTLS v1.2 system with -ECDHE-ECDSA, mutual auth and pre-installed public/private keys, no unnecessary messages or ASN.1/X.509 decoding

I am designing an IoT system based on Silicon Labs EFR32 MCUs with hardware accelerated support for SHA-256, AES-128-CBC and ECC (m255) computation. The system will communicate over a proprietary ...
2
votes
0answers
45 views

Unanimity for three (or more) players

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following unanimity protocol for three players: Three players want to ...
4
votes
2answers
329 views

Role of session identifier in Otway-Rees protocol

According to Wikipedia, Otway-Ress protocol is as follow: The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$...
0
votes
1answer
80 views

Analysing communication complexity of a protocol

My question is more about the practical side of designing crypto. protocols and it is related to complexity. So, if you think it's irrelevant to this forum please kindly let me know and I will remove ...
3
votes
2answers
119 views

Fully homomorphic encryption with polynomials

I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea. Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
7
votes
2answers
389 views

Is there a cryptographic solution for this “dating protocol”?

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following dating protocol (due to Bert den Boer): Alice and Bob wish to ...
2
votes
1answer
106 views

Homomorphic encryption of logical OR/AND

Are there any ways to perform homomorphic encryption of logical OR (or logical AND) without using fully homomorphic encryption?
9
votes
0answers
2k views

Has Telegram security been significantly improved with MTProto 2.0?

Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, ...
0
votes
2answers
116 views

Decentralised blind leader election

I am looking for a decentralised leader election protocol where each node knows whether or not they were elected leader, but nothing else. In particular, this "blindness" property means a node that ...
0
votes
1answer
211 views

What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user?

What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user? For example say I have a database table with 50 columns ...
4
votes
1answer
683 views

Challenge / Response to Prevent Replay Attack - Using nonce as challenge

I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other. My plan ...
1
vote
0answers
97 views

Zero Knowledge Proof

In the following protocol $(P,V)$, prover $P$ and verifier $V $have common input $(N,X) \epsilon QR$ while the prover also has private input $x \epsilon SR(N,X)$. Let $SR(N,X) = \{x \epsilon$ $Z_{n}^{*...
1
vote
2answers
222 views

Why is there a counter in CSPRNGs?

This is probably one of those embarrassingly simple questions, but here goes. Consider the following two constructs: CSPRNG made out of a block cipher (AES) with a counter such as CSPRNG made ...
0
votes
1answer
293 views

Is there an application of fully homomorphic encryption scheme such that encryption key and evaluation key are different?

I want know if there is an application of FHE contains three kinds of users such that: $A$ is the data owner and she has the secret key. $B$ only has the permissions to encrypt (just like a general ...
2
votes
1answer
80 views

How do quantum key distribution systems tolerate noise?

It seems to me that any noise in the signal would result in Alice and Bob generating different keys, without a simple way to tell the difference. How do quantum key distribution systems tolerate ...
2
votes
0answers
82 views

Plaintext DH keys in the message header in the Double Ratchet Algorithm

I've been reading details about the Double Ratchet algorithm, and I wanted some clarification regarding the aspect of the DH public keys going out in the plain in the header of every message. Quoting ...
3
votes
1answer
2k views

Equal sign with a “c”

I am not sure whether this is common sense, but I really don't know what this $c$ means in an equivalent sign, from Lindell's How to Simulate It: $$\big\{(S_1(1^n, x, f_1(x,y)), f(x,y))\big\}\...
0
votes
1answer
97 views

RSA Protocol/Generating Primes

So, Alice wants to use the RSA protocol and pays Cindy to generate the two (odd) primes p and w so she can use e=65537 and n=pw as her public key. Alice will then, upon receipt of p and w, privately, ...
0
votes
1answer
61 views

Proving knowledge of a value and computation that uses it

Alice picks random points P and Q in a group where DLP w.r.t. a base point G is hard (I am ...
1
vote
3answers
271 views

Generating OTP using Digital Dead Drop

I've had a thought and I'm wondering if this would be a useful way to devise and distribute a one-time pad. It relies on a digital dead drop and a hash function. The digital dead drop could take a ...
3
votes
3answers
240 views

RSA - What's to stop someone from using the same ciphertext to mimic private key holder?

I've recently looked into fundamentals of RSA and think I understand how it works. However, there's one basic problem I can't seem to figure out. If someone received ciphertext for a given message, ...
2
votes
3answers
647 views

Security concern with TOTP

I am pretty new to cryptography and I have been studying up on TOTP (Time Based OTP) and while I have learnt how the computation works, I'm unable to figure out why using TOTP makes a system more ...
1
vote
1answer
165 views

How to generate two different keys out of a single password?

I'm designing a system in which a password is used both for logging in as well as for encrypting some payload. To encrypt a payload I derive a key from the password. Very straightforward so far. ...
1
vote
1answer
227 views

The parameters included in TLS 1.2 server signature in the ServerKeyExchange

In TLS 1.2, section 7.4.3 in the standard documentation on Server Key Exchange Message, it says that the parameters covered by ...
3
votes
3answers
198 views

Can cryptography help create tamper proof voting systems?

After hearing about what happened with the election in Kenya and the related discussion about a “tamper proof voting system”, I was wondering how the use of cryptography could be used to make a tamper ...
11
votes
1answer
339 views

Why was WEP apparently not reviewed by many cryptographers?

According to this analysis of WEP, These attacks point to the importance of inviting public review from people with expertise in cryptographic protocol design; had this been done, the problems ...
1
vote
1answer
64 views

Is it generally okay to substitute “like for like”?

Is it generally okay to substitute “like for like” in cryptographic protocols? For example, many lattice protocols use SHAKE and SHA3 for various purposes. However, both of those are relatively slow ...
5
votes
1answer
160 views

How to compute result in last step of Socialist millionaires problem?

I was trying to understand Socialist millionaires problem and solution in OTR protocol, but I'm stuck at figuring out how and who computes $(Q_{a}Q_b{}^{-1})^{\alpha\beta}$. If I'm Bob then I ...
2
votes
1answer
165 views

Byzantine agreement implies Broadcast channel [Consesus]

I am not sure if this is the right place to ask but I will give it a try. If not, let me know and I will ask somewhere else :) We discussed the byzantine agreement and broadcast channel in class. We ...
0
votes
2answers
114 views

Signing an exchanged symmetric key that is asymmetrically encrypted

Consider the following implementation: Bob wants to communicate long-term with his team over an unsecured channel. Bob and all members of the team generate individual public/private keypairs (ex. ...
5
votes
1answer
739 views

Security of zero knowledge proof protocols

When designing a protocol based on zero knowledge proofs, be it based on the discrete log problem, or on a Hamiltonian cycle in a graph, or something else, I assume there are security considerations, ...
2
votes
1answer
169 views

Challenge to prove possession of file

Suppose Bob wants to give Alice a large file, in such a way that: Bob cannot keep the file, but is able to use it to precompute anything he needs before he gives it to Alice Bob must be able to ...
7
votes
0answers
145 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
3
votes
0answers
62 views

Draw/Lottery with hidden but provable outcome?

I have a scenario in which one of n participants is to be assigned a positive value and all other participants a negative value. The outcome of the draw is to be known only by the respective ...
2
votes
0answers
56 views

Efficiently formatting data so that each byte is critical

I'm experimenting with implementing a Fair Exchange Protocol that assumes there is a trusted third party to provide a hash-checksum of the two files for each missing byte, (so that the exchange can ...
2
votes
1answer
106 views

Is it possible to prove the time a message was produced?

Say Bob wants to tell Alice a secret message, then they start some message exchanges protocol. At the end, Alice will receive the secret message and can be convinced that the message was not produced ...
1
vote
1answer
186 views

Proving Sigma Protocol on a Schnorr Protocol Variant

Let p, q be chosen as in Schnorr's protocol, and let $g_1, g_2, h$ be elements in $Z^*_P$ of order q. Assume that the prover P gets as input $w_1,w_2$ where $h = (g_1^{w_1}g_2^{w_2}) \mod q$. ...
6
votes
2answers
2k views

DRM simple clone

I have been trying to encrypt media(Video and audio content) from a nodejs server to a client like android or iOS. I heard of DRM but could not get a reliable implementation of DRM. I wanted to make ...

1 2 3 4 5 12