Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
0
votes
1answer
205 views

What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user?

What cryptographic protocol or algorithm I can use to encrypt/decrypt a subset of columns of a database table for each user? For example say I have a database table with 50 columns ...
4
votes
1answer
569 views

Challenge / Response to Prevent Replay Attack - Using nonce as challenge

I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other. My plan ...
1
vote
0answers
96 views

Zero Knowledge Proof

In the following protocol $(P,V)$, prover $P$ and verifier $V $have common input $(N,X) \epsilon QR$ while the prover also has private input $x \epsilon SR(N,X)$. Let $SR(N,X) = \{x \epsilon$ $Z_{n}^{*...
1
vote
2answers
199 views

Why is there a counter in CSPRNGs?

This is probably one of those embarrassingly simple questions, but here goes. Consider the following two constructs: CSPRNG made out of a block cipher (AES) with a counter such as CSPRNG made ...
0
votes
1answer
271 views

Is there an application of fully homomorphic encryption scheme such that encryption key and evaluation key are different?

I want know if there is an application of FHE contains three kinds of users such that: $A$ is the data owner and she has the secret key. $B$ only has the permissions to encrypt (just like a general ...
2
votes
1answer
78 views

How do quantum key distribution systems tolerate noise?

It seems to me that any noise in the signal would result in Alice and Bob generating different keys, without a simple way to tell the difference. How do quantum key distribution systems tolerate ...
2
votes
0answers
75 views

Plaintext DH keys in the message header in the Double Ratchet Algorithm

I've been reading details about the Double Ratchet algorithm, and I wanted some clarification regarding the aspect of the DH public keys going out in the plain in the header of every message. Quoting ...
3
votes
1answer
2k views

Equal sign with a “c”

I am not sure whether this is common sense, but I really don't know what this $c$ means in an equivalent sign, from Lindell's How to Simulate It: $$\big\{(S_1(1^n, x, f_1(x,y)), f(x,y))\big\}\...
0
votes
1answer
93 views

RSA Protocol/Generating Primes

So, Alice wants to use the RSA protocol and pays Cindy to generate the two (odd) primes p and w so she can use e=65537 and n=pw as her public key. Alice will then, upon receipt of p and w, privately, ...
0
votes
1answer
57 views

Proving knowledge of a value and computation that uses it

Alice picks random points P and Q in a group where DLP w.r.t. a base point G is hard (I am ...
1
vote
3answers
242 views

Generating OTP using Digital Dead Drop

I've had a thought and I'm wondering if this would be a useful way to devise and distribute a one-time pad. It relies on a digital dead drop and a hash function. The digital dead drop could take a ...
3
votes
3answers
216 views

RSA - What's to stop someone from using the same ciphertext to mimic private key holder?

I've recently looked into fundamentals of RSA and think I understand how it works. However, there's one basic problem I can't seem to figure out. If someone received ciphertext for a given message, ...
2
votes
3answers
529 views

Security concern with TOTP

I am pretty new to cryptography and I have been studying up on TOTP (Time Based OTP) and while I have learnt how the computation works, I'm unable to figure out why using TOTP makes a system more ...
1
vote
1answer
140 views

How to generate two different keys out of a single password?

I'm designing a system in which a password is used both for logging in as well as for encrypting some payload. To encrypt a payload I derive a key from the password. Very straightforward so far. ...
1
vote
1answer
198 views

The parameters included in TLS 1.2 server signature in the ServerKeyExchange

In TLS 1.2, section 7.4.3 in the standard documentation on Server Key Exchange Message, it says that the parameters covered by ...
3
votes
3answers
193 views

Can cryptography help create tamper proof voting systems?

After hearing about what happened with the election in Kenya and the related discussion about a “tamper proof voting system”, I was wondering how the use of cryptography could be used to make a tamper ...
11
votes
1answer
334 views

Why was WEP apparently not reviewed by many cryptographers?

According to this analysis of WEP, These attacks point to the importance of inviting public review from people with expertise in cryptographic protocol design; had this been done, the problems ...
2
votes
1answer
63 views

Is it generally okay to substitute “like for like”?

Is it generally okay to substitute “like for like” in cryptographic protocols? For example, many lattice protocols use SHAKE and SHA3 for various purposes. However, both of those are relatively slow ...
5
votes
1answer
148 views

How to compute result in last step of Socialist millionaires problem?

I was trying to understand Socialist millionaires problem and solution in OTR protocol, but I'm stuck at figuring out how and who computes $(Q_{a}Q_b{}^{-1})^{\alpha\beta}$. If I'm Bob then I ...
2
votes
1answer
133 views

Byzantine agreement implies Broadcast channel [Consesus]

I am not sure if this is the right place to ask but I will give it a try. If not, let me know and I will ask somewhere else :) We discussed the byzantine agreement and broadcast channel in class. We ...
0
votes
2answers
103 views

Signing an exchanged symmetric key that is asymmetrically encrypted

Consider the following implementation: Bob wants to communicate long-term with his team over an unsecured channel. Bob and all members of the team generate individual public/private keypairs (ex. ...
5
votes
1answer
664 views

Security of zero knowledge proof protocols

When designing a protocol based on zero knowledge proofs, be it based on the discrete log problem, or on a Hamiltonian cycle in a graph, or something else, I assume there are security considerations, ...
2
votes
1answer
166 views

Challenge to prove possession of file

Suppose Bob wants to give Alice a large file, in such a way that: Bob cannot keep the file, but is able to use it to precompute anything he needs before he gives it to Alice Bob must be able to ...
7
votes
0answers
139 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
3
votes
0answers
61 views

Draw/Lottery with hidden but provable outcome?

I have a scenario in which one of n participants is to be assigned a positive value and all other participants a negative value. The outcome of the draw is to be known only by the respective ...
2
votes
0answers
56 views

Efficiently formatting data so that each byte is critical

I'm experimenting with implementing a Fair Exchange Protocol that assumes there is a trusted third party to provide a hash-checksum of the two files for each missing byte, (so that the exchange can ...
2
votes
1answer
104 views

Is it possible to prove the time a message was produced?

Say Bob wants to tell Alice a secret message, then they start some message exchanges protocol. At the end, Alice will receive the secret message and can be convinced that the message was not produced ...
1
vote
1answer
168 views

Proving Sigma Protocol on a Schnorr Protocol Variant

Let p, q be chosen as in Schnorr's protocol, and let $g_1, g_2, h$ be elements in $Z^*_P$ of order q. Assume that the prover P gets as input $w_1,w_2$ where $h = (g_1^{w_1}g_2^{w_2}) \mod q$. ...
6
votes
2answers
2k views

DRM simple clone

I have been trying to encrypt media(Video and audio content) from a nodejs server to a client like android or iOS. I heard of DRM but could not get a reliable implementation of DRM. I wanted to make ...
1
vote
0answers
202 views

Design a simplified version of the protocol for secure addition

To learn secure multiparty communication, I want to design a simplified protocol for secure addition, where instead of receiving two (random) numbers in $Z_p$, a player only receives a single (random) ...
-5
votes
1answer
94 views

Is a symmetric cryptographic code secure if only the sender and recipient know the method used to encrypt? [closed]

I recently designed an encoding method that I'm fairly sure is unique. Is it universally secure, provided that anyone intercepting the message doesn't know anything about how it was encrypted? Could ...
3
votes
0answers
82 views

High-latency anonymous communication minimum delay?

High-latency anonymous communication (e.g. Mixmaster and Mixminion) delay messages for a long time using mixers to anonymous communications. I understand that it has applications for email and p2p but ...
2
votes
1answer
73 views

Definition of randomly generate in the parallelepiped

I am reading the [CLT13] paper regarding multilinear maps over the integers and I have some troubles in understanding what the following random generation means: The vectors of the matrix $r_i \in \...
4
votes
0answers
115 views

What's the difference between game-based and simulation-based security? [duplicate]

What's the difference between game-based and simulation-based security? When we use the simulation-based, how to construct the simulator based on the adversary?
4
votes
1answer
605 views

What is Byzantine Agreement?

This was mentioned in a different question. However Wikipedia states it is proven to be unsolvable. So I would like to know what it is in this context and - since it is unsolvable - what the ...
1
vote
1answer
287 views

Byzantine agreement and PBFT

I have just gone through Feldman-Micali, Dolev-Strong, KatzKoo (basically, most of the literature behind Byzantine agreement), however all of their protocols take a really incredible amount of rounds. ...
1
vote
1answer
92 views

Would reuse of the symmetric key in a hybrid cryptosystem between files be inherently insecure?

This question stems from a UX problem where I want to allow the user to input their PIN only one single time when they open up an mobile app. Here are some properties of the application to provide ...
9
votes
3answers
361 views

Can a device prove the identity of its own code?

Say you have a computing system that has some functionality that is not in itself cryptographically secure, but you want to make sure is executed as specified, and, e.g. an adversary hasn't re-flashed ...
0
votes
1answer
114 views

Elgamal Protocol Failure

I'm having a difficult time trying to solve this problem. Suppose Alice uses the Elgamal signature scheme with $(\alpha, \beta, p) = (2, 33384, 65539)$. She publishes the two signed messages:...
6
votes
1answer
939 views

Can an U2F public/private key-pair for signatures be used for encryption?

I understand that this might be more a process question: Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device ...
8
votes
1answer
243 views

Is a key ratchet effective against replay attacks?

In the answer to this question, a message counter is used to protect against replay attacks. Could a key ratchet be used instead? The basic idea is that with every message sent, the symmetric ...
1
vote
1answer
499 views

Sigma protocol to prove that the prover knows how open a commitment

Sigma protocol to prove that the prover knows how open a commitment. Consider the unconditionally hiding commitment scheme based on discrete log, i.e., the public key $p_k = (p,g,y)$, where $\langle ...
6
votes
1answer
158 views

How to improve long-term duration of standard checksum for authenticity purposes?

Official CMS's of Government gazettes (in the third world), need to publish the checksum of each article and each cited external documentin (eg. full-text contracts) in a permanent support medium like ...
2
votes
1answer
200 views

Bit Commitment - from any One Way Permutations

In the Wiki Page on Commitments, it is given that a commitment scheme may be perfectly binding or perfectly concealing but not ...
3
votes
1answer
60 views

Is it feasible to design a crypto scheme for centralised reporting of anonymized data?

I would like to find out if it is feasible to design a cryptographic scheme that would allow several "reporting parties" to independently transfer information to the same centralised "authority", ...
2
votes
1answer
111 views

linkable tokens

Is it possible for $n$ parties for each to perform operations $f_1$,$f_2$,...,$f_n$ (they can all be the same function) on $x$. Now, another party $A$ given all $n$ values of $f(x)$s should know they ...
3
votes
1answer
78 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
2
votes
2answers
180 views

How to contruct a pseudorandom with a specific property

How to construct a pseudorandom function $PRF$ with the following property: Probability that $PRF(k_1,i)=PRF(k_2,i)$ is negligible, for all keys $k_1,k_2$ such that $k_1\neq k_2$ Does the PRF with ...
5
votes
1answer
253 views

Geometric Cryptography and Zero-Knowledge Proofs

Trying to understand zero-knowledge proofs, I came across this page, which provides an excellent example of a simple cryptographic protocol. I will reproduce the protocol here for the sake of ...
3
votes
0answers
133 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...