Questions tagged [protocol-design]

Design of cryptographic protocols, i.e. ways of using algorithms (primitives) to achieve one or more security goals like integrity, confidentiality, authenticity (maybe together with non-security-related goals). If you ask about a specific protocol, tag with its name instead (or additionally, if about its design).

Filter by
Sorted by
Tagged with
2
votes
1answer
112 views

linkable tokens

Is it possible for $n$ parties for each to perform operations $f_1$,$f_2$,...,$f_n$ (they can all be the same function) on $x$. Now, another party $A$ given all $n$ values of $f(x)$s should know they ...
3
votes
1answer
78 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
2
votes
2answers
180 views

How to contruct a pseudorandom with a specific property

How to construct a pseudorandom function $PRF$ with the following property: Probability that $PRF(k_1,i)=PRF(k_2,i)$ is negligible, for all keys $k_1,k_2$ such that $k_1\neq k_2$ Does the PRF with ...
5
votes
1answer
258 views

Geometric Cryptography and Zero-Knowledge Proofs

Trying to understand zero-knowledge proofs, I came across this page, which provides an excellent example of a simple cryptographic protocol. I will reproduce the protocol here for the sake of ...
3
votes
0answers
133 views

How can we formally define a Pseudo-Random Shuffle function?

My question is related to: When we turn Random shuffle to Pseudorandom Shuffle The idea is to permute the elements in vector $\mathbf{v}$ pseudorandomly, where $|\mathbf{v}|=n$; I am aware that we ...
2
votes
3answers
258 views

Are there historical examples of Occam's Razor being useful to cryptography research?

Previously, I asked what is the simplest digital signature scheme known, under the assumption simpler implementations could provide valuable insights on the nature of the problem. Among competing ...
2
votes
2answers
252 views

Collision-resistant Pseudorandom function

Assume we have a pseudorandom function: PRF(.) We want the following property holds with a high probability: $\forall i, 0\leq i \leq n: PRF(k_1, i)\neq PRF(k_2,i)$ where $k_1$ and $k_2$ are two ...
3
votes
1answer
134 views

Piggyback on Bitcoin for independent data verification?

The recent threats to EPA data integrity have me wondering if it's possible to archive data in a way such that one can later check whether the data have been tampered with since the original archival. ...
4
votes
1answer
559 views

One ciphertext, multiple keys, multiple messages

I recently came across following idea, does anyone know a name and if it is actually used? A wants to send B a message (A and B know both have a common secret key) and C wants to intercept it (...
1
vote
1answer
39 views

Efficient protocol to give out N known items randomly to k>=3 parties without independent bodies

There are $N$ items which are to be uniformly randomly distributed (every possibility has equal probability) to $k\geq 3$ parties, such that no individual party can change the probability of getting ...
5
votes
2answers
137 views

What requirements would lead to the development of a new security protocol?

I recently completed a semester studying some basic amount of cryptography. So my knowledge is not very broad/deep. What I currently see is that we have a bunch of fairly secure encryption modes to ...
1
vote
1answer
83 views

Is battery usage an important parameter for mobile based key exchange protocol?

I am studying a key exchange protocol based on public key cryptography technique specifically designed for mobile devices. I noticed there is no importance given to battery usage by these protocols. ...
9
votes
2answers
1k views

Alternative for RFC 6238/4226 - one time password via SMS (single-factor authentication)

Currently we have implemented One Time Passwords (OTP) as second authentication which works well. We use TOTP - RFC 6238 Some clients would like to have a "sms only" login, so it's single factor ...
1
vote
1answer
369 views

Use Cases of Otway Rees key exchange protocol

I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is ...
1
vote
1answer
377 views

Speeding up the Denning-Sacco protocol?

I have started to study cryptography and I have come across Denning-Sacco protocol. I understand multiplicity vulnerability. My question is why Denning-Sacco protocol choose to generate key on ...
1
vote
1answer
1k views

Why does appending a message to a key before hashing not guarantee integrity? [duplicate]

I want to guarantee the integrity of a message $m$. My first thought is to append the message to an integrity key $k$ and hash it as $H(k\,||\,m)$. However, I have been told that this is not totally ...
0
votes
1answer
71 views

What does this protocol mean?

Does this mean that the message is being added onto the hashed(message, tag) ? m || H(m, "secret") So the output would be something like: "RandomMessage"+...
-1
votes
1answer
68 views

Need Help with understanding authentication process

I want to develop an app which allows to pair between pc using bluetooth then you can send the signal from the phone to unlock the PC(on the same network). I need help with the process after ...
9
votes
1answer
757 views

Is there a formal language to define a cryptographic protocol?

I wanted to work on a personal project where I would attempt to identify the flaws in a cryptographic protocol. Now for that to work properly, the program should understand the syntax of protocol ...
8
votes
1answer
2k views

Replay attack prevention in connectionless UDP encrypted communication

What are the options for replay attack prevention when two parties exchange UDP messages. No connection or session is estabilished. Communicating parties have pre shared key that is used for ...
4
votes
1answer
141 views

Why is cryptographic model not considered formal methods?

I have just started looking at different methods for analyzing the security of cryptographic protocols. According to my reading, there are two main approaches in this area. The first approach is so-...
2
votes
1answer
115 views

Secure instant messaging protocol and implementation for an anonymous end-to-end chat?

all is said in the title but I will go further. First question : I searched here and I found Tox to be the most powerful protocol. It uses Curve25519, XSalsa20 and Poly1305. They seem to be good ...
5
votes
1answer
187 views

Why is does the protocol of Ding et al. produce biased bits and does it relate to passive security?

I am not understanding the following from "Lattice Cryptography for the Internet" by C. Peikert (pages 9): We remark that a work of Ding et al. DXL14 proposes a different reconciliation method ...
0
votes
1answer
125 views

Whether hash function of two values $h(a,b)=h(b,a)$ are same?

If two messages $M_1$ and $M_2$ are given as input to a hash function $h$ is it then true that $h(M_1,M_2) = h(M_2,M_1)$? I have two messages. I want to know, Is it possible to apply a hash ...
2
votes
0answers
30 views

Can “PrivateKey+MagicValue” decode pre-encoded data without intermediate key?

Let's say I want to build a public repository of encrypted files. EncA(FileA) EncB(FileB) ...
5
votes
1answer
436 views

Implementing Secure multi-party computation for online website

I need to know if the following is feasible: I want that any two users of my website have a private key such that the private key is divided into three parts one for website owner and one each for the ...
3
votes
1answer
138 views

Secure communication protocol for equality test

I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ. Easy solution is ...
3
votes
0answers
245 views

Shared-secret authentication with implicit session keys?

Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which ...
3
votes
1answer
302 views

Using ChaCha20 on very short messages with high packet loss

I'm building a low power wireless network and need to transmit very small packets at regular intervals (10 bytes every minute or so). In order to secure the communications I'm considering using ...
4
votes
1answer
2k views

What does the Double Ratchet algorithm need the Root Key for?

One of the basic ideas of the Double Ratchet algorithm is that it performs DH exchanges in-band using a clever “half-DH” trick. For some reason, instead of directly deriving the Chain Key from the DH ...
3
votes
1answer
461 views

Multiple users getting access to same (secret) encryption key on a single computer?

I am developing an application for Desktop PCs (Mac primarily, Windows later) that uses an encrypted SQLite database. I want to give multiple authenticated users access to this "main" database. I like ...
8
votes
1answer
2k views

Can I use a HMAC for Replay Attack protection?

I am considering a system where a small device accepts messages/commands from another device over a wireless channel. I am worried about replay attacks. The messages will be encrypted. What are ...
50
votes
7answers
7k views

One Encryption, Many Decryption Keys

I would like to share access to encrypted data among many recipients. I do not know the recipients ahead of time (when encrypting the data). Once the data is encrypted, I do not have access to the ...
0
votes
1answer
130 views

Secure multi-party private set intersectio: Protocols supporting MULTI-party VS supporting TWO-party

Let assume party $B$ wants to receive secure multi-party computation (MPC) output. The are many private set intersection (PSI) protocols that support only two parties but they cannot support multi-...
1
vote
0answers
27 views

Digital Dead Drops or guaranteed significant uncertainty of identity over TCP/IP for a large set of users

Client is part of a Set members. Every distinct object in members has in common, that they do want to communicate to the Server without the Server or other objects of members knowing the origin of ...
2
votes
1answer
90 views

Security of one-time-pad without $\bmod $ operation?

Assume $r_1,r_2$ are used only once, and picked uniformly at random (each time we want to mask a value) from finite field $\mathbb{F}_p$, where $p$ is a large prime number. Assume $r_i\neq0$ and $b$ ...
1
vote
0answers
73 views

Secure Communication Protocol Design using oblivious transfer?

I have a problem I need to solve with the following scenario and I hope someone can help me find an approach or direction to start tackling it. Consider Alice as a sender who has $n$ strings which ...
2
votes
3answers
201 views

DIY message level security?

This might be in danger of being too elementary a question for this community but I'm hoping for expert help: Assuming that TLS is not enough to protect messages transmitted between a client and a ...
1
vote
1answer
75 views

Encoding an element in $r=r'||h(r')$ way

We consider a finite field $\mathbb{F}_p$, where $p$ is a large prime e.g. 256-bit. We have $b$ a fixed element of the field. We encode it as $b'=b||h(b)$, where $h(.)$ is a cryptographic hash ...
1
vote
0answers
74 views

Who invented the $1^n$ notation? [duplicate]

I am always wondering about the seemingly odd syntax $1^n$ which designates the security strength of a cryptographic algorithm. Who invented this (odd) syntax and what was the reason for inventing ...
3
votes
1answer
103 views

Does encryption of data/information take place in peer to peer networks like Gnutella, Bittorrent?

Do peer to peer networks like Gnutella, Bittorrent have any encryption system to secure the users privacy or encrypt the file/data being shared? Elaborate please.
1
vote
0answers
133 views

Encrypted comms between devices on LAN

I'm trying to encrypt a protocol that shares data between devices on a local area network (i.e.no connection to the internet). I don't want to use predefined keys because they're too easy to read from ...
2
votes
0answers
205 views

Simultaneous 2 way exchange without trusted third party

Stakeholders: Alice - has a message, M containing a secret, SA that Bob wants, where H(SA) is a hash which may be used by Bob to redeem some Bitcoin time-locked transaction sent previously by Alice. ...
1
vote
2answers
242 views

What is a simple information authentication protocol for constrained devices?

Background: I have an application where devices will poll information from some source on the network. These devices are very basic and have modest processing and memory capabilities. Hashing (and ...
23
votes
2answers
890 views

Is it possible for Alice and Bob to both sign a message “simultaneously”?

Let's say that there is a message which is considered valid if signed by both Alice and Bob. Alice could sign the message and then give it to Bob, so that he can sign it and give it back to her. But,...
1
vote
0answers
102 views

Key Distribution Center Key Protocol Analysis

As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture From my understanding, Notation B in ...
2
votes
0answers
120 views

Designing a secure protocol to avoid MITM?

Imagine that you are designing an online game, the framework consists of a player A, a game host H and a trusted central server S. The player A has a symmetric key KAS and id A that is known to ...
11
votes
1answer
2k views

Is the “New Hope” Lattice Key Exchange vulnerable to a lattice analog of the Bernstein BADA55 Attack?

In the paper, "Post Quantum Key Exhange - A New Hope," the authors present a lattice-based key exchange based on the work of Chris Peikert. In this "New Hope" key exchange the authors try to gain ...
4
votes
0answers
65 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
1
vote
0answers
135 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...