Skip to main content
61 votes
Accepted

Is the software that uses PGP broken, or is it PGP itself?

Usenix Paper, replacing earlier draft at efail.de. TL;DR: the vulnerability is in some popular email client software, often combined with an extension simplifying the use of an OpenPGP (e.g. GnuPG) or ...
fgrieu's user avatar
  • 142k
57 votes
Accepted

Signal vs Telegram in terms of protocols?

Alright, I'll bite. First, let me propose bounding the discussion to just the core of the protocol. In particular, let's not get hung up on: Social engineering attacks How broadly the end-to-end ...
Joshua Warner's user avatar
53 votes

Is the software that uses PGP broken, or is it PGP itself?

There are a few parts to the EFAIL attacks. Some parts are the fault of the mailer authors for exposing unnecessary attack surface via arbitrary incoming email. Some parts are the fault of the ...
Squeamish Ossifrage's user avatar
40 votes
Accepted

What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

The different guarantees of security In security proofs, you have several guarantees that you can obtain on the security of a protocol. The most famous are maybe the following: game-based security ...
Léo Colisson's user avatar
22 votes
Accepted

Finding flaw in cryptographic protocol

If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute. How about Finding a flaw in cryptographic protocol?! A protocol ...
Ella Rose's user avatar
  • 19.7k
13 votes
Accepted

Free Start Collision In SHA-3

NO, you can't ! I will only consider initial_vector_0 and next_block_0. What you have found is this: ...
Biv's user avatar
  • 10k
10 votes
Accepted

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

There's a line of thought in crypto when it comes to keys: one usage, one key. That gives a first level of rationale towards using separates keys in each direction: each direction is a different usage ...
fgrieu's user avatar
  • 142k
9 votes
Accepted

Importance of round complexity in determining the efficiency of an MPC protocol

First note that all polynomial-time functions can be securely computed with a constant number of rounds (Yao and BMR families) and all can be securely computed with protocols that have rounds ...
Yehuda Lindell's user avatar
9 votes

Signal vs Telegram in terms of protocols?

Besides Joshua Warner's excellent answer, I do also want to point out that someone has to "roll their own crypto" at some point for there to be any designs and implementations at all. On that front, ...
Stephen Touset's user avatar
9 votes
Accepted

Using weak hash functions to construct a stream cipher

As long as your encoding of $K$, $N$, and $i$ is injective (i.e., for each encoded string you can uniquely derive $K$, $N$, and $i$) and fixed-length, this is almost certainly a decent stream cipher. ...
Squeamish Ossifrage's user avatar
8 votes
Accepted

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Do you know protocols where it is necessary to obtain several "independent" points on the same elliptic curve? One obvious place where this occurs if you are implementing a Pedersen ...
poncho's user avatar
  • 148k
7 votes

Why does the WhatsApp protocol require elaborate computation when verifying user keys?

I agree with the comments, in that the aim of step 1 is likely to increase the cost of performing a man-in-the-middle attack. When two users want to verify their keys, the only information they rely ...
Mark's user avatar
  • 665
6 votes

Secure communication protocol for equality test

Equality of single bits is the XNOR function. There is no unconditionally secure protocol for XNOR in the presence of malicious adversaries. We prove this in: HK Maji, M Prabhakaran, M Rosulek: ...
Mikero's user avatar
  • 13.5k
6 votes
Accepted

Showing formally that DDH hardness implies CDH hardness

Let me state the precise definition of DDH, to make it more clear: assuming a group an a generator $g$ are fixed, the challenger flips a coin. If he gets 0, he picks $(x,y,z)$ uniformly at random; if ...
Geoffroy Couteau's user avatar
6 votes
Accepted

Information Theoretic Oblivious Transfer?

It is impossible to achieve (fully) information theoretic oblivious transfer (OT), since OT is complete (and so can compute all functions). Since many (most) functions cannot be securely computed ...
Yehuda Lindell's user avatar
5 votes

Key recovery when AES ECB is used for short but repeated messages

If the attacker can make the end device send plenty join-request messages and if the server always responds with a corresponding join-accept message, can the attacker gain knowledge of the AppKey ...
otus's user avatar
  • 32.2k
5 votes

Key management for military GPS receivers

I am not familiar with SAASM, but I have read a little bit about the older scheme PPS-SM and can answer that. The SV (space vehicle - aka the satellite) transmits an encrypted ...
Artium's user avatar
  • 151
5 votes
Accepted

Proving knowledge of a value and computation that uses it

This looks like your typical Schnorr identification protocol. Here $r$ is some secret value, which we could think of as having two public keys $r\cdot P$ and $r\cdot Q$. You'll probably want to assume ...
CurveEnthusiast's user avatar
5 votes

Finding flaw in cryptographic protocol

This relates how I dealt with this issue in 1999. I had found an attack on the ISO/IEC 9796(-1) signature scheme. It was closer to practical than another line of effort¹ to break that scheme. The ...
fgrieu's user avatar
  • 142k
4 votes

Simulation-based proofs and universal composability proofs

My goal is just to complete Mikero's answer, notably on that part: Also, I would be most grateful if you should show me example proofs in the UC framework. The shorter/easier the better, just so I ...
Léo Colisson's user avatar
4 votes
Accepted

Geometric Cryptography and Zero-Knowledge Proofs

Suppose that the second approach is used, this would allow an attacker to impose Alice. The intuition is that, as long as an attacker knows what is Bob going to ask him, he will be able to make things ...
Daniel's user avatar
  • 3,972
4 votes
Accepted

Key recovery when AES ECB is used for short but repeated messages

ECB mode has several weaknesses as discussed in Why shouldn't I use ECB encryption? but in this specific case, it does not allow to gain information about the secret key ...
Raoul722's user avatar
  • 2,836
4 votes
Accepted

Why would we use a Key Agreement Protocol if we already have a key between 2 entities?

Hint Consider what would happen if an adversary somehow managed to recover the session key. Spoiler If they simply used the shared key as the session key directly, then an adversary who ...
Ella Rose's user avatar
  • 19.7k
4 votes
Accepted

Fully homomorphic encryption with polynomials

I missed some pitfalls? The most obvious one is that the secret key $x_0$ is recoverable with a single known plaintext/ciphertext pair. That is, if we know both $m$ and $Enc(m) = a_{p-2}x^{p-2} +\ ....
poncho's user avatar
  • 148k
4 votes
Accepted

Does using Noise asynchronously weaken its security properties?

Online $\neq$ Synchronous Yes, Noise can be used in a somewhat asynchronous setting. Noise is initially meant to be an "online" protocol to establish secure channels, however "online&...
Lery's user avatar
  • 7,719
4 votes
Accepted

Security proof, Sequence of games

The general strategy in sequence of games or game-hopping proofs is the following: Starting with the original security game, change small details in the game in every hop until you get to a game where ...
0kp's user avatar
  • 346
4 votes
Accepted

Secure Multi-Party Computation (MPC) protocol with all dishonest parties

Secure computation against all dishonest parties is well-defined, and actually attainable under standard assumptions. The key point is that this notion is useful when we consider composable notions of ...
Geoffroy Couteau's user avatar
3 votes
Accepted

Is battery usage an important parameter for mobile based key exchange protocol?

The Kungpisdan Et al. paper you cite does make mention of battery powered devices with "low-computational capabilities" in section 2.2 "Mobile Payment – Problems and Limitations" although they do not ...
dave.zap's user avatar
  • 493
3 votes

Simplified universal composability (SUC): can I model the use of encryption? Can I prove fairness?

Since fairness cannot be modeled, does that mean I cannot prove that a voting scheme, for example is fair (that is, that either the protocol finishes execution and everybody learns the result or ...
Mikero's user avatar
  • 13.5k
3 votes
Accepted

Why a pseudorandom permutation is used in a simulation based proof but pseudorandom function is not?

I happened to be talking to one of the authors and asked about this. The short answer is: Eventually on page 34 they are considering a malicious adversary. The simulator has to extract the adversary's ...
Mikero's user avatar
  • 13.5k

Only top scored, non community-wiki answers of a minimum length are eligible