63 votes
Accepted

Why do 5G, 4G, etc., use non-conventional algorithms?

These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is ...
user avatar
  • 4,212
55 votes
Accepted

Signal vs Telegram in terms of protocols?

Alright, I'll bite. First, let me propose bounding the discussion to just the core of the protocol. In particular, let's not get hung up on: Social engineering attacks How broadly the end-to-end ...
user avatar
55 votes
Accepted

One Encryption, Many Decryption Keys

This is known in the cryptographic literature as "traitor tracing". See, e.g., the following seminal paper: An efficient public key traitor tracing scheme. Dan Boneh and Matt Franklin. CRYPTO 1999....
user avatar
  • 35.3k
46 votes

Should we MAC-then-encrypt or encrypt-then-MAC?

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. ...
user avatar
36 votes
Accepted

Why is plain-hash-then-encrypt not a secure MAC?

$\operatorname{Encrypt}(m\|H(m))$ is not an operating mode providing authentication; forgeries are possible in some very real scenarios. Depending on the encryption used, that can be assuming only ...
user avatar
  • 122k
34 votes

Is it easy to crack a hashed phone number?

No, it is not a good idea to hash phone numbers. There are only a limited number of phone numbers, so it is pretty easy for an adversary to try and hash all of them. Then you can simply compare the ...
user avatar
  • 84.5k
26 votes
Accepted

How does a rolling code work?

What happens if the sender is at another point in the sequence? ... the key is pressed while out of range to the car. In a rolling code (code hopping) system, the keyfob transmitter maintains a ...
user avatar
  • 5,238
24 votes

Should we MAC-then-encrypt or encrypt-then-MAC?

Moxie Marlinspike calls it in his article http://www.thoughtcrime.org/blog/the-cryptographic-doom-principle/ the doom principle: if you have to perform any cryptographic operation before verifying ...
user avatar
  • 349
18 votes
Accepted

Is it possible for Alice and Bob to both sign a message "simultaneously"?

This is one of the earliest questions that was asked in modern cryptography. There is a proof that you cannot achieve completely fair contract signing. However, there are some reasonable alternatives. ...
user avatar
17 votes
Accepted

Salary Negotiation Problem

Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else. So ...
user avatar
  • 37.7k
17 votes
Accepted

DRM simple clone

I heard of DRM but could not get a reliable implementation of DRM There is a good reason for this: DRM is a hard problem, and a solution to it could be leveraged to obtain incredible amounts of money....
user avatar
  • 19.2k
14 votes
Accepted

Why do we implement a protocol?

I assume the question is related to academic work: why do we implement a protocol if we already know how efficient it is by a complexity analysis? The answer depends very much on the type of protocol. ...
user avatar
13 votes
Accepted

How to use proof of lack of knowledge?

In general, you cannot prove lack of knowledge, because even if you did know something you shouldn't, you can always pretend that you don't know it and carry out the proof as if you didn't know it. ...
user avatar
12 votes

NTRU crypto from unseen.is; myth busting help

I'll comment only the statement referring to an AES-256 replacement with 4096-bit key: According to our engineers, this will take 23840 times longer to crack than aes256 Bob writing that is not ...
user avatar
  • 122k
12 votes
Accepted

Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?

SSL was designed long ago when encrypt-then-MAC wasn't that popular yet. Even TLS 1.2, published in 2008, is pretty old by now, and while encrypt-then-MAC was preferred by then, the practical risks ...
user avatar
12 votes
Accepted

Is there a formal language to define a cryptographic protocol?

Disclaimer: I use Coq on daily basis... About the tools As you are looking for a formal verification, I would advise you to take a look at Coq. Even though mainly used by Academics, it provides a ...
user avatar
  • 9,789
12 votes

Is it easy to crack a hashed phone number?

It is always a bad idea to hash data that has a limited set of length or characters. A phone number in Germany for example has normally no more than 12 digits. The first digit is always a ...
user avatar
12 votes

Is it easy to crack a hashed phone number?

In the general sense, The problem is known as the small input space on the hash functions, and in short simple hashing won't be secure. If you hash data ( here a phone number) and an attacker tries to ...
user avatar
  • 42.9k
11 votes

Why is plain-hash-then-encrypt not a secure MAC?

Two things going on that together may make plain-hash-then-encrypt insecure. First, the distinction between secure MACs and hashes, which is that a hash function may allow you to derive $H(m')$ from $...
user avatar
  • 31.2k
11 votes

How does a rolling code work?

It is worth pointing out that Samy Kamkar realized and implemented (in 2015) what is now forehead-slappingly obvious in retrospect - it's perfectly practical to have a radio TX+RX unit that snoops a ...
user avatar
11 votes

Equal sign with a "c"

To quote the paper Two probability ensembles... are said to be computationally indistinguishable, denoted $X\stackrel{c}{\equiv}Y$, if... This is found in section 2.
user avatar
  • 37.7k
11 votes
Accepted

Obfuscating functions that are mostly zero

I provide a summary below of what is currently known (to my knowledge) regarding obfuscation of various class of "mostly-zero" functions. From Indistinguishability Obfuscation What we can obfuscate: ...
user avatar
10 votes

Why do we implement a protocol?

Do we implement it for proof of concept? Absolutely. It's very easy to miss vital points if no implementation exists. W3C for instance doesn't even allow protocols to be standardized without ...
user avatar
  • 84.5k
10 votes
Accepted

Examples of protocols that are insecure when run concurrently

Consider the function $f : \{L,R\} \times \{ U,D \} \to \{0,1,2\}$ defined by the following table: $$ \begin{array}{c|cc} f & L & R \\ \hline U & 0 & 0 \\ D ...
user avatar
  • 10.6k
9 votes

Should we MAC-then-encrypt or encrypt-then-MAC?

The really important thing is, not encrypt-and-mac. The other two, you can debate, but both are at least theoretically sound -- one might just practically be better than the other. Encrypt-and-MAC ...
user avatar
  • 231
9 votes
Accepted

SHA-256-based stream cipher

Some brief thoughts: Shared secret Generation: $$s=E_a(B)=E_b(A)$$ The shared secret is generated by encrypting the other users public key with your private key. This is effectively an ECDH step, ...
user avatar
9 votes

Zero-knowledge proof of a product

Use the exponential variant of ElGamal, where the plaintext is encoded in the exponent. Elliptic curve ElGamal is fine. In fact, any public key cryptosystem which allows raising ciphertexts to a power ...
user avatar
  • 1,370
9 votes
Accepted

Universal Circuits in Indistinguishability Obfuscation Candidate Construction

As @D.W. guessed, the branching program for a circuit essentially reveals the original circuit. It's not clear what you mean by "apply the whole obfuscation process to the circuit-revealing branching ...
user avatar
9 votes

Signal vs Telegram in terms of protocols?

Besides Joshua Warner's excellent answer, I do also want to point out that someone has to "roll their own crypto" at some point for there to be any designs and implementations at all. On that front, ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible