82
Assuming you are asking about public-key signatures + public-key encryption:
Short answer: I recommend sign-then-encrypt, but prepend the recipient's name to the message first.
Long answer: When Alice wants to send an authenticated message to Bob, she should sign and encrypt the message. In particular, she prepends Bob's name to the message, signs this ...
62
Actually, that wikipedia article you mention in your question already answers your question:
It is moderately common for companies and sometimes even standards bodies as in the case of the CSS encryption on DVDs – to keep the inner workings of a system secret. Some argue this "security by obscurity" makes the product safer and less vulnerable to attack. ...
54
This is known in the cryptographic literature as "traitor tracing". See, e.g., the following seminal paper:
An efficient public key traitor tracing scheme. Dan Boneh and Matt Franklin. CRYPTO 1999.
They show a public-key encryption scheme where each possible recipient has their own private decryption key. If an authorized recipient discloses their ...
43
Alright, I'll bite.
First, let me propose bounding the discussion to just the core of the protocol.
In particular, let's not get hung up on:
Social engineering attacks
How broadly the end-to-end encryption is applied (i.e. are all conversations in the app encrypted?)
The backgrounds of the inventors and reasoning for inventing the protocol
Metadata ...
42
Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. The ciphertext is the ENTIRE ciphertext (including IV etc.), and this is what must be MACed. This is granted.
However, if you MAC-then-encrypt in the ...
34
$\operatorname{Encrypt}(m\|H(m))$ is not an operating mode providing authentication; forgeries are possible in some very real scenarios. Depending on the encryption used, that can be assuming only known plaintext.
Here is a simple example with $\operatorname{Encrypt}$ a stream cipher, including any block cipher in CTR or OFB mode. Mallory wants to forge an ...
29
This is a classical example.
Here is the proof system…
Bob gives two gloves to Alice so that she is holding one in each hand. Bob can see the gloves at this point, but Bob doesn't tell Alice which is which. Alice then puts both hands behind her back. Next, she either switches the gloves between her hands, or leaves them be, with probability $1/2$ each. ...
25
Cascading cipher gives a sense of security; and one that is technically justified with respect to the possibility that a weakness in one of the cipher would allow recovering the encrypted data. That's Bruce Schneier's argument, and it made sense in an era where DES, the then leading cipher, was a closed design, clearly deliberately weakened by a small key, ...
21
Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such as XOR.
Purchase a plane ticket for an international flight connecting through Sheremetyevo airport.
...
21
What happens if the sender is at another point in the sequence? ...
the key is pressed while out of range to the car.
In a rolling code (code hopping) system,
the keyfob transmitter maintains a synchronization counter C,
incremented every time a button is pushed.
The car receiver stores the most recent
validated synchronization counter it has received N.
...
18
Moxie Marlinspike calls it in his article http://www.thoughtcrime.org/blog/the-cryptographic-doom-principle/ the doom principle:
if you have to perform any cryptographic operation before verifying
the MAC on a message you’ve received, it will somehow inevitably lead
to doom.
He also demonstrates two attacks which are possible because of trying to ...
17
Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else.
So Alice and Bob just run the protocol with their respective inputs A and B.
17
This is one of the earliest questions that was asked in modern cryptography. There is a proof that you cannot achieve completely fair contract signing. However, there are some reasonable alternatives. There is one direction called "gradual release" which I personally do not like. A model that I think has a lot of promise is called the "optimistic model". In ...
17
I heard of DRM but could not get a reliable implementation of DRM
There is a good reason for this: DRM is a hard problem, and a solution to it could be leveraged to obtain incredible amounts of money. Doing a cursory search for "why DRM doesn't work" yields an abundance of articles explaining the whats and whys.
To win at DRM, let's say you have some piece ...
15
TLS 1.0 uses initialization vector (IV) to refer to two different processes. TLS 1.1 introduces a new type of IV that causes an entire block to be discarded and isn't directly comparable to the old series of IVs based on CBC residue. By simply changing an operation at the beginning of a record, the hope was apparently to make implementations easy to patch ...
15
If k is a constant, such as 3, it becomes possible to select a pair (N,g) such that the discrete log of k to the base g is known, which would enable the two-for-one guessing attack again.
14
This is actually to a great extent a question of terminology, and ultimately which security claims you are prepared to make, more than it is a practical question.
For short: You may draw the line between the key space and the algorithm any way you want, but the way you draw that line will have implications regarding which security claims you are able to ...
14
Short answer: Because the browser developers have long thought interoperability to be more important than security and standard compliance.
Slightly longer answer: Some SSL/TLS server implementations do not negotiate the protocol version correctly, but terminate the connection with a fatal alert if the client attempts to negotiate a protocol version that ...
13
I think Encrypt-then-MAC does not deliver Plaintext integrity, but only ciphertext integrity. If the MAC over the ciphertext is OK but then we use the wrong key to decrypt (for whatever reason), then the recipient receives a plaintext that the sender did not send and did not vouch for. If this can happen, this is a violation of plaintext integrity.
So, ...
13
The overall idea is a sound migration strategy. The nice thing is that security for all users is upgraded in a one-shot operation, rather than at the hypothetic next login of each user. Of course, original salt and new_secure_salt shall be stored, or perhaps for some portion derivable exactly from material keyed-in by the user, e.g. user name lowercased.
...
13
It depends on your requirement,
If you Sign-then-encrypt then only receiver can decrypt and then
verify .
If encrypt-then-sign then anybody can verify the
authenticity and only receiver can decrypt it .
But in practice, both are not enough , ideally We have to sign-encrypt-sign , am not able to recollect the paper which discusses this
There is one ...
13
There are a couple of options for protocol analysis tools.
(I don't know any established tool for their design - as said by someone else, designing your own protocols is not really recommended.)
If you are looking for formal methods based, symbolic tools, some well-known tools that have been applied to many protocols are ProVerif and Scyther. Given that you ...
13
I assume the question is related to academic work: why do we implement a protocol if we already know how efficient it is by a complexity analysis? The answer depends very much on the type of protocol. However, the answer typically is that a theoretical complexity analysis usually does not suffice to understand the concrete efficiency. If the "previously best ...
13
In general, you cannot prove lack of knowledge, because even if you did know something you shouldn't, you can always pretend that you don't know it and carry out the proof as if you didn't know it.
For your specific example, consider how the prover would know $x_0$. Did you tell them what it is? If so, that proves nothing, since they would then know $x_0$ ...
12
Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?
It can be done, but the algorithm is a bit complex and the hashes have to be specially constructed. The basic idea is this:
What you need is a way for each party to give the other a verifiable "clue" that reduces the search space for the possible file, say by a factor of 10. As soon as one party stops giving clues, the other stops giving clues as well. So a ...
12
I'll comment only the statement referring to an AES-256 replacement with 4096-bit key:
According to our engineers, this will take 23840 times longer to crack than aes256
Bob writing that is not able to correctly transcribe even the numbers that engineer Alice allegedly spelled: most likely, $23840$ is intended to be $2^{3840}$, which is the ratio $2^{...
12
Disclaimer: I use Coq on daily basis...
About the tools
As you are looking for a formal verification, I would advise you to take a look at Coq. Even though mainly used by Academics, it provides a logical framework and an interface to write formal and interactive proofs.
Based this language there exists some libraries dedicated to cryptographic proof :
...
11
It's shockingly simple. It's a file. It has public keys in it.
The traditional PGP Key Ring is a sequential file with a sequential list of keys in it. It's not even a database.
Slightly more advanced key rings, such as those used in Key Servers actually use a database.
11
The archetypal situation where the length-extension property becomes problematic is when ones builds a Message Authentication Code from a hash function as $$\textrm{BadMAC}(K,M)=\textrm{Hash}(K||M)$$ where $K||M$ is the concatenation of the Key and the Message.
The length extension property then translates directly into the capability to forge a different ...
Only top voted, non community-wiki answers of a minimum length are eligible
