64 votes
Accepted

Why do 5G, 4G, etc., use non-conventional algorithms?

These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is ...
b degnan's user avatar
  • 4,820
57 votes
Accepted

Signal vs Telegram in terms of protocols?

Alright, I'll bite. First, let me propose bounding the discussion to just the core of the protocol. In particular, let's not get hung up on: Social engineering attacks How broadly the end-to-end ...
Joshua Warner's user avatar
55 votes
Accepted

One Encryption, Many Decryption Keys

This is known in the cryptographic literature as "traitor tracing". See, e.g., the following seminal paper: An efficient public key traitor tracing scheme. Dan Boneh and Matt Franklin. CRYPTO 1999....
D.W.'s user avatar
  • 36.4k
35 votes

Is it easy to crack a hashed phone number?

No, it is not a good idea to hash phone numbers. There are only a limited number of phone numbers, so it is pretty easy for an adversary to try and hash all of them. Then you can simply compare the ...
Maarten Bodewes's user avatar
  • 92.6k
25 votes

Why is SSL on top of TCP?

why the SSL is not under the TCP ( Transport layer ) ? Because SSL can use TCP [1] to transport SSL records, and so SSL relies on TCP as a service. That is, SSL takes the user data stream, and ...
poncho's user avatar
  • 147k
18 votes
Accepted

Salary Negotiation Problem

Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else. So ...
mikeazo's user avatar
  • 38.6k
18 votes
Accepted

Is it possible for Alice and Bob to both sign a message "simultaneously"?

This is one of the earliest questions that was asked in modern cryptography. There is a proof that you cannot achieve completely fair contract signing. However, there are some reasonable alternatives. ...
Yehuda Lindell's user avatar
17 votes
Accepted

DRM simple clone

I heard of DRM but could not get a reliable implementation of DRM There is a good reason for this: DRM is a hard problem, and a solution to it could be leveraged to obtain incredible amounts of money....
Ella Rose's user avatar
  • 19.6k
14 votes

How does a rolling code work?

It is worth pointing out that Samy Kamkar realized and implemented (in 2015) what is now forehead-slappingly obvious in retrospect - it's perfectly practical to have a radio TX+RX unit that snoops a ...
Richard Aplin's user avatar
13 votes
Accepted

How to use proof of lack of knowledge?

In general, you cannot prove lack of knowledge, because even if you did know something you shouldn't, you can always pretend that you don't know it and carry out the proof as if you didn't know it. ...
Ilmari Karonen's user avatar
13 votes

Is it easy to crack a hashed phone number?

It is always a bad idea to hash data that has a limited set of length or characters. A phone number in Germany for example has normally no more than 12 digits. The first digit is always a ...
dmuensterer's user avatar
13 votes

Is it easy to crack a hashed phone number?

In the general sense, The problem is known as the small input space on the hash functions, and in short simple hashing won't be secure. If you hash data ( here a phone number) and an attacker tries to ...
kelalaka's user avatar
  • 48.5k
12 votes
Accepted

Is there a formal language to define a cryptographic protocol?

Disclaimer: I use Coq on daily basis... About the tools As you are looking for a formal verification, I would advise you to take a look at Coq. Even though mainly used by Academics, it provides a ...
Biv's user avatar
  • 9,988
12 votes

Why is SSL on top of TCP?

The Secure Socket Layer is as the name suggests build on sockets, which provide error free, ordered stream of data. TLS is the differently named successor to SSL; TLS 1.0 succeeds SSL 3. TLS likewise ...
Maarten Bodewes's user avatar
  • 92.6k
11 votes

Equal sign with a "c"

To quote the paper Two probability ensembles... are said to be computationally indistinguishable, denoted $X\stackrel{c}{\equiv}Y$, if... This is found in section 2.
mikeazo's user avatar
  • 38.6k
11 votes
Accepted

Obfuscating functions that are mostly zero

I provide a summary below of what is currently known (to my knowledge) regarding obfuscation of various class of "mostly-zero" functions. From Indistinguishability Obfuscation What we can obfuscate: ...
Geoffroy Couteau's user avatar
11 votes
Accepted

Examples of protocols that are insecure when run concurrently

Consider the function $f : \{L,R\} \times \{ U,D \} \to \{0,1,2\}$ defined by the following table: $$ \begin{array}{c|cc} f & L & R \\ \hline U & 0 & 0 \\ D ...
Mikero's user avatar
  • 13.2k
10 votes

Why is SSL on top of TCP?

While the other answers are good, I think they're missing the core point: TCP is what's there. You can't just define arbitrary new layer-4 protocols on top of IP and expect existing operating systems ...
R.. GitHub STOP HELPING ICE's user avatar
10 votes
Accepted

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

There's a line of thought in crypto when it comes to keys: one usage, one key. That gives a first level of rationale towards using separates keys in each direction: each direction is a different usage ...
fgrieu's user avatar
  • 141k
9 votes

Signal vs Telegram in terms of protocols?

Besides Joshua Warner's excellent answer, I do also want to point out that someone has to "roll their own crypto" at some point for there to be any designs and implementations at all. On that front, ...
Stephen Touset's user avatar
9 votes

One Encryption, Many Decryption Keys

I can't really prevent "bad" recipients from the leaking the key (or the plaintext, for that matter), but I would like to be able to distribute unique keys to each recipient so that if a key is leaked,...
Luis Casillas's user avatar
9 votes
Accepted

Can I use a HMAC for Replay Attack protection?

An old but excellent paper on this topic is Tuomas Aura's Strategies against Replay Attacks. The simplest version of the "Hashed Full Information" method would be to include the MAC of the ...
joveian's user avatar
  • 345
9 votes

Is there any protocol for proving that a message was written at a certain time?

In general, no. You can prove a message was written no later than time T by hashing the message with a collision-resistant hash, and communicating the hash to some trusted third party that records it ...
lacker's user avatar
  • 191
8 votes
Accepted

How to implement 1-out-of-n OT from 1-out-of-2 OT?

Approach 1 The simplest way of doing this is for the receiver, with choice $j \in \{1,\dots,n\}$, to input $1$ in the $j$-th 1-out-of-2 OT and $0$ elsewhere. The sender, with input $(x_1, \dots, x_n)$...
pscholl's user avatar
  • 721
8 votes
Accepted

Replay attack prevention in connectionless UDP encrypted communication

The simplest way to deal with replay attack prevention (in some narrow sense of that, where the goal is to avoid that the receiver allows the same command to be played to it several times) is to have ...
fgrieu's user avatar
  • 141k
8 votes

Are there historical examples of Occam's Razor being useful to cryptography research?

The definition you cite says that "among competing hypotheses, the one with the fewest assumptions should be selected". If you take this literally and don't understand fewer assumptions as simpler, ...
Christian Matt's user avatar
8 votes

How to thwart a cleartext message's size?

This is a complex question. There exists no formal treatment of this question and the parameters you choose will depend on your application. A method that is typically used is, like you said, to ...
dionyziz's user avatar
  • 573
8 votes
Accepted

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Do you know protocols where it is necessary to obtain several "independent" points on the same elliptic curve? One obvious place where this occurs if you are implementing a Pedersen ...
poncho's user avatar
  • 147k
7 votes
Accepted

Have I made any glaring mistakes in my use of Yao's garbled circuits?

Unfortunately, the answer to your question is yes. You have made glaring mistakes. In particular, Yao's garbled circuits are suited for two-party computation only, and here you wish to carry out a ...
Yehuda Lindell's user avatar
7 votes

What requirements would lead to the development of a new security protocol?

There are plenty of security issues which are not yet solved with widely used protocols: At the low level there are reflection/amplification attacks. DNS (and in particular DNSSEC) is known to be ...
kasperd's user avatar
  • 1,387

Only top scored, non community-wiki answers of a minimum length are eligible