60

These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is particularly true in commodity parts, such as cell phones. When you make wireless ICs, you have two clocks in the system at a minimum, which are the carrier frequency ...


30

No, it is not a good idea to hash phone numbers. There are only a limited number of phone numbers, so it is pretty easy for an adversary to try and hash all of them. Then you can simply compare the hash of each with the stored hash. Generally you don't have to deal with all telephone numbers, only a subsection of phone numbers anyway (for a specific country ...


12

It is always a bad idea to hash data that has a limited set of length or characters. A phone number in Germany for example has normally no more than 12 digits. The first digit is always a 0 and the vast majority of numbers is longer as 3 digits, as those are normally reserved for emergency services. This effectively leaves us with 10^11-10^3 possible ...


10

In the general sense, The problem is known as the small input space on the hash functions, and in short simple hashing won't be secure. If you hash data ( here a phone number) and an attacker tries to find an input value that matches the hash value is called the pre-image attack. In a secure Cryptographic hash functions pre-image attack requires $\mathcal{O}(...


7

As an alternative, you can salt the phone numbers to avoid pre-calculation attacks. A known salt will help against an adversary who has already done a hash of all possible phone numbers but just adds one order of magnitude of work (the adversary just has to recalculate all the hashs with the salted phone numbers). If you can keep the salt private raises the ...


3

What would be a good choice for the hash type? Whatever works best for you. As long as the hash is considered secure, the difference comes down to performance. SHA-256 and SHA-512 are both traditional and safe choices recommended e.g. by NIST. You can't really go wrong with either of those. Which one is faster depends on your hardware. (SHA-384 is ...


3

My solution is based on Pedersen commitments; in this scheme, we work in a prime-sized ($p$) subfield of some group, perhaps $\mathbb{Z}_{kp+1}$, so some prime $kp+1$; where both $p$ and $kp+1$ are large enough to make the discrete log problem intractible. We have two generators of this subgroup $g$ and $h$, and it is important that no one knows the ...


3

You might be somewhat confused by the term 'record'. In TLS, a data to be encrypted is divided into a series of fragments; each fragment is encrypted as a record, with each record being encrypted and integrity protected independently [1]. Such a record can hold up to 16kbytes of data. This 'record' is standard TLS terminology and is what you are referring ...


3

Promoting my comment to an answer: Encryption hides information from someone who doesn't know the decryption key. In your case, $P_2$ knows the decryption key, and can therefore learn $x$. This is really no different than sending $x$ in the clear to $P_2$. Note that this is the strange example from the book that is secure in the malicious setting but not ...


3

In my opinion this may open door to a lot of attacks the attacker can use. Actually, public key signatures are designed to be used securely like this. When we design a signature method, we assume that the attacker can ask for a large number of messages of his choosing to be signed, and still try to ensure that the attacker cannot generate a valid signature ...


2

I think this simply comes down to the definition of Unix time, which is given in the Wikipedia article: Unix time (also known as POSIX time[1][2] or UNIX Epoch time[3]) is a system for describing a point in time. It is the number of seconds that have elapsed since 00:00:00 Thursday, 1 January 1970,[2] Coordinated Universal Time (UTC), minus leap seconds. ...


2

If you have to implement or design and implement your own protocol then using well established libraries is generally the way to do it. JavaScript is a large eco-system. For such ecosystems it is not adviced to implement your own (partial) "hazardous materials" library for the low level functionality that you require. It is much more likely that there is ...


2

It depends on the scenario. My intuition says that typically it would be used. In particular, the transcript that is generated during simulation includes the randomness of the corrupted party/parties and their incoming messages. Given this, it is possible to compute the outgoing messages sent by the corrupted parties. Since these messages must somehow embed ...


2

Should I always call the key used for verification "public key" even on those settings? Usually it is a public key, or at least it is called that in the key pair generation procedure of the cryptosystem that is used. Public key is in that case a more generic term - it may not be decided for what the key will be used after all. Similarly, cryptographic API'...


2

As for the first question: as long as you create a signature over some or all data that is required and unique in the key establishment protocol then you should get entity authentication for that session. If you sign entire messages then you may be able to avoid some attacks on the message format itself. Some protocols deliberately include the public key ...


2

Dining cryptographer networks are information theoretically secure to the anonymity set size. This is ultimately a traffic analysis question; however, it's very closely related to, and somewhat hard to delineate from, cryptography. In practice a DC-net is, in numerous ways, a lot like a one time pad. Primarily useful in theory and some niche cases. Anonymity ...


2

Aren't they delievering by the network the same as the encypted messages? No. At least not in the plain. What doing it end-to-end encrypted? Try to search for the key agreement protocol (e. g. Diffie-Hellman ) and asymmetric encryption (e.g. RSA ). The "asymmetric" encryption allows sending encrypted and signed messages without sharing the private (...


2

Is this protocol design secure? See below. What would be the advantage to use HMAC (or any other MAC) instead of AES encryption? HMAC was originally proposed as a construct that turns a Merkle-Damgaard hash function based on compression functions built from block ciphers, into a message authentication code. Although there's no decryption in HMAC, you ...


2

A paper was published in 2015 describing a scheme called Anonize to do just that. It appears to be constructed around a specially designed Non-Interactive Zero-Knowledge Proof of Knowledge (NIZKPoK) protocol used by clients. First, a registration is made, whereby a client sends a commitment to a seed of a pseudo-random function. Sent back to it by the ...


2

An alternative is to encrypt the phone number as proposed in the previous answers. For example, Mobile connect identity service encrypts the MSISDN (aka phone number) using a specific algorithm. This GSMA specification gives information about decoding the payload : Following are the example of encrypted MSISDN passed: with URL encoding: login_hint=...


1

But is there a way without a trusted third party? Sure, one of the simpler solutions is probably to use Yao's Garbled Circuit Protocol to compute the AND gate. Note that actually using the original protocol will do here because the modern speed-ups are only important for large numbers of ANDs and malicious security would also be somewhat useless as a ...


1

With this zero knowledge proof, the prover attempts to prove that he knows an opening of the commitment. The obvious way to approach this is to show that, if the prover is able to complete the protocol for two different challenges, he is able to construct an opening of the commitment (and hence he actually knows what he is attempting to prove knowledge of). ...


1

Yes, the attacker does have the ability to make messages to appear to be from SenderA. In the end, the crypto_box functionality relies on a MAC, not a signature. That means that it depends on a shared secret key, rather than a private key for message authenticity. As explicitly stated by the protocol, this allows any message to be signed if you possess just ...


1

How big is the secret key that defines a community? If it is trivial, say a number between 1-100, then an attacker can easily calculate 100.000 hashes to know in which community each user is. If the secret s is long, say 64 bytes, then I don't see the usefulness to generate 1000 hashes for each option. Then it would be best to just send your hash H(s+n), ...


1

Assuming that it's sufficient to catch a cheating player after the round is over, this seems trivial to implement using only bit commitments. Let $\mathsf{Com}$ be a bit commitment scheme. At the beginning of each round: Each player $P_i$ chooses a random index $j\gets \{1,2,3,4\}$, computes $$ c_i^k := \begin{cases}\mathsf{Com}(0)&\text{if } k\neq j\...


1

You can start your learning https://www.coursera.org/learn/crypto/home/welcome An excellent course to start with all about Symmetric/Asymmetric encryption/TLS/MAC etc. A free ebook is also available https://crypto.stanford.edu/~dabo/cryptobook/BonehShoup_0_4.pdf https://www.schneier.com/books/applied_cryptography/


1

It is doable. Assuming all parties are semi-honest and you have a public key encryption scheme allows threshold key generation and threshold decryption, as well as re-encryption, that is: $keyGen(\lambda,m)$: given the security parameter $\lambda$ and an integer $m$, output a public key $pk$ and $m$ shares of the secret key, each share is given to a player (...


1

1. Before Bob computes $S_B(\mathit{B_K, A_K})$ does he hash $B_K$ and $A_K$ using $SHA256$ for example so Alice can hash them herself and compare the hashes? Generally the signature generation function already includes a hash operation (which might be SHA-256) so requiring a separate hashing step isn't required; it should be configured for the ...


1

Unless the key derivation function you use is specifically designed to exploit related-key attacks, then no, it will not result in a vulnerable related-key pair. It is true that XSalsa20 is not designed with related-key attack resistance in mind, but a key put through any decent KDF will not lead to exploitable weakness. This answer explains the kind of ...


1

This is not a correct dynamic accumulator scheme. Your scheme assumes that the following holds: if $a,b$ are primes and $0< a,b < p$, then $$(a,b)=1 \implies (ab\mod p,a)\neq1. $$ If this is true, then your scheme is correct, however this is not the case. Toy example: $p=11,a=5,b=7$. Since $ab \mod 11=35 \mod 11=2,$ therefore $A=2$. Now, it is ...


Only top voted, non community-wiki answers of a minimum length are eligible