# Tag Info

36

But i wrote and tested a script in python that does exactly the story above. Yes, obviously it can happen; however you have to be a bit careful about how you do it to actually be secure. Here's is likely what your python script does; it generates a bitstring (based on the key), and xor's the bitstring and the plaintext together, generating the ciphertext (...

10

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices. Your scheme: A->B: $c_1 = m \oplus a$ B->A: $c_2 = c_1 \oplus b$ A->B: $c_3 = c_2 \oplus a$ B computes $m = c_3 \oplus b$ an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can ...

9

The name I would use for this protocol is "broken". It is insecure. An eavesdropper gets to observe $Q_0 = P \oplus CM$, $Q_1 = Q_0 \oplus SM = P \oplus CM \oplus SM$, and $Q_2 = Q_1 \oplus CM = P \oplus SM$. Notice that we have the relation $$Q_0 \oplus Q_1 \oplus Q_2 = (P \oplus CM) \oplus (P \oplus CM \oplus SM) \oplus (P \oplus SM) = P.$$ Therefore, ...

6

If this works, depends on the encryption algorithm you use. It needs to have the special property $Enc_{K_1}(Enc_{K_2}(M)) = Enc_{K_2}(Enc_{K_1}(M))$. Most traditional encryption schemes (AES) do not have this property, the symmetric equivalent of RSA is the only one that I am aware of. EDIT: Stream cipher, if used correctly, work too.

5

I don't remember reading Shamir's original proposal, but I would strongly suspect that he never endorsed the use of XOR in the protocol; if he mentioned it at all, it was as an illustration. Instead, here is what is commonly referred to as Shamir's three pass protocol: Alice and Bob agree on a large prime $p$ (larger than any message Alice wants to send) ...

4

Would this still be a valid and comparably secure protocol as Shamir's No-Key protocol? No, it would not be secure at all. In this revised protocol, Alice sends a message $M$ to Bob, to do that, she picks a random string $A$, and sends: $$A \oplus M$$ Bob receives this, picks a random string $B$, and sends: $$B \oplus (A \oplus M) = A \oplus B \oplus M$$...

2

how will a cryptanalyst break it? Well, the most obvious way is that the cryptanalyst sees both $D$ and $E = D \times B$; he then can compute $D^{-1} \times E = D^{-1} \times D \times B = B$. Then, he sees $F$; as he now knows $B$, he can compute $F \times B^{-1} = C$. So, the strength of the system is in the 'number sequence' that maps $C$ back to the ...

2

I have a program that uses a custom algorithm to encrypt a message This algorithm is called a cipher. There are plenty well known ciphers that are considered secure. If you have a "custom cipher" then you're either using something of your own design. Using proprietary schemes is not recommended except for learning purposes. My program support multiple ...

2

Shamir's three-pass or no-key protocol is based on a public-key encryption scheme with keys $(k, K)$, encryption $E_K(m)$, and decryption $D_k(c)$, with the conjugation property that for any $K'$, $D_k(E_{K'}(E_K(m))) = E_{K'}(m)$. In other words, $D_k \circ E_{K'} \circ E_K = E_{K'}$. (Thus the group of encryption and decryption operators is abelian.) ...

1

The three-pass authentication protocol defined in ISO/IEC 9798-2 at 5.2.2. and it is defined as follows; $\text{B}$ generated random $R_B$ and sends to $\text{A}$; $$\text{B}\xrightarrow{R_B\|\text{Text1}}\text{A}$$ $\text{A}$ generated random $R_A$ and sends to $\text{B}$; \text{B} \xleftarrow{\text{TokenAB}\;=\;\text{Text3}\|eK_{AB}(R_A\|R_B\|B\|\text{...

1

how difficult is it for me to determine the key that Bob is using? This is essentially the discrete log problem; Bob's key is a value $b$, and his encryption mechanism is computing the value $P^b \bmod p$. Given $P$, $P^b \bmod p$, recover $b$ is the definition of discrete log. Actually, you get two pairs of values encrypted with Bob's key; the plaintext (...

1

I suspect that the professor is thinking of Quadratic Residuosity. A value $x$ is a quadratic residue (modulo $p$) if there exists a $y$ such that $y^2 \equiv x \pmod p$. This is important, because: For any value $x$ (and prime $p$), it's easy to determine whether it's a quadratic residue or not. If $e$ is relative prime to $p-1$, then $x^e$ is a ...

1

How many bits long should the prime modulus $M$ be in order to be secure? The modulus $M$ should be long enough to prevent discrete logarithms from being computable. As of 2015 this means 2048 bits length is fine, but for other (official) recommendations you should consult keylength.com Should the $M$ be secret? You can make $M$ secret but making it ...

1

This is very difficult, if you don't trust anyone, as Ricky Demer explains. You can have each party publish a commitment to their move. However, the main problem is that a malicious party might decide not to open their commitment. For instance, suppose Alice publishes a(non-malleable) commitment to her move, and Bob publishes a commitment to his move. ...

Only top voted, non community-wiki answers of a minimum length are eligible