Questions tagged as ['protocol-design']

Imagine that we have a protocol like this:
B -> A: R_B
A -> B: {R_B,B}_K

Goal: authenticate A to B
K: a shared key between A and B
{}_K: encrypting by K

After receiving {R_B, B}_K by B, B is able to authenticate A. But what if we have something like:
A -> C: {R_B,B}_K
C -> B: {R_B,B}_K
so in this case B will authenticate C instead of A, isn't it?

Suppose that we have the usual problem of secure communication, where each of the $I$ agents have a private signal $s_1,s_2,\dots,I$ and they wish to compute any function $f(s_1,s_1,...,s_I)=(x_1,x_2,...,x_I)$ in such a way that no party learns more than their input $s_i$ and output $x_i$.

Although I have seen many cryptographic protocols designed to be secure and in order to solve the problem th ...

Lattice-based cryptography is being used for several primitives and applications.

I know there are newer works for PIR, PSI, ORAM that have seen tremendous improvements due to FHE. In some cases, FHE is the only tool that can be used for practical constructions of these primitives.

My question is which other such primitives have seen improvements (in performance or security)?

TLS is the standard cryptography protocol on the internet, and many websites use it to secure their communications. However, for personal use, most people use other protocols like PGP, instead of using TLS keys/certificates.

There doesn't seem to be any reason to not use TLS for these things, or at least the encryption/signing part. The transport part of TLS isn't always needed, since people have ...

In Rabin and Ben-Or, their basic assumption is that each participant can broadcast a message to all other participants and that each pair of participants can communicate secretly. Hence, they design a protocol of communication that is called verifiable secret sharing protocol (VSSP), and show that any multiparty protocol, or game with incomplete information, can be achieved if a majority of the play ...

Is there a strict proof for secure multiparty protocols? What do they serve? I mean some have shown the existence for such protocols, but can I use them in order to substitute a mediator in game theory who sends messages to the players? How can I model a process of $3$ or $4$ players who can play a game wihtout the central mediator and they exchange infroamtion with each other?

I am searching for a simle model that can simulate the following procedure.

Suppose that $i$ and $j$ are two agents that each one obtains her state dependets signal $s_i(\omega)$ and $s_j(\omega)$. After observing their own signals with probability $1$, they do not know anything about the signal that the other agent has, but they do know the common prior $\pi$ about the signals, s.t. $\pi:\Omega\to \D ...

There is a field of exchanging information that combines cryptography and game theory. I am interested in understanding this field, but it's a little complex for me. To begin with there is a paper of Barany which shows that instead of having a centralized mechanism of information where a mediator can inform the players about what strategy to follow, the players instead can replace the mediator w ...

Are there any different secret sharing schemes instead of Shamir's Secret Sharing , that is not based in polynomial interpolation over finite fields? Or is it the most efficient than the others?

I have a really simple ProVerif problem. My current proverif code looks like this:

(* communication channel *)
free c:channel.

(* trying to create a mac scheme *)
type mkey.
fun mac (bitstring , mkey): bitstring.

(* Symmetric encryption *)

type skey.
type coins.

fun internal_senc(bitstring , skey , coins): bitstring.

reduc forall m:bitstring , k:skey , r:coins;
   sdec(internal_senc(m,k,r),k)  ...

I am looking for a hash methodology that allows previous hashes to provide "hints" to find same or nearby hashes:

1. if I expect to find a message $M = P + U$ consisting of private $P$ and public $U$ that hashes to some $H \lt N$ on average after $T = S/N$ tries, where $S$ is size of hash space (ie a cryptographically secure hash that can only be brute-forced)
2. then there is a way to find another $P'$ ...

It should be a secure two party protocol against malicious adversary.

P1's input is X in Zp* (p is a prime number); P2's input is nothing. P1's output is rX+r'. r,r' are random numbers from Zp* P2' output is r and r'.

Is there any efficent protocol to realize this functionality other than by using homomorphic encrytion? If only HE solves this problem, which is the most efficent one?

Thanks for help!

As far as I know Whatsapp ,Signal and co in their group channels first used the already existing peer-to-peer channels between the participants and protected using the Double Ratchet Algorithm to exchange the key material for group communication. The Matrix Olm Library implements this principle using its Megolm Ratchet for advancing the sender keys for each participant. Each group member creates i ...

I'm a crypto newbie and hoping to get pointed in the right direction. I've seen some related questions like this but none that satisfy my requirements.

Let's say Jane's Forum is a large community, and every member of Jane's Forum has a public/private keypair. The public key is associated with their profile and visible to anyone.

Bob's Backpack Shop is willing to send a free backpack to every memb ...

When using openssl cms -encrypt -pwri_password, it follows the process described in RFC 3211, which passes the user-provided password into a KDF, but then, rather than using the output of that KDF to encrypt the content, it instead uses that key as a KEK to encrypt the actual content-encryption key (CEK), which is then bundled alongside the content:

SEQUENCE (2 elem)
  OBJECT IDENTIFIER 1.2.840.113549.1 ...

In JKSS12, a proof for the handshake in TLS-DHE 1.2 is given, assuming (among other things) the PRF-ODH hypothesis on the PRF used to derive keys.

It is also stated that, if TLS 1.2 was to be modified to follow more closely the $\Sigma_0$ protocol from Canetti-Krawczyk; this protocol could be provably secure under a (weaker) DDH assumption instead of the PRF-ODH assumption (as it is the case for I ...

Consider the following scenario. Alice picks a number A; Bob picks a number B. Both A and B belong to a relatively small set X (by small I mean that X can be easily looped through: for intuition sake, imagine X to be the size of a deck of cards). I would like Alice and Bob to engage in a protocol that tells both if A = B. If A != B, then Alice should have no further information about B, and Bob should h ...

I've been looking at ristretto.group, and its really cool.

I understand for some protocols we need curve points to behave as if they were from a prime order curve.

I have a few questions on this,

1. Do we call curves without prime order "composite"?
2. Why do some protocols demand prime order from the underlying curve?
3. Why isn't the fact that we work inside a prime order subgroup anyway good enough in th ...

I've been conducting some research into general-purpose MPC protocols and have been unable to pinpoint the exact security offered by the BMR protocol. The reference I've been using for the majority of my research is “A pragmatic introduction to secure multi-party computation" by Evans et al., which states that BMR is able to achieve security "against any $t < n$ number of corruptions among ...

The TLS 1.3 RFC, section 7.1 lists this as the last part of the key schedule:

https://datatracker.ietf.org/doc/html/rfc8446#section-7.1

            ...
   0 -> HKDF-Extract = Master Secret
             |
             +-----> Derive-Secret(., "c ap traffic",
             |                     ClientHello...server Finished)
             |                     = client_application_traffic_secret_0
     ...

In key agreement (or key exchange) protocols, is used signature for authentication. Suppose that key exchange protocols execute on elliptic curve. The initiator of protocol must sends signature of his message with main message. What happen if the curve used in key agreement protocol also used in signature inside of protocol?

For example in Diffie-Hellman key exchange over curve, Alice sends $aP$ and  ...