Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

If we want to establish secret symmetric key between two entities, why use Needham-Schroeder if we have Diffie-Hellman? With DH we don't need to have any trusted party, so what's the point of NS?

share|improve this question
    
Which Needham-Schroeder are you referring to? The symmetric or the asymmetric? But I'd assume the main reason for choosing either of them is historical. I doubt anybody would design a new protocol based on NS. –  CodesInChaos Jan 12 at 16:13
    
@CodesInChaos Where symmetric key is established between A and B with a help of a third party. –  evening Jan 12 at 16:16
3  
Needham-Schroeder was published in 1978, Diffie-Hellman in 1976. So DH was new and unproven back then, so based a protocol purely on symmetrical primitives might have been a good idea. Now DH is over 30 years old and has seen a lot of analysis, so it's far more trustworthy now. CPU power has grown a lot as well, which is important since asymmetric crypto is more expensive than symmetric crypto. –  CodesInChaos Jan 12 at 16:19
add comment

1 Answer

up vote 2 down vote accepted

Both Needham-Schroeder (N-S) and Diffie-Hellman (D-H) are one of the earliest proposed key exchange protocols and thus they are usually used as classical textbook examples. However, the originally proposed protocols have some flaws. The N-S Symmetric Key Protocol is vulnerable to a replay attack, the N-S Public-Key Protocol is vulnerable to a man-in-the-middle attack and the D-H is also vulnerable to a man-in-the-middle attack.

Therefore, improved schemes such as Kerberos (for N-S) and the Station-to-Station (STS) protocol (for D-H) were proposed. The N-S makes use of a trusted server for authentication while the improved D-H or STS protocol uses public key certificates for authentication. With STS, we are still making use of a trusted party which is the Certificate Authority for authentication. Even though the web of trust concept (in PGP) may be used, it may not be scalable.

So the main differences between the two protocols would be:

  1. To trust a single trusted party which you can maintain yourself or to trust the public Certificate Authorities.
  2. To depend on the security of the underlying encryption schemes (such as AES for Kerberos) or to depend on the assumption of the discrete logarithm problem (for D-H).
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.