Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to secure a communications channel against both passive (sniffing) and active (injecting / MitM) attackers without either legitimate party knowing any pre-shared information?

I know that this isn't possible using "traditional" asymmetric crypto, since an active attacker could create its own public keys and relay the information on both sides. A trusted third party implies pre-shared information, since at least one party must provide their public key to the third party.

Are there any schemes that make this viable, or is it completely impossible?

Update: By "zero information", I mean other than the "address" of the other person, e.g. their computer's IP address, or even their mailing address.

share|improve this question
It's obviously impossible. You need to know at least something. For example you could have the public key double as address. – CodesInChaos Jul 16 '12 at 9:44
Is IBE (where there's a third party that provides to each party the system parameters and the private key corresponding to that party's address, but no one need give a public key to a third party) also out of bounds? – poncho Jul 16 '12 at 12:47
@poncho The only thing the two parties have pre-shared is their locations, e.g. an IP address. – Polynomial Jul 16 '12 at 12:49
up vote 3 down vote accepted

Yes. Simply send the data in the clear.

Passive attacks are not possible. For a passive attack to work, the data must be intercepted by someone other than the intended recipient. But by your definition of "pre-shared information" the existence of an intended recipient would count as "pre-shared information" (since both sides would know this). So anyone who receives the traffic is just as much the recipient as anyone else.

Active attacks are not possible. Active attacks involve someone other than the person the other side expects to be sending the data to be able to influence the data or receive the data. Since neither side has any expectations as to who is originating or receiving the data (such an expectation would be "pre-shared information" since both sides would need to have it), such an attack cannot, by definition, exist.

The idea of a "secure channel" to nobody in particular simply isn't coherent. And if both sides knew who they wanted to speak to or hear from, that would be "pre-shared information" by your expansive definition.

So this is not a coherent thing to want.

Consider two people considering such a scheme, Alice and Bill. If Bill knows who Bill is, Alice cannot know who Bill is as that would be pre-shared information. If Alice knows who Alice is, then Bill cannot know who Alice is, as that would be pre-shared information. Thus Bill could not distinguish a secure link to Alice from a secure link to Fred. To Bill, either is just as good. So it matters not if Fred intercepts or distorts the data. Fred is no less the intended recipient.

Update: If literally all you know is the address, then nothing could provide any more security than simply sending to that address. Since the address is all you know, whoever can receive something sent to that address is the intended recipient, right? And it doesn't matter what that person receives, since you are no different from an attacker, they wouldn't care whether they received what you sent or what someone else sent -- they don't know who you are.

share|improve this answer
Certificate authorities, as I mentioned, count as pre-shared information. They have to give their certificate to a trusted third party. – Polynomial Jul 16 '12 at 8:35
Ahh, okay, I'll fix my answer. – David Schwartz Jul 16 '12 at 8:37
I think your edit went too far the other way. Alice knows Bob, Bob knows Alice, let's say by IP address on a LAN. I'm not sure whether you misunderstood me, or if you're just being pedantic with the aim of making a point. – Polynomial Jul 16 '12 at 8:48
If all Bob knows is Alice's IP address, then the best Bob can do is communicate with that IP address. Whoever gets it is the intended recipient, since that person meets the only criterion Bob knows or cares about. (Unless you're asking a totally different question like "Can someone prove they are 'entitled' to a particular IP address?" If that's the case, you should ask a more specific question.) – David Schwartz Jul 16 '12 at 9:23

Yes, one needs a manual channel. $\:$ That is, some channel which allows
the parties to compare a short string held by each of them for equality.

share|improve this answer
You should post a summary of your source. Your post is utterly useless without the linked material. – CodesInChaos Jul 16 '12 at 9:53
I'll concede that it wasn't very helpful without the linked material, but I say it was far from "utterly useless" without the linked material. $\:$ It provided the term "manual channel", which is the term that's needed to look up further information on this subject. $\;\;$ – Ricky Demer Jul 16 '12 at 10:01
I have to agree with @CodeInChaos here. I don't even have software installed to read PPT files. – Polynomial Jul 16 '12 at 12:49
@RickyDemer.. ok, but that's just being overly picky on his words... – Pacerier Apr 4 '14 at 23:50

No. Consider using encryption to protect against a passive adversary. In this case, encryption needs to hold from the sender to the receiver. The sender can verify that the message leaves them encrypted but they have no guarantee that it is not decrypted before the receiver unless if they can authenticate the receiver. Authentication requires knowledge of some secret which would constitute preshared information in your definition.

The closest I believe you could come to a secure channel in this setting would be what is called Secure Message Transmission Protocols. The basic idea is that the sender would split up the message into shares (say 10 shares) such that some threshold (7 shares) are required to reconstruct the message. The sender would send the 10 shares over different channels. This is not secure against an adversary that is one all channels (which your question implies, which is why the answer is still likely "no") but if the adversary is on 6 or less, you get passive security. Active security is possible but the adversary is bounded to less than a third of the channels (byzantine agreement). Anyways, you could also argue that knowing the algorithm to reconstruct the message from the shares is pre-shared information (although not a secret).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.