|
In Zero Knowledge auth schemes the public DH factor of each peer is encrypted with a potentially weak pre-shared secret and the resulting ciphertexts are exchanged over an insecure channel. Why is no attack on the weak secret possible? I mean the messages can be sniffed and with an offline dictionary attack or simply bruteforce it should be possible to reveal the secret. |
|||
|
|
|
I believe that you are talking about one specific version of EKE, which is one of several known Password authenticated key agreement methods (which is the general category of methods that do a key agreement with the property that someone listening into the exchange can't learn anything, and an attacker that poses as one of the two sides can learn no more from a single exchange than whether a specific password was correct). Now, with that background, here is the answer to your question. With DH-based EKE, yes, both sides exchange their $E_k( g^x )$ and $E_k( g^y)$ values, and yes, the attacker can decrypt both values with a potential password, giving $g^x$ and $g^y$ if his guess is correct, and $D_{k'}(E_k(g^x))$ and $D_{k'}(E_k(g^y))$ if his guess is incorrect. However, EKE uses a special encryption method such that $D_{k'}(E_k(g^x))$ and $D_{k'}(E_k(g^y))$ are also valid public values; possibly $g^z$ and $g^w$, for some $z$ and $w$. This prevents the attacker from learning anything; he cannot test if a specific $g^x$ and $g^y$ generates the correct shared secret (because the DH problem is hard), and checking if they are valid public value tells him nothing (because they're all valid). So, while the attacker can make a list of potential decryptions, there's nothing that distinguishes the correct one from all the wrong ones. |
||||
|
|
