Questions tagged [man-in-the-middle]
A man-in-the-middle (MITM) attack is an active attack where the attacker is able to interpose himself between the sender and receiver. The attacker may monitor and/or modify some or all of the messages sent between the two endpoints.
22
questions with no upvoted or accepted answers
14
votes
0
answers
894
views
The backdoor of Telegram on Diffie-Hellman Key Exchange and possibly other examples?
Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible.
Standard DHKE
The simple protocol on the multiplicative ...
- 48.5k
5
votes
0
answers
174
views
Multilinear trapdoor commitments secure against concurrent man-in-the-middle attacks
I am trying to understand how to apply a multi-trapdoor commitment described by Gennaro and what makes them secure against a concurrent MiM attack.
There are two ways to construct a multi-trapdoor ...
- 491
3
votes
0
answers
358
views
TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message
I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
- 31
3
votes
0
answers
174
views
Is the "Pico" alternative to passwords vulnerable to man-in-the-middle?
Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting.
Regarding the paper, ...
- 519
3
votes
0
answers
196
views
Is MITM possible after key exchange phase done successfully in RSA?
Is MITM attack theoretically possible after public/private key pair exchange is done successfully? Say Alice and Bob have genuine public keys of each other. Is MITM possible further during the ...
- 69
2
votes
0
answers
94
views
Questions about TLS 1.3 inspection with commercial middleboxes
i'm trying to learn how commercial (for example PaloAlto or Fortigate) middleboxes intercept and decrypt TLS 1.3 traffic. To do that I started observing the TLS traffic between the client, middlebox ...
- 21
2
votes
0
answers
478
views
MITM Attack on Key Exchange Protocols
I was doing research on this attack and I am wondering, why is Diffie-Hellman always
associated with such an attack? Aren't other public key cryptography schemes vulnerable
to the same kind of ...
- 89
2
votes
0
answers
221
views
Is it possible to perform one-way Diffie-Hellman MITM?
Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
- 363
1
vote
0
answers
40
views
Dealing with MITM attack in e-voting systems
I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers.
-Does anyone knows ...
- 150
1
vote
0
answers
34
views
Can attacker eavesdrop on the user credentials during WPA2 (802.1X) handshake?
In a WPA2 (802.1X) scenario, there are 3 entities -> Supplicant (client), Authenticator (router) and Authentication server (Radius server). Radius server performs the authentication process and, as ...
- 11
1
vote
0
answers
36
views
Proof that exchanged variable was not modified with MITM
If I understand correctly, the core of man in the middle attack is in being able to replace an exchanged variable (public key) with another.
Hence to detect a MITM one needs to check if the exchanged ...
- 111
1
vote
0
answers
93
views
attacks and defenses on multi party Diffie-Hellman protocol
I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property.
However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...
- 11
1
vote
0
answers
205
views
Security of the Needham-Schroeder public key protocol after a minor adjustment
I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer:
We have the Needham Schroeder Public Key Protocol:...
- 111
1
vote
0
answers
1k
views
Diffie-Hellman combined with DSA/RSA
we have learned Diffie-Hellman, RSA and DSA (Digital Signature Algorithm) in university.
Because DH is vulnerable of Man-in-the-Middle we had the task to program the DH combined with RSA to protect ...
- 111
1
vote
0
answers
149
views
Could MITM securely identify identity?
Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol).
From crypto ...
- 153
0
votes
0
answers
27
views
How two secure elements can safely authenticate each other without a third party?
Assume there are multiple secure elements, and also multiple man-in-the-middle or malwares. How can any two secure elements authenticate each other without a third party and hard coding something in ...
- 103
0
votes
0
answers
33
views
How can I impersonate Bob without creating a new session
Good morning,
I've been struggling with this protocol for the last few days and I'm out of ideas now. The goal is to impersonate Bob by just modifying or dropping packages. The attacker(me) is a Proxy ...
- 1
0
votes
0
answers
231
views
Diffie-Hellman man-in-the-middle attack
Diffie-Hellman Key Exchange Basic Protocol:
Let G be a cyclic group of order $n$ and generator $g$.
Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$.
...
- 325
0
votes
0
answers
40
views
Server stored, encypted messaging app
For my personal research, I have to create a messaging app, but security is only important part of application, security from MITM (man in the middle attack), at device end, and at server level. (note:...
- 101
0
votes
0
answers
225
views
How does DHE-RSA work and why is PFS guaranteed?
How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.
- 153
0
votes
0
answers
161
views
How to decrypt plain text x using man in the middle attack
Suppose Alice want to share a plain text $x = 5$ to Bob; using RSA, DHKE, and El-Gamal.
My question is if Man-in-the-middle attack is applied then weather oscar can compute/decrypt plain text in all ...
- 101
0
votes
1
answer
339
views
Needham–Schroeder fix by adding opponent's identity to the first message
Recap: Needham–Schroeder is as follows:
$A \rightarrow B : \{A, N_a\}_{pk_B}$
$B \rightarrow A : \{N_a, N_b\}_{pk_A}$
$A \rightarrow B : \{N_b\}_{pk_B}$
Then, there is a MITM attack by Lowe ...
- 1