# Tag Info

0

Suppose the server does not check the Client Finished value. This means that the MITM could change some handshake messages and the server would not know this (e.g., downgrade, as you mentioned). So, you could use this to fool a server that doesn't check the Client Finished value. If n bits are checked by the server, you have a 1/2^n chance of getting ...

1

Saying that ECDH does not do authentication is not entirely accurate. If you use ECDH with static, known public keys and both sides prove knowledge of the shared secret, then you do get authentication. However, with ephemeral keys you need some way to authenticate the exchange of public keys. That could be ECDSA or it could be any other authentication. So ...

2

The reason Lamport's scheme is secure against a passive attacker is that even if they see $H^{n-1}(p)$ for a given $n$, the server would require the preimage of that hash, $H^{n-2}(p)$ on the next login. The active attack, in comparison, allows Trudy to find an earlier iteration than the server is expecting. That allows calculating several login hashes by ...

Top 50 recent answers are included