# Tag Info

1

Is there a vastly simpler way? I think so. Let the server send a reset token in the following form: (deadline, HMAC(server key, id_user || S || deadline)) That is, the server calculates an authenticator that allows id_user to change their secret from S before deadline. The key used should be only known by the server and can be changed often, since ...

0

$\;\;\;$ Probably as long as you compare securely, although you're applying $\;\;\;$ a pbkdf to what should be a uniformly random long secret key. $\;\;\;$ Don't bother computing S'; let S be a uniformly random secret key and use it instead. $\;\;\;$ To construct a reset token for a user U, set h = HMAC(S, 0 || (id,U,e) ), $\;\;\;$ set H = HMAC(S,1||h), ...

5

Yes, there are several ways in which Mallory could pretend to be Amy. One obvious way, which doesn't even involve Amy herself in any way, would be for Mallory to perform steps 1 and 2 of the protocol normally, as if he were Amy. Then, given Betty's nonce $n_b$, Mallory can start a second, parallel instance of the protocol, again pretending to be Amy, and ...

3

Yes, because Mallory can use Amy and Betty to get any encrypted nonce; Amy and Betty are oracles for Mallory. She just has to send the nonce she has to encrypt to either one of them and they perform the task for her (in another "authentication attempt", using step 1 & 2). Usually you protect against this kind of situation by performing an encryption ...

Top 50 recent answers are included