130 reputation
5
bio website
location
age
visits member for 9 months
seen Jun 18 at 0:56

Oct
25
accepted Please punch holes in this authentication scheme
Oct
3
comment Please punch holes in this authentication scheme
All the man in the middle in your first scenario managed to do is reduce the TTL of the packets by 1 and add a bit of latency. Other than that he failed to authenticate himself to either parties and failed to reach the actual info that will be traded after this authentication process
Oct
3
comment Please punch holes in this authentication scheme
Another scenario where your second part fails:imgur.com/xPElU2Y
Oct
3
awarded  Commentator
Oct
3
comment Please punch holes in this authentication scheme
Regarding your second scenario as to Charlie giving out his own nonce . hre is why that won't work: imgur.com/iDLoQa9
Oct
3
comment Please punch holes in this authentication scheme
If i were to suggest that after successful authentication as described above in my post ... Alice sends bob a pre-master secret encrypted in Bobs public key . then both of them use this premaster to calculate master secret.. and communicate using that key . Charlie is left with nothing but Ra and Rb and a whole lot of nothing as he hasn't authenticated himself to either party
Oct
3
comment Please punch holes in this authentication scheme
regarding your first part: In that scenario Charlie is merely acting like a server relaying the information . This isn't a MITM attack as the goal there is to get the information being traded after authentication. Now he hasn't authenticated himself to either Alice or Bob ... He has merely relayed info. All he has is Ra and Rb ... its much like SSL hello . Client_hello random and Server_hello random are known to anyone looking into the connection... but both these hello values are used later in addition to pre master secret to get a master secret
Oct
3
comment Please punch holes in this authentication scheme
Lets say RSA encryption scheme with proper padding. However once again if you are going to point out a flaw in encryption, its not a valid answer to my posed question .. Encryption schemes can always be changed to stronger ones .. what I am after is wether you are able to attck the logic behind this authentication scheme
Oct
3
awarded  Supporter
Oct
3
comment Please punch holes in this authentication scheme
for the purpose of this exercise please assume that the encryption is very strong. and I am not using simple rsa encryption as you stated The question i am asking is : is this authentication scheme solid or are there attacks it could be vulnerable to? Attacks being : masquerade , modification , man-in-middle , replay etc. attack on the encryption is very general - it doesn't negate the logic behind this authentication. One can always change the encryption scheme to a stronger one. But changing the logic behind authentication is quite another matter
Oct
3
revised Please punch holes in this authentication scheme
added 1 characters in body
Oct
3
comment Please punch holes in this authentication scheme
Yes public keys are known
Oct
3
awarded  Editor
Oct
3
revised Please punch holes in this authentication scheme
added 278 characters in body
Oct
3
asked Please punch holes in this authentication scheme
Oct
3
awarded  Scholar
Oct
3
accepted Can an RSA private key have several public keys?
Oct
3
awarded  Student
Oct
3
comment Can an RSA private key have several public keys?
You are right .. thanks a lot
Oct
3
comment Can an RSA private key have several public keys?
I didn't know that was possible ... so adding ϕ(N) to (n,e) gives another public key which is paired with (n,d) private key. I wasn't even aware this was possible .. But thanks