0
$\begingroup$

It’s been a few years since I read anything involving crypto. I’ve come across this scheme and I wonder how secure it is:

  1. Alice generates an RSA keypair (we assume Alice is using proper random numbers).

  2. Alice sends the public key as plain text to Bob.

  3. Bob generates a 3DES session key: BA.

  4. Bob sends BA encrypted with Alice’s public key, together with a checksum of BA.

  5. Alice receives and decrypts BA using its private key.

  6. All following sensitive data is encrypted with BA and integrity is checked via the checksum.

  7. When the checksum fails communication is aborted and Alice generates a new keypair.

What are the potential (or very real) problems with this scheme?

Improve this question
$\endgroup$
1
  • $\begingroup$ The checksum does not serve any security purpose in this example, unless Alice and Bob also have a shared key to use a Message Authentication Code (MAC; basically a cryptographic checksum with a key). As poncho pointed out in his answer: Your problem is, that Alice and Bob don't know anything about each other, and there is no available PKI for authentication. None of them will ever know, if they are talking to someone called "Alice", "Bob" or "Eve". $\endgroup$
    – tylo
    Commented Dec 15, 2014 at 12:46

1 Answer 1

Reset to default
2
$\begingroup$

One real problem is that lack of authentication between the two sides. Here's one possible problem:

Alice generates an RSA keypair (we assume Alice is using proper random numbers)

Alice sends the public key as plain text to Bob.

Eve intercepts this message, and forwards on a message to Bob with her public key

Bob generates a 3DES session key: BA

Bob sends BA encrypted with [Eve]'s public key, together with a checksum of BA

Eve intercepts this message, and decrypts it with her private key, giving her the value of BA. She then takes BA and the checksum, and encrypts it with Alice's public key, and sends that on to Alice

Alice receives and decrypts BA using its private key.

all following sensitive data is encrypted with BA and integrity is checked via the checksum.

That is, all sensitive data is encrypted by a key that Eve knows. Furthermore, she can modify anything she wants.

In general, you cannot really have secure communication unless you know who you're actually communicating with. In this case, Bob has no reason to believe that the public key he gets is from Alice, and not someone impersonating Alice.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Also, in the other direction it is even worse. There is no way Alice can tell she is talking to Bob. Eve could simply begin the protocol in his name. $\endgroup$
    – Guut Boy
    Commented Dec 12, 2014 at 14:53
  • $\begingroup$ @GuutBoy: this is quite true; however depending on the security model, Alice might not care. One real world example of this situation is Amazon; they don't care who is placing an order (the person placing the order does care that they're giving their credit card to Amazon; TLS does have the checks to make sure authentication happens in that direction). $\endgroup$
    – poncho
    Commented Dec 12, 2014 at 14:58
  • $\begingroup$ yes, in general this question suffers from not making clear what the security goal is and what assumptions can be made about the setup. E.g., if we are communicating over an authenticated channel we would not have so much trouble. $\endgroup$
    – Guut Boy
    Commented Dec 12, 2014 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.