1
$\begingroup$

Some days ago I asked for a help to find and correct the problems of an authentication protocol. I closed the post because I was convinced I can correct it but, unfortunately I'm having some troubles. The "old" post is the following:

I'm dealing with this problem: establish if the following protocol is 'secure' and, if it isn't, modify it to make it secure.

I will use the subsequent notation to describe the protocol:

  • $N$ is a nonce
  • $X \longrightarrow Y: \space M$
    to indicate that $X$ sends $M$ to $Y$
  • $K_{XY}$ to indicate the symmetric key shared by $X$ and $Y$
  • and $K_{XY}(M)$ to indicate that the message $M$ has been encrypted with the symmetric key $K_{XY}$.

The protocol allows a client $C$ to authenticate itself to a server $S$ using an authentication service $A$.

$C \longrightarrow S:\space C$
$S \longrightarrow C:\space N$
$C \longrightarrow S:\space K_{CA}(N)$
$S \longrightarrow A:\space K_{SA}(C, K_{CA}(N))$
$A \longrightarrow S:\space K_{SA}(N)$

$S$ authenticates $C$ if and only if the nonce received $N$, got by the authentication service ($A$), is equal to the nonce sent to $C$.

Assuming the communication channel is not secure, an attacker (called Eve) can impersonate $C$ simply sending the message "C" and $K_{CA}(N)$ whenever $C$ tries to authenticate himself.

How to avoid impersonation and offline nonce-guessing in this case? Any suggestion? I don't want the answer to the problem, just a few tips to continue on my own. At the end, I want to say that I know how to make the protocol secure but my answer consists in completely change the protocol described above, and so I think my answer is not the most appropriate.

Recently I thought to modify the protocol as follows:

$C \longrightarrow S:\space C$
$S \longrightarrow C:\space K_{SA}(N)$
$C \longrightarrow S:\space K_{CA}(K_{SA}(N))$
$S \longrightarrow A:\space K_{SA}(C, K_{CA}(K_{SA}(N)))$
$A \longrightarrow S:\space K_{SA}(N)$

Can it work now?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

If Eve knows $C, \space N, \space K_{CA}(N)$ then she is able to impersonate $C$ just by following the protocol you described above.

If she just knows $K_{CA}(N)$ for a single $N$ then the effectiveness of the attack depends on the set wherein $N$ is picked.

But as you are supposing that the communication channel is not secure, an attacker could spy several authentication session to get a sufficient number of pairs $(N, K_{CA}(N))$ to successfully attack with high probability.

Improve this answer
$\endgroup$
12
  • $\begingroup$ Alright! Thanks @Raoul722! But how can Eve impersonate C precisely? She can send the message "C", (because it is known) and then what?? Can she ask to C to encrypt the nonce N for her? I'm not convinced of this.. p.s. forgive my English $\endgroup$
    – ssh3ll
    Commented Apr 12, 2016 at 11:21
  • $\begingroup$ @Process0 No, you said you admit that Eve knows $K_{CA}(N)$. So Eve sends $C$ then receives $N$ and then send back $K_{CA}(N)$. She exactly follows the protocol you gave. $\endgroup$
    – Raoul722
    Commented Apr 12, 2016 at 11:27
  • $\begingroup$ Alright! My problem/answer is: does C respond with the nonce encrypted if he didn't request any authentication to the server? If yes, obviously is sufficient what you said. What if he doesn't? $\endgroup$
    – ssh3ll
    Commented Apr 12, 2016 at 17:08
  • 1
    $\begingroup$ @Process0 I don't understand your question. How is it related to the scenario in which Eve tries to impersonate $C$? Anyway, it seems a good practice to not send $K_{CA}(N)$ if authentication wasn't requested. But in the case I described above, Eve could spy the authentication protocol when $C$ initiates it (so he would send the encrypted nonce). $\endgroup$
    – Raoul722
    Commented Apr 12, 2016 at 17:42
  • $\begingroup$ @Process0 The problem here is that the signature of the challenge only depends of the nonce $N$. So as soon as the same $N$ is used it is easy to impersonate $C$. To make this protocol more robust, we could introduce another contextual parameter $x$ in $K_{CA}(N,x)$ which does not appear as plaintext, known by $S$ and which would be different in an other session (date and hour for example ?). $\endgroup$
    – Raoul722
    Commented Apr 20, 2016 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.