Mutual authorization using a pre-shared key

Question

I'd like for two machines on a network to be able to prove to each other that they both have knowledge of a pre-shared secret, without revealing the secret to each other. Let's assume that all traffic over the connection between the parties, A and B, is encrypted.

Here are the steps I'm currently imagining:

1. A->B: nonce_A, hash(nonce_A || secret_key)

• B checks that they can produce the same hash using nonce_A
• even if B can produce the hash, it doesn't yet prove A knows the key (e.g.could be a replay attack)

2. B->A: nonce_B, hash(nonce_B || nonce_A || secret_key)

• A checks that they can produce the same hash using the nonces and key
• if nonce_B == nonce_A, the handshake fails
• A now knows B knows the secret key

3. A->B: hash(nonce_A || nonce_B || secret_key)

• B checks that they can produce the same hash using the nonces and key
• B now knows A knows the secret key

4. Both sides know the key!

My understanding is that this protects against replay attacks (since a fresh nonce is used each time) and also against reflection attacks (since the hash must include BOTH parties' nonces).

Are there any security issues in this approach?

(I'm also curious if there are any existing RFC or similar for doing this.)

Answer 1

First off, if you can, just use something standard like TLS-PSK which is designed to do exactly this and is hard to mess up.

If you do want to roll your own crypto, symmetric stuff is definitely the most foolproof place to start.

simplifying the protocol

Simplest protocol is:

secret key sk, A and B pick nonces N_a,N_b

• A-->B N_a
• B-->A N_b,Hash(N_a || N_b || sk || bytes("b-->a"))
• A-->B Hash(N_a || N_b || sk || bytes("a-->b"))

When deriving keys, pseudorandom values or challenge responses, just add a string to the hash that's unlikely to be reused elsewhere.

If you need to derive encryption keys, just do K_a2b=Hash(N_a || N_b || sk || bytes("K_a2b")) or similar. Adding strings to the value to be hashed is pretty standard for adding context to get different values out of a hash function or key derivation function.

A few things to keep in mind

Are you are using /dev/urandom or your platform's equivalent secure random byte source? If not, nonce values could be predictable.

If the random number generator in A or B breaks and nonces start repeating, hash comparisons can be vulnerable to a timing attack.

If you use your language's = operator to compare the hash value you receive from the peer to a value calculated locally your code will take longer to reject an answer if more bytes of the hash match. With enough timing measurements an attacker can determine the entire value. Always use something like https://docs.python.org/3/library/hmac.html#hmac.compare_digest when doing byte string comparisons in crypto code.

Alternatively, if you can't find a constant time comparison somewhere in your standard library, you can do this:

def masked_compare(a,b):
    rand=get_random_bytes(16)
    return hash(rand+a)==hash(rand+b)

It's not constant time but it doesn't allow for timing based extraction of the correct answer.