Say $B$ is a server and $A$ is a client who wants to login to the server, by proving herself to $B$. In challenge-response authentication protocols, $B$ sends challenge to $A$ and $A$ replies with response.

Here, I think all kinds of challenge-response authentication protocols are vulnerable to Man-in-the-Middle attack because if there is $E$ (who wants to login to the server, impersonating $A$) between $A$ and $B$ who relays the challenge(sent by $B$) to $A$, relays the response(sent by $A$) to $B$ and then gains access.

Is this Man-in-the-Middle attack possible? It seems to be safe if $A$ and $B$ exchange encrypted messages afterward, but it does not seem to be safe to give access to the entity authenticated using challenge-response. enter image description here

  • $\begingroup$ Challenge response is usually used to derive a shared key that secures future communications. Alice and Bob derive a key which Eve does not know and so while access has been granted, it's only been granted to Alice who has the correct key needed to authenticate future messages. $\endgroup$ Commented Jun 7, 2023 at 15:59
  • $\begingroup$ The question highlights the subtlety in defining authentication and relationship to session key establishment. I'll write a fuller answer later. But first, note that on its own the scenario is not an attack. Eve is just playing the role of a ethernet link between A and B. However, the consequences will indeed depend on what happens after. Another thing, the issue isn't simply mitigated with encryption. Indeed if the parties would just do a DH exchange after the authentication, the security isn't increased in any meaningful way. $\endgroup$ Commented Jun 7, 2023 at 22:10
  • $\begingroup$ That is why authenticated key exchange are carefully design to guarantee both entity authentication and session key authentication $\endgroup$ Commented Jun 7, 2023 at 22:11
  • $\begingroup$ @RichardThiessen I think, then, the protocol is not truly an 'authentication'. I think what Bob come to know in the protocol is that "There exists Alice somewhere, but I do not certain that I am directly talking to her." And as you said, after they derive a shared key, they can authenticate 'messages'. Is this right? I think I am not clear about the meaning of authentication. $\endgroup$ Commented Jun 8, 2023 at 1:04
  • 1
    $\begingroup$ @LeeSeungwoo, one way to clarify all of this is the following: the challenge response protocol is an identification protocol. The only security guarantee is that it should only succeed with the help of the legitimate user. The protocol is not meant to establish a secure session. "Eve can come again to make use of the access" only if the application makes the mistakenly thinks that there's a secure session established after this protocol. This issue is solved using a secure authenticated key exchange to establish a secure session and authenticate the parti(es). $\endgroup$ Commented Jun 9, 2023 at 14:01


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.