3
$\begingroup$

Is MITM attack theoretically possible after public/private key pair exchange is done successfully? Say Alice and Bob have genuine public keys of each other. Is MITM possible further during the authentication phase between Alice and Bob?

Please find the protocol below:

Alice and Bob have key pairs. Assume Alice and Bob have the correct public key of the other party. (i.e. key exchange is already done successfully.)

Now,

Ia and Ib are the identities of Alice and Bob.
pu_a and pu_b are the public keys of Alice and Bob.
pr_a and pr_b are the private keys of Alice and Bob
No_a and No_a’ are the nonce generated by Alice; No_b is the nonce generated by Bob
Sig_a and Sig_b are the signatures generated by Alice and Bob respectively by encrypting the message content with their private key:
Sig_a = Encpr_a(No_a’, No_b, Ib); Sig_b = Encpr_b(No_b, No_a, Ia)
Alice verifies Bob by decrypting Sig_b with pu_b, and checking if No_a is there; while Bob verifies Alice in the same way.

Improve this question
$\endgroup$
6
  • 1
    $\begingroup$ Can you clarify which protocol you mean? In general: If Alice and bob have the public key of the other side, then authentication is possible. But it depends on the protocol if it is secure against MITM. $\endgroup$
    – tylo
    Mar 6, 2014 at 10:06
  • $\begingroup$ Related to this other question $\endgroup$
    – fgrieu ♦
    Mar 6, 2014 at 10:35
  • $\begingroup$ @tylo I have updated the question with protocol $\endgroup$
    – user40349
    Mar 6, 2014 at 19:17
  • 1
    $\begingroup$ The main issue is that you are trying have Alice and Bob generate Sig_a and $\hspace{1.6 in}$ Sig_b by "encrypting the message content with their private key" rather than by $\hspace{1.3 in}$ "signing the message content with their private key". $\:$ $\endgroup$
    – user991
    Mar 6, 2014 at 22:09
  • $\begingroup$ @RickyDemer Can you please elaborate? What is the exact difference? $\endgroup$
    – user40349
    Mar 6, 2014 at 22:44

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.