1
$\begingroup$

What does it mean that a protocol realizes "strong mutual authentication"? And what does it mean that a protocol realizes "weak mutual authentication"? Can you define them formally ?

I have found a definition for "strong mutual authentication" here on slide 36 (not formal):

Strong mutual authentication requires not only matching conversation records: all principals’ records of the content and the order of all messages must coincide, but also matching views of the intent: all principals’ views of the purported sources and the intended destinations of all messages should also coincide.

$\endgroup$
6
  • $\begingroup$ @owlstead : The question I get is the first part of a multiple parts question , when it is asked they didn't specify which protocol it is, so I didn't think the name is important. Later part ask to prove that $CREE_0$ - nest is "weak mutual authentication". $\endgroup$ Jun 7, 2014 at 17:39
  • $\begingroup$ @owlstead : I can provide $CREE_0$ - nest 's definition if you want. $\endgroup$ Jun 7, 2014 at 17:53
  • $\begingroup$ OK, but I'm not sure that posting the protocol will help solve this issue; it is still unclear what the word "strong" means in relation to the protocol, we may need the context for the security claim. $\endgroup$
    – Maarten Bodewes
    Jun 8, 2014 at 10:08
  • 1
    $\begingroup$ Sorry, chat is not currently available, it says I have to log in (which I already have). I can see you are trying to salvage the question, and we are trying to answer, but "strong" in itself does not have any meaning. So without the particular claim, we can simply only guess. Maybe you haven't got enough context either, but in that case you should ask the authors for more detail. We want to answer, we just cannot. $\endgroup$
    – Maarten Bodewes
    Jun 8, 2014 at 13:50
  • 2
    $\begingroup$ Yes, that link contains one definition of strong authentication. If you are sure that is the definition of strong authentication you want to use, by all means edit it into your question. $\endgroup$
    – Maarten Bodewes
    Jun 9, 2014 at 18:02

1 Answer 1

1
$\begingroup$

Strong with regards to cryptographic protocol usually means that the protocol is secure if the underlying primitives can be proved cryptographically strong. In your case, that could be because authentication is performed using a symmetric cipher and a key that is only distributed for 2 participants.

But as indicated in the comments, "strong" depends on context, you won't get any assurances from it by itself.

$\endgroup$
3
  • $\begingroup$ In other words, "strong" and "weak" depend on what is within the scope of a particular threat model. Biometrics, 2FA, MFA, OTPs, TOTPs, PKI-based authentication, etc., could all be part of a strong system. "Strong" would mean the system meets all security goals, which is more than just the strength of the underlying cryptographic primitives taken separately, right? $\endgroup$
    – Patriot
    Jul 11, 2021 at 10:22
  • $\begingroup$ I guess, but I would be very hesitant about assigning it even that meaning. I mean, if I was auditing documentation and it would just say that a "strong" method would be used, then I would not assign it any meaning whatsoever. It would need further clarification. $\endgroup$
    – Maarten Bodewes
    Jul 11, 2021 at 10:27
  • $\begingroup$ That makes sense. It can be very problematic to justify such assured blanket statements. I got it. $\endgroup$
    – Patriot
    Jul 11, 2021 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.