1
$\begingroup$

Scenario: I have to protect the integrity of some files that will be exchanged between entities $A$, $B$, $C$. Entity $A$ creates the file (e.g. configuration) and sends it to $B$ and $C$. Entities $A$ and $B$ are considered trusted but entity $C$ is semi-trusted (by default it is trusted but we assume it could be compromised at some point). The communication channel between $A \leftrightarrow B \leftrightarrow C$ is considered secure (e.g. VPN).

Now, I obviously cannot rely on HMAC since I would have to share a secret with potentially compromised $C$. But I would prefer to avoid implementing a PKI and digital signatures for this purpose. Is there any way around a PKI that will protect the integrity of my files?

Improve this question
$\endgroup$
3
  • 3
    $\begingroup$ Any wrong with two symmetric keys K0 K1, with K0 known to A and B only, and K1 shared between A B C; and protecting messages with two MACs with these keys, except when originating from C which uses K1 only? $\endgroup$ – fgrieu♦ Aug 6 '14 at 9:31
  • 2
    $\begingroup$ I don't see the big argument against PKI. In this case you could just distribute/trust the public keys and validate the messages directly. Creation of a black list would be trivial. No need for CA's etc. (or at least not more need than required for a symmetric scheme). $\endgroup$ – Maarten Bodewes♦ Aug 6 '14 at 12:56
  • 1
    $\begingroup$ It sounds like you are saying the assumptions are that A,B,and C trust each other, but want to protect against compromise. That's more a problem of building an infrastructure that supports non-repudiation, logging, and audit trail, not just encryption/decryption. $\endgroup$ – Jeff-Inventor ChromeOS Aug 7 '14 at 2:15
0
$\begingroup$

As owlstead wrote in the comments, you don't need a real public key infrastructure to use public key signatures for this. You can have A create a key-pair, then distribute the public key to B and C in advance, before any communications start.

A symmetric setup isn't much more complex either. You need two secrets, one between A and B, one between A and C. Calculate two MACs for each file, with either key. B can verify one, C the other. Even if E gets the secret key from C modifies a file, they can only calculate one of the MACs for modified messages.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.