Suppose the honest parties - Alice and Bob - exchange public key in person/via telephone so that attacker can only eavesdrop on the line. Alice has hashed the public key using a collision resistance hash function $H$ before telling it to Bob. Bob will encrypt a random $k$ using $key = H(pk)$ and read it ($E_{H(pk)}(k)$) off to Alice for the authenticated scheme. Later on they both communicate through the internet where the attacker can act as a Man-in-the-Middle attacker. Is this scheme secure? As far as I can see, the attacker can't do anything since he can't either obtain $pk$ (as they use a CRH function) or key $k$(attacker doesn't have secret key from Alice)
$\begingroup$
$\endgroup$
3
-
$\begingroup$ "read it off to Alice", where "it" is ... $\;$ $\endgroup$– user991Mar 13, 2015 at 5:46
-
$\begingroup$ Is "it" the random k or H(pk) or pk or the ciphertext resulting from encrypting the random k with H(pk)? $\hspace{.23 in}$ $\endgroup$– user991Mar 13, 2015 at 6:36
-
$\begingroup$ "it" = Enc(H(pk), k) where k is a random key $\endgroup$– hvuong91Mar 13, 2015 at 6:47
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
No, this scheme isn't secure.
As far as I understand your description you are using the hashed public key of Alice as the symmetric key to a cipher, but as you already just send this hash over the line, the attacker can simply decrypt $k$ himself and thereby $k$ isn't established as a pre-shared key. By the way, there's no way to recover $pk$ from $H(pk)$ and thereby you can't public key encrypt $k$ here.
This can however be fixed in one of two ways: a) you don't hash the public key at all and just let Alice send Bob her public key, which he will subsequently use to asymmetrically encrypt $k$ so only Alice can read it. Or b) you just stay with the hash of the public key (and maybe drop the $k$ which doesn't serve any purpose if the channel is guaranteed to be integrity protecting) and let Alice send her public key over the internet in clear. Bob can verify the public key using the trusted hash of it and if the hash of the received public keys match, he can then use this to encrypt a session key.