1
$\begingroup$

Suppose the honest parties - Alice and Bob - exchange public key in person/via telephone so that attacker can only eavesdrop on the line. Alice has hashed the public key using a collision resistance hash function $H$ before telling it to Bob. Bob will encrypt a random $k$ using $key = H(pk)$ and read it ($E_{H(pk)}(k)$) off to Alice for the authenticated scheme. Later on they both communicate through the internet where the attacker can act as a Man-in-the-Middle attacker. Is this scheme secure? As far as I can see, the attacker can't do anything since he can't either obtain $pk$ (as they use a CRH function) or key $k$(attacker doesn't have secret key from Alice)

$\endgroup$
3
  • $\begingroup$ "read it off to Alice", where "it" is ... $\;$ $\endgroup$
    – user991
    Mar 13, 2015 at 5:46
  • $\begingroup$ Is "it" the random k or H(pk) or pk or the ciphertext resulting from encrypting the random k with H(pk)? $\hspace{.23 in}$ $\endgroup$
    – user991
    Mar 13, 2015 at 6:36
  • $\begingroup$ "it" = Enc(H(pk), k) where k is a random key $\endgroup$
    – hvuong91
    Mar 13, 2015 at 6:47

1 Answer 1

1
$\begingroup$

No, this scheme isn't secure.

As far as I understand your description you are using the hashed public key of Alice as the symmetric key to a cipher, but as you already just send this hash over the line, the attacker can simply decrypt $k$ himself and thereby $k$ isn't established as a pre-shared key. By the way, there's no way to recover $pk$ from $H(pk)$ and thereby you can't public key encrypt $k$ here.

This can however be fixed in one of two ways: a) you don't hash the public key at all and just let Alice send Bob her public key, which he will subsequently use to asymmetrically encrypt $k$ so only Alice can read it. Or b) you just stay with the hash of the public key (and maybe drop the $k$ which doesn't serve any purpose if the channel is guaranteed to be integrity protecting) and let Alice send her public key over the internet in clear. Bob can verify the public key using the trusted hash of it and if the hash of the received public keys match, he can then use this to encrypt a session key.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.