Consider two types of attackers on a key exchange (KE) protocol and subsequent communication between the parties which used this KE instance to establish a secure communication key. Attacker Eve eavesdrops on their links, both over the internet and over telephone, while attacker Mallory can stage a man-in-the-middle attack over the internet and he can eavesdrop on the telephone but he cannot fake Alice’s and Bob’s voices over the telephone. In each case say whether the scheme is secure or not against each attacker type and briefly justify your answer.

(b) What if Alice uses CPA-secure public key encryption scheme to generate a (private,public) key pair, communicates her public key to Bob over email, and Bob chooses a random key k for the authenticated encryption scheme and emails it encrypted under Alice’s public key to Alice?

(d) Suppose Alice and Bob do as in (b) but they hash and read off over the telephone Bob’s chosen key k instead of Alice’s public key? Assume the hash function H' is a true random function, and in particular that for a random 128-bit key k the authenticated encryption using k remains secure even if the adversary learns the H'(k) value.

This is a homework question. I'm not really asking for the answer. It's just that I don't understand how Alice and Bob can retrieve the key k and the attacker can't since all of them see/hear the same H'(k). Suppose we don't have the attacker in this case. How do the honest parties exchange the key? I would really appreciate any explanation.

  • $\begingroup$ You're sure they read Bob's hash over the phone, instead of the hash of Alice's public key? $\endgroup$ – cpast Mar 13 '15 at 18:55
  • $\begingroup$ Yes, that's the given scheme for this question. I just copied what was written in the homework. $\endgroup$ – hvuong91 Mar 13 '15 at 19:49
  • $\begingroup$ In (b), Alice generates a public/private key pair and sends the public key to Bob by email; Bob chooses a symmetric key k; Bob encrypts k using Alice's public key and sends the cryptogram to Alice by email; Alice deciphers that using her private key and thus gets k. That's how Alice and Bob share the symmetric key k, in the absence of attack. $\;$ In (d), Bob additionally reads H'(k) to Alice over the phone. $\endgroup$ – fgrieu Mar 13 '15 at 21:51
  • $\begingroup$ So somehow they must agree on using hashing function H' before exchanging the key k? If Bob simply read H'(k) to Alice, Alice must have to figure out the way to get k and the attacker Mallory could do the same thing $\endgroup$ – hvuong91 Mar 13 '15 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.