0
$\begingroup$

Colin Percival's spiped utility uses a pre-shared key and Diffie-Hellman with ephemeral keys to provide forward secrecy. The protocol is summarized in the project's README under the section "Encrypted Protocol".

What is the purpose of the nonces (nonce_C and nonce_S)? How are they useful when x_C and x_S are already chosen at random?

$\endgroup$
0
$\begingroup$

Without the nonces, one could violate explicit authentication
by replaying the group_element || MAC_tag messages.

$\endgroup$
  • $\begingroup$ Can you elaborate on the replay attack? I don't see how the attacker could actually replay packets, since the other party will end up computing a different shared secret every time. $\endgroup$ – Tim McLean May 7 '15 at 2:55
  • $\begingroup$ The attacker would just send the same group_element || MAC_tag to the party that message $\hspace{.26 in}$ was sent to before, even though that "party will end up computing a different shared secret every time." $\hspace{.15 in}$ $\endgroup$ – user991 May 7 '15 at 3:06
  • $\begingroup$ Right. So the receiver accepts group_element as valid, and computes a new y_SC (a new shared secret). The receiver then derives the new AES and HMAC keys. How does the attacker now produce a packet with a valid HMAC tag? The attacker can't simply replay packets because the HMAC key has changed, AFAICT. $\endgroup$ – Tim McLean May 7 '15 at 3:14
  • $\begingroup$ The attacker doesn't "now produce a packet with a valid HMAC tag". $\;$ $\endgroup$ – user991 May 7 '15 at 3:23
  • 1
    $\begingroup$ Yes. ${}{}{}\;$ $\endgroup$ – user991 May 7 '15 at 3:29
0
$\begingroup$

Without the initial exchange of nonces, an attacker could replay a recorded handshake. Although an attacker can't use this to replay actual packets, an attacker could possibly execute a denial of service attack if the process protected by spiped is not expecting a large number of connections.

The attack (assuming a modified spiped protocol that MACs the public keys directly with the long-term key):

  1. Observe a handshake. Record y_C || h_C, where y_C is the client's ephemeral public key and h_C = HMAC(K, y_C) (K is the pre-shared key).
  2. Open a new connection and replay y_C || h_C. The server sees a valid MAC, and presumably opens a connection to the protected process.
  3. Repeat #2 until the protected process is overwhelmed.

Thanks to Ricky Demer for the discussion on his answer.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.