The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol

If we would like to defend against MITM attack, this protocol will work even without the symmetric key encryption. A related question is asked here In the STS Authentication Protocol, why are the signatures encrypted?

The answer points out that some identity protection is enforced. However, I am not convinced that the identity of Alice and Bob are protected. A MITM attacker can figure out where the traffic is coming from and where the traffic is going to. It should be easy to bind the traffic from specific machine. Then use other unencrypted traffic from that machine, it should be easy to figure out who the machine belongs to.

Another question: Why A is protected against active attack while B is protected against passive attack?

  • $\begingroup$ possible duplicate of In the STS Authentication Protocol, why are the signatures encrypted? $\endgroup$ – user991 Jul 17 '15 at 3:45
  • $\begingroup$ @RickyDemer, even without encryption, how does the attacker know which public key to choose to verify the identity from billions of billions public keys on the internet. If he has a specific subset to choose from, then this scheme is already broken from identity point of view. Of course, I am not familiar with the metrics to evaluate anonymity. $\endgroup$ – drdot Jul 17 '15 at 4:12
  • $\begingroup$ Why would this scheme be "already broken from identity point of view" if $\hspace{1.87 in}$ "he has a specific subset to choose from"? $\;$ $\endgroup$ – user991 Jul 17 '15 at 4:24
  • $\begingroup$ My words may be too strong. What is the definition of keeping the identity of the initiator confidential? Do you mean there is a negligible probability of revealing the identity? In that case, does all the public keys on the internet be sufficient to guarantee a negligible probability? $\endgroup$ – drdot Jul 17 '15 at 5:11
  • $\begingroup$ The definition is that the adversary's ability to distinguish between different initiators is negligible. $\hspace{.57 in}$ $\endgroup$ – user991 Jul 17 '15 at 5:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.