# What is the most an adversary can do in the context of public key masquerading?

Suppose two parties A and B are using a public-key encryption scheme in order to communicate securely. A and B both have a public/private key pair:

$$A: (P_A, S_A), B: (P_B, S_B)$$

and A already knows about B's public key but has no proof of authenticity. What is the most an adversary C can do while impersonating one of the parties (we assume there is no authentication employed). For example, if C masquerades as B and creates a key pair:

$$C(P_B, S_C)$$

he may be able to trick A into sending it encrypted messages with the public key of B, but not more since not being in possession of B's secret key C cannot retrieve the message from A. But what more can C do from this point with retrieving the secret key of B? In a more concrete setting, how can the RSA scheme be exploited as mentioned above?

## 1 Answer

Perhaps the situation should be concretized a little.

A and B both have a public/private key pair:

Does A already know $P_B$, and vice versa? If not, then $C$ can send to A the $P_C$ saying it's «$P_B$» (similar for B, $P_C$ substitutes $P_A$), and become a typical man-in-the-middle, being able to, for example, remove any «real» message from B to A (something he can perform without keys at all) and decrypt or even modify everything that A sends to «B».

but not more since not being in possession of B's secret key C cannot retrieve the message from A.

Hypothetically, if A is «naive» enough (may A be a machine, for instance?), C sends him the message like «stop using my public key $P_B$, instead use $P_C$» (encrypted with $P_A$), A decrypts it with $S_A$, believes without approvals, switches to $P_C$, and then C becomes a man-in-the-middle again.

Does A know $S_B$? Obviously, he must not; otherwise, using the preceding trick, C may convince A to share $S_B$, and impersonate B elsewhere.

In general, the «exploitability» here depends not only on the cleverness of C, but on the «naivety» of A and B as well (they have to know what's dangerous and don't do it).

do from this point with retrieving the secret key of B?

Didn't you mean without retrieving?

Sorry if this looks like a comment. In case you consider a man-in-the-middle attack to be «the most an adversary can do» (or at least critical), it probably helps to concretize the picture. Also, although it is stated that

assume there is no authentication employed

to avoid man-in-the-middle attack is a kind of authentication, in itself.

When the situation is clarified, other answers will be much more useful, and this one may be deleted.

• A knows about B's public key but the key itself is not authenticated so C can claim to be B. – Sebi Oct 25 '15 at 14:01