Besides using a certificate to defend against a man in the middle attack
during a key exchange, what methods can be used?


Any shared secret can be used. Securely distributed passwords and symmetric keys, for example. Alternatively, you can use asymmetric cryptography, such as public keys.

For one example, SSH has for years authenticated servers using public key cryptography and users typically using either public keys or passwords. Only recently had SSH added support for certificates.

  • $\begingroup$ Couldn't this processes be attacked by someone in the middle as the public keys are established on the server? Bob request Alice, but Oscar intercepts and sends him his? $\endgroup$ – Jesse Nov 12 '15 at 15:36
  • $\begingroup$ Yes the "securely distributed" notion applies to asymmetric keys as well as symmetric. This is true for your certificate authorities too though - that's just a special application of public keys. $\endgroup$ – Thomas M. DuBuisson Nov 12 '15 at 15:56
  • $\begingroup$ Ok, just wanted to make sure. Could they pre-install the keys before distribution or embedded a chip in a ID card to minimize this risk? $\endgroup$ – Jesse Nov 12 '15 at 15:58
  • $\begingroup$ Sure, this is a common strategy. Large organizations setup kiosks and distribute the initial keys physically - usually just the one CA but there isn't any reason you couldn't do it for SSH server keys. $\endgroup$ – Thomas M. DuBuisson Nov 12 '15 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.