The exercise is: What could be changed on the second message " Kya(Kxb(Ra,Ks)) " to guarantee B's authenthicity and also privacy?

My teacher's solution was "add a destination" , so it would be something like this Kya(Kxb(Ra,Ks,A)).

If we have a man in the middle, Trudy pretending to be B, couldn't she just check the contents of the message and send them to A? (I'm not sure if it works that way), but this is my understanding, something like this:

1- A -> A, Kxa(Ra, Ts) ->T -> A, Kxt(Ra, Ts) ->B

2- A <- Kya(Kxb(Ra, Ks, A)) <- T <- Kyt(Kxb(Ra, Ks, A)) <- B

I'm not quite sure how does the "Destination" field solve anything.

enter image description here

Also as indicated in this answer to a related question made by the user Maarten Bodewes, here's the meaning of those operations:

  • A is the identity of A, which can be used to select the right public key of A;
  • Kxa() is a signing operation (with message recovery) that signs the random Ra and a tag Ts which is used as proof;
  • Kya() is an encryption operation with the public key A, so that the session key Ks is kept confidential;
  • Kxb() is a signing operation (with message recovery) that signs the random Ra together with session key Ks;

1 Answer 1


Let's assume that T does send A,Kxt(Ra,Ts) to B as you have indicated. In that case upon reception and validating the signature, B would immediately be able to tell that the signature does not belong to A (and should thus not continue the exchange).

To try to take advantage of the exchange, T would have to alter the message from A so that it still looks legitimate (i.e. where the attached originator matches the signature), while substituting it's own identity to A's when interacting with B (so that B would reply with an encrypted message for T instead of for the original A; B has otherwise no reason to encrypt using Kyt as you've indicated in step 2). This could be done by changing the message from A,Kxa(Ra,Ts) to "T,Kxt(Ra,Ts) as T intercepts the message. At that point one of two things can happen:

  1. B already knew A's identity, and would immediately be able to tell that T,Kxt(Ra,Ts) is not from A.
  2. B does not have prior knowledge of A's identity. He then validates the message signature Kxt(Ra,Ts) which look like a valid signature for the attached identity T. Since it looks ok, he proceeds to generate Kyt(Kxb(Ra, Ks,T)) which T could decrypt to obtain the much needed Ks. However, since T cannot forge B's signature to generate Kxb(Ra,Ks,A), T can either send Kya(Kxb(Ra,Ks,T)) (a message properly signed by B which reveals T's identity to A) or Kya(Kxt(Ra,Ks,A)) (a message which attempts to hide T identity, but which is visibly not signed by B) to A. In either case, A knows that the channel is compromised and should not continue the exchange.
  • $\begingroup$ Thank you for your explanation, was very nice and detailed. $\endgroup$
    – jruivo
    Jun 3, 2016 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.