In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step.

In the final step, both parties check a value like $R_{ab} == P_{alice} / P_{bob}$. So the parties have to agree who's the numerator (alice), and who's the denominator (bob) (reference).

But I noticed I can avoid this asymmetry by just checking for both $P_{alice} / P_{bob} $ and $P_{both} / P_{alice}$. Or more explicitly, with the roles removed.

$$ (R_{ab} == P_{self} / P_{other}) \text{ or } (R_{ab} == P_{other} / P_{self}) $$

My question is: is this safe? Is there some way an attacker could use this extra check to interfere with the final result?

If it is the case that both parties do have the same secret value, this should always work. But if the parties don't have the same value, could the adversary make my extra check return true somehow?

Here is my code for reference: https://github.com/cowlicks/socialist-millionaire-go/blob/master/smp.go#L129-L138

  • $\begingroup$ If this is a dangerous thing to do, then it seems like it would make this implementation vulnerable. Because an adversary could just lie about the proto.SMP2TLV orproto.SMP3TLV flag. $\endgroup$
    – cowlicks
    Commented Nov 28, 2016 at 19:09


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.