1
$\begingroup$

Let's consider that Alice and Bob both know a shared secret $secret$ and don't know each other DH public keys. They want to authenticate each other and their keys using only $secret$. Let's also forget about an existence of SMP. Can the following scheme be considered secure?

First, Alice and Bob perform Diffie-Hellman KE:

$Alice: send(g^a)$
$Bob: recv(g^a);\ send(g^b)$
$Alice: recv(g^b)$ // Now both Alice and Bob has a shared $dh\_key$

Next, they want to be sure that their companion:
a) Knows a shared secret.
b) Is the owner of the corresponding DH private key.

$Alice: send(HMAC(g^a, secret))$
$Bob: recv\_and\_check(msg, secret); send(HMAC(g^b, secret))$ $Alice: recv\_and\_check(msg, secret)$

If all checks are passed Alice and Bob can start a secure data exchange. They also can save DH-public keys for future conversations.

So:

  1. Is the scheme secure?
  2. If the answer to the first question is 'yes' what are pros and cons in comparison with SMP (like in OTR SMP)?
| improve this question | |
$\endgroup$
1
$\begingroup$

Since you tagged the question with "man-in-the-middle" then the answer is that the protocol is not secure after its first use because the eavesdropper can record the exchange and repeat it. Instead, each party should challenge the other party with a random value that will be used by the other party to construct the HMAC.

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ An attacker still can't MITM the connection: he doesn't have private keys corresponding to the signed public keys. Moreover, after the first use, Alice and Bob can save each other public keys for future conversations. $\endgroup$ – Enr1g May 3 '17 at 17:52
  • $\begingroup$ @Enr1g My answer relates to the protocol as described by OP. Under this protocol, after the first round the attacker can impersonate either Alice or Bob, because the exchange does not change from one session to the next one. Saving each other's keys will not prevent such impersonation unless the protocol is modified. $\endgroup$ – stromboli May 3 '17 at 19:53
  • $\begingroup$ If you change "also can" in the description to must remember and never use this protocol again than it would be secure against the described attack. But most of us would prefer seing a different key used for each session. A challenge mixed into the hmac would be a better mechanism. $\endgroup$ – Meir Maor Jun 1 '17 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.