I have the following protocol for mutual authentication ($V=$ verifier, $P = $ prover, $r_V$ and $r_P$ random values, $h_k$ a keyed hash function)

  • $V\rightarrow P:r_V$
  • $P\rightarrow V:r_P,h_k(r_V,r_P)$
  • $V\rightarrow P:h_k(r_P,r_V)$

My question is why does the prover send back to the verifier $h_k(r_V,r_P)$? Can't he just send back $h_k(r_V)$? Or is this less secure.


(EDIT: question before edit asked about case where $r_v$ is missing from hash, that's why the answer is mostly about it:)

This would totally break security of the scheme. Assume that protocol looks like this (only change is in step 2 - missing $r_v$):

  • $V\rightarrow P:r_V$
  • $P\rightarrow V:r_P,h_k(r_P)$
  • $V\rightarrow P:h_k(r_P,r_V)$

Let's assume that Eve sees message from step 2. She can now start another authentication session and send to $V$ the same pair $r_P,h_k(r_P)$ again and get authenticated as $P$ (in as many separated sessions as she wants).

You can prevent this by requiring that each $r_P$ can be used only once but tracking used values is way more expensive and error-prone than simply including challenge from $V$ in hash.

Please note that if you drop $r_P$ from step 3 as well and Eve sees all messages then she can pretend to be $V$ in communication with $P$ as well.

If protocol looks like:

  • $V\rightarrow P:r_V$
  • $P\rightarrow V:r_P,h_k(r_V)$
  • $V\rightarrow P:h_k(r_P)$

then you can force $P$ to sign whatever message you want (impersonating $V$ ) or force $V$ to sign whatever you want performing man-in-the-middle attack and changing $r_P$. This can potentially lead to some replay attack if you use strong MAC or to secret key recovery if MAC is not chosen plaintext secure.

| improve this answer | |
  • $\begingroup$ hum... And in the first scenario (with $r_V$ in the hash function), what stops Eve from doing exactly the same thing? i.e. she intercepts ($r_P, h_k(r_V,r_P))$ and sends it to $V$. $V$ will also think he is talking to $P$ since he receives the information he expects. $\endgroup$ – tomak Jan 22 '18 at 13:29
  • $\begingroup$ This shows that I haven't really understood what's going on... $\endgroup$ – tomak Jan 22 '18 at 13:29
  • $\begingroup$ Even in the simpler case of unilateral identification, if we have $V\rightarrow P:r_V$ and $P\rightarrow V:h_k(r_V)$ what stops Eve from intercepting $h_k(r_v)$ and sending it to $V$. Then Eve has identified herself as $P$ to $V$ $\endgroup$ – tomak Jan 22 '18 at 13:37
  • $\begingroup$ I edited the question a bit. What happens if $P$ just sends back $r_P,h_k(r_V)$. $\endgroup$ – tomak Jan 22 '18 at 13:54
  • $\begingroup$ Please don't change your question after there are answers because that makes them off-topic. I've updated my answer though to address new question $\endgroup$ – Przemko Robakowski Jan 22 '18 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.