I was reading some research papers and saw that in Registration phase/process it is always assumed that communication is over the secure/private channel, whereas, all of the phases communication is happening over the public/open channel. What is the reason for this? on the basis of which parameter! we assume that the channel is secure/private insecure/public? Thanks in advance.
Registration phase/process it is always assumed that communication is over the secure/private channel, whereas, all of the phases communication is happening over the public/open channel. What is the reason for this?
Well, the point of the registration phase is to register the client to the server, so that they can reach mutual authentication afterwards using the exchanged information and with minimal / no assumptions on the underlying channel.
If you assume the channel to be insecure for this process, what an attacker can do, is wait for you to enter the registration phase with the legitimate server, intercept the request, act like they are the legitimate server and at the same time register themselves to the real server.
Now if you connect after the registration stage, the attacker can perfectly fine be authenticated as "the real server" and intercept your entire traffic (and potentially forward it to the real server).
