2
$\begingroup$

I was reading some research papers and saw that in Registration phase/process it is always assumed that communication is over the secure/private channel, whereas, all of the phases communication is happening over the public/open channel. What is the reason for this? on the basis of which parameter! we assume that the channel is secure/private insecure/public? Thanks in advance.

Registration Process

$\endgroup$
  • 2
    $\begingroup$ Well, if you use an insecure channel, an attacker can impersonate the server and later down the line also impersonate the server, as they become the server. $\endgroup$ – SEJPM Jan 1 at 11:39
  • 1
    $\begingroup$ @SEJPM Please can you elaborate your answer.. ........thanks in advance $\endgroup$ – hafeez shah Jan 1 at 11:44
5
$\begingroup$

Registration phase/process it is always assumed that communication is over the secure/private channel, whereas, all of the phases communication is happening over the public/open channel. What is the reason for this?

Well, the point of the registration phase is to register the client to the server, so that they can reach mutual authentication afterwards using the exchanged information and with minimal / no assumptions on the underlying channel.

If you assume the channel to be insecure for this process, what an attacker can do, is wait for you to enter the registration phase with the legitimate server, intercept the request, act like they are the legitimate server and at the same time register themselves to the real server.

Now if you connect after the registration stage, the attacker can perfectly fine be authenticated as "the real server" and intercept your entire traffic (and potentially forward it to the real server).

$\endgroup$

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.