1
$\begingroup$

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer:

We have the Needham Schroeder Public Key Protocol:

$ 1. A \rightarrow B: \{N_A, A\}_{pk(B)} \\ 2. B \rightarrow A: \{N_A, N_B\}_{pk(A)} \\ 3. A \rightarrow B: \{N_B\}_{pk(B)}$

The question asks for an attack on this protocol. Like for the original NSPK I think the weakness is a man-in-the-middle attack (where $I_A$ stands for $I$ impostering as $A$ on the network:

$ 1. A \rightarrow I: \{N_A, A\}_{pk(I)} \\ \hspace{225px} 1'. I_A \rightarrow B: \{N_A, A\}_{pk(B)} \\ \hspace{225px} 2'. B \rightarrow I_A: \{N_A, N_B\}_{pk(A)} \\ 2. I \rightarrow A: \{N_A, N_B\}_{pk(A)} \\ 3. A \rightarrow I: \{N_B\}_{pk(I)} \\ \hspace{225px} 3'. I_A \rightarrow B: \{N_B\}_{pk(B)} \\ $

Which uses $A$ as a decryption agent to authenticate $I_A$ with $B$ despite it not being $A$'s intention to do so.

Now the question then asks about the modification of line 3 in the given protocol, i.e. changing the line: $3. A \rightarrow B: \{N_B\}_{pk(B)}$ into $3. A \rightarrow B: h(N_B, A, B)$ for a cryptographic hash function $h$.

The original man-in-the-middle attack doesn't seem to work from what I can see under this modification.

It then goes on to ask me whether this new method is secure on not, i.e. does any attacks exist on this new protocol? I have thus far noticed reflection and man-in-the-middle attacks will fail on this new protocol.

I'm wondering if there exist any attacks or else what would be a way to show its security? (Gut feeling says there should exist an attack as it may be very difficult to show it is completely secure.)

|improve this question
$\endgroup$
  • $\begingroup$ I don't see why changing to hash rectifies the problem. If in step 3 $A$ sends to $I$ the hash value, the in step 3' $I$ can pass it to $B$ without any problem and still $A,B$ cannot possibly detect there is a man in the middle. $\endgroup$ – Changyu Dong Jan 14 at 11:18
  • $\begingroup$ @ChangyuDong I think $A$ would send $I$ the string $h(N_B, A, I)$ then, and $B$ would then be able to tell as he would expect $h(N_B, A, B)$? $\endgroup$ – CowNorris Jan 14 at 17:22
  • $\begingroup$ Then in the third step of your attack, $A$ should send $\{N_B\}_{pk_I}$ instead of $\{N_B\}_{pk_B}$. $\endgroup$ – Changyu Dong Jan 15 at 10:36
  • $\begingroup$ @ChangyuDong Ah, sorry, my bad. I've corrected my attack now - though I'm still unsure about the security of the protocol after the modification the question suggests. $\endgroup$ – CowNorris Jan 15 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.