0
$\begingroup$

I'm not a cryptography expert, so excuse me if the question seems very trivial.

I need to know if this protocol is secure against a MiTM attacks and ensure a safe entity authentication method.

We have Alice and Bob that share the same key $K$. Alice needs to be sure that Bob is really Bob. In order to achive this Alice generates a random number $N$ and sends it to Bob. Bob receives this message from Alice, computes $C=ENC_K(N,ID_{B})$ and then sends to Alice $C$. Upon that Alice received $C$ performs $DEC_K(C)$ extracts the nonce, named $N'$ and checks if $N'$ = $N$.

Is it correct?

UPDATE: I've found this paper:

M. Bellare, R. Canetti, and H. Krawczyk, “A modular approach to the design and analysis of authentication and key exchange protocols”, Proceedings of the 30th Annual Symposium on the Theory of Computing, ACM, 1998.

Where in section 3.2 is described an authentication technique using encryption and MAC algorithms. Now, I need to know, since the paper is quite old, if this scheme could be considered secure yet. Furthermore, how can I make it secure against a Reset Attack (if it is possible) ?

Improve this question
$\endgroup$
2
  • 2
    $\begingroup$ When seeing authentication, the first thing that pops up should be message authentication code (MAC), rather than encryption. $\endgroup$
    – DannyNiu
    May 28, 2019 at 4:23
  • $\begingroup$ Thanks. I understood that also I must add a MAC. However I need to know if this protocol could be considered secure as identity authentication protocol. $\endgroup$
    – thinker.92
    May 28, 2019 at 9:54

1 Answer 1

Reset to default
2
$\begingroup$

In general, no, this is not safe, and in the cases where it is safe it's wasteful.

The safe (but wasteful) cases are those where you're already using an Authenticated Encryption with Associated Data (AEAD) scheme or applying a Message Authentication Code (MAC) over the ciphertext. It's wasteful since those both have their own authentication systems, but safe since it prevents a MITM from modifying the ciphertext in transit.

Without authentication the MITM can simply modify data in the ciphertext beyond the start of $N$, ie anything in $ID_{B}$. This won't affect $N$ at all in any of the commonly used modes (either a direct stream cipher or a block cipher in CTR or CBC mode). There are some caveats to my statement, eg if $N$ is not a multiple of the underlying block size in CBC or CTR mode then data out to the next multiple of the block size needs to be preserved by the attacker, but since you didn't specify anything about the cipher used for encryption I'll go with the most general case.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Ok, first of all thanks for the answer. However, the scheme that I presented, adding a MAC, should be safe for guarantee entity authentication? $\endgroup$
    – thinker.92
    May 28, 2019 at 6:00
  • $\begingroup$ If you mean that you want Alice to be able to know she's talking to Bob (identification), then it's only safe if $ID_B$ is a shared secret. If it's not a secret then anyone can fake it. I'm not sure what you mean by "entity authentication" as opposed to the standard definition of "authentication". $\endgroup$
    – SAI Peregrinus
    May 29, 2019 at 0:23
  • $\begingroup$ Ok, I'm not an expert, so maybe I used the wrong definition. I'm referring to the problem of identification. So I want thant Alice is able to understand that she is talking with Bob in a symmetry cryptography setting. $\endgroup$
    – thinker.92
    May 29, 2019 at 6:17
  • 1
    $\begingroup$ If there is a pre-shared key only Bob and Alice have then computing a normal MAC of any message will work. If the key is used for a group then there's no unique (uncopyable) identifier and so no way to uniquely identify Bob. $\endgroup$
    – SAI Peregrinus
    May 30, 2019 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.