1
$\begingroup$

I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them with a pre-shared ECC key. However, how should these PSKs be transmitted in a secure way to prevent MITM attacks that change the PSKs??

$\endgroup$
8
  • $\begingroup$ A pre shared key has to be transmitted using a method that lacks any man in the middle. For example, IT might run a kiosk from which they distribute packages of signing keys used by the corporation (x509 for TLS, perhaps SSH key fingerprints, etc). $\endgroup$ Commented Sep 8, 2019 at 17:55
  • $\begingroup$ "transmitting a PSK for first time" - if a key is pre-shared, it means both side already have it. What are you going to transmit for the first time? $\endgroup$
    – mentallurg
    Commented Sep 8, 2019 at 17:59
  • 2
    $\begingroup$ Welcome to one of the fundamental issues in information security. You must have a pre-existing secret of some sort - you can not bootstrap from zero without a trusted communication channel. $\endgroup$ Commented Sep 8, 2019 at 18:10
  • 2
    $\begingroup$ Must have pre-existing unforgeable information, not secret information. $\endgroup$ Commented Sep 8, 2019 at 20:03
  • 1
    $\begingroup$ @ThomasM.DuBuisson When you said ‘pre-existing secret’ I read that as ‘pre-shared secret’, sorry. What I meant is that Alice must know something about Bob that an adversary cannot forge; otherwise Alice can't distinguish Bob from the adversary. You are right that there have to be secrets too, of course—all I meant is that the secrets don't have to be shared in advance. $\endgroup$ Commented Sep 8, 2019 at 22:22

1 Answer 1

1
$\begingroup$

There is no magic solution. Either both parties are in a direct contact to exchange a PSK, or they use authentication based on PKI. Otherwise there is no guarantee that there is no man in the middle.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.