I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them with a pre-shared ECC key. However, how should these PSKs be transmitted in a secure way to prevent MITM attacks that change the PSKs??
$\begingroup$
$\endgroup$
-
$\begingroup$ A pre shared key has to be transmitted using a method that lacks any man in the middle. For example, IT might run a kiosk from which they distribute packages of signing keys used by the corporation (x509 for TLS, perhaps SSH key fingerprints, etc). $\endgroup$ – Thomas M. DuBuisson Sep 8 '19 at 17:55
-
$\begingroup$ "transmitting a PSK for first time" - if a key is pre-shared, it means both side already have it. What are you going to transmit for the first time? $\endgroup$ – mentallurg Sep 8 '19 at 17:59
-
2$\begingroup$ Welcome to one of the fundamental issues in information security. You must have a pre-existing secret of some sort - you can not bootstrap from zero without a trusted communication channel. $\endgroup$ – Thomas M. DuBuisson Sep 8 '19 at 18:10
-
2$\begingroup$ Must have pre-existing unforgeable information, not secret information. $\endgroup$ – Squeamish Ossifrage Sep 8 '19 at 20:03
-
1$\begingroup$ @ThomasM.DuBuisson When you said ‘pre-existing secret’ I read that as ‘pre-shared secret’, sorry. What I meant is that Alice must know something about Bob that an adversary cannot forge; otherwise Alice can't distinguish Bob from the adversary. You are right that there have to be secrets too, of course—all I meant is that the secrets don't have to be shared in advance. $\endgroup$ – Squeamish Ossifrage Sep 8 '19 at 22:22
$\begingroup$
$\endgroup$
There is no magic solution. Either both parties are in a direct contact to exchange a PSK, or they use authentication based on PKI. Otherwise there is no guarantee that there is no man in the middle.
