0
$\begingroup$

Trying to simplify my question, keeping only core concepts.

Proposed solution:

  1. Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret.
  2. Device that requests secrets – presents dialog with the 6 digit code. 6 digit code is just first 6 bytes of SHA-512(shared_secret||A_identity||B_identity) and mod 10 of each byte.
  3. Device that expected to share secrets asks user to enter 6 digit code. And if code entered is correct (no man-in-the-middle + explicit user approve on action) – uses KDF on shared secret to generate transfer key and sends all data to other device.

As it's ephemeral keys and there is no ability to brute-force keys with the same fingerprint easily from first try - it is seems to be ok to use just 6 digit fingerprint. Server has no ability to intercept data or to introduce himself as legitimate device.

I'm not a security or crypto expert. Obviously I must not re-invent secure communication protocols. That's why I'm here to ask.

What are drawbacks of solution I propose? Are there any well known protocols for that case ?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ The technical term you are looking for is short authenticated string (SAS) which was originally introduced by Vaudenay at Crypto 2005 (PDF). The linked paper discusses long-message authentication using SAS, one could reasonably use that to authenticate two public keys. $\endgroup$
    – SEJPM
    Commented Mar 4, 2020 at 11:52
  • $\begingroup$ Now I understand that in the scheme I've described - MITM is possible. Attacker just need to create about a 10^6 keys (19 bit security strength) to get pair with the same digit code. Thank you for your response. Post it as an answer when you have time. $\endgroup$
    – Alexander Smirnov
    Commented Mar 4, 2020 at 14:38

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.