0
$\begingroup$

Diffie-Hellman Key Exchange Basic Protocol:

Let G be a cyclic group of order $n$ and generator $g$.

Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$.

Alice computes $h_A = g^a$ and Bob computes $h_B = g^b$.

Alice sends $h_A$ to Bob and Bob sends $h_B$ to Alice.

Alice computes $(h_B)^a = g^{ab}$ and Bob computes $(h_A)^b = g^{ab}$.

The common symmetric key is $g^{ab}$

As we all know, this basic protocol is vulnerable to the man-in-the-middle attack.

Therefore I propose the following variant, where Alice and Bob use a digital signature scheme, both having a pair of public and private keys for signing (the public portion of this keypair is shared beforehand):

Let G be a cyclic group of order $n$ and generator $g$.

Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$.

Alice computes $h_A = g^a$ and Bob computes $h_B = g^b$.

Alice sends $(h_A,sig_{sk_A}(h_A))$ to Bob and Bob sends $(h_B,sig_{sk_B}(h_B))$ to Alice.

Alice verifies the signature. If ok, proceed to next step. Otherwise abort. The same for Bob.

Alice computes $(h_B)^a = g^{ab}$ and Bob computes $(h_A)^b = g^{ab}$.

The common symmetric key is $g^{ab}$

This variants differs from the Station-to-Station Protocol, which provides security against man-in-the-middle attacks.

Is my variant of the basic protocol also secure against man-in-the-middle attacks? What is the advantage of the STS Protocol when compared to this variant?

Thanks in advance.

$\endgroup$
3
  • $\begingroup$ Hint: what happens if Eve passively captures $(h_A,\text{sig}_{\text{sk}_A}(h_A))$, and replays that to Bob on a later day, or to Carol just after that? Is there an equivalent in STS? $\endgroup$
    – fgrieu
    May 3 '20 at 14:03
  • $\begingroup$ I don't know... If that happens, Eve still does not learn the value of $a$, so she cannot learn the common key $\endgroup$
    – Leafar
    May 3 '20 at 19:11
  • 2
    $\begingroup$ @Leefar. Right. But the signature check by Bob or Carol is pass, and that can be an issue. At least, that allows Eve to go past that step in the protocol, and start fuzzing the code that will be using the (invalid and unknown) session key in Bob's or Carol's implementation. It also gives some credibility to Eve impersonating Alice on the phone and saying she just tried to connect, because Bob's or Carol's logs will show that. $\endgroup$
    – fgrieu
    May 3 '20 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.