I'm reading about the security of the Signal protocol (used in WhatsApp) and in particular, the X3DH part used to establish authentication, all papers seem to gloss over Man in the Middle attacks. Is it possible or not to MitM between users and the server? Seems easy on the server.

  • $\begingroup$ After the user verified the other end or before? $\endgroup$
    – kelalaka
    May 4 '20 at 18:55
  • $\begingroup$ I'm surprised they don't address it directly. A DH MitM is a basic attack if you can't verify the other party somehow. Both X3DH and the Signal doc from WhatsApp seem to gloss over it. Also, some "proof" I found seems more interested in analyzing the "double ratchet" part (since I guess it sounds sexy to them) than analyzing boring old DH. I just want someone to say "A man in the middle attack is possible on the server or between a user and server, therefore, to ensure secure communications both parties MUST confirm their public keys out of band." Otherwise you have to trust the server. $\endgroup$ May 5 '20 at 19:02

This is "covered" by section 4.1 of the X3DH spec:

Before or after an X3DH key agreement, the parties may compare their identity public keys $IK_A$ and $IK_B$ through some authenticated channel. For example, they may compare public key fingerprints manually, or by scanning a QR code. Methods for doing this are outside the scope of this document.

Signal and WhatsApp both support verifying identities through QR codes, and provide a warning (optional in WhatsApp) if the other party's identity public key changes. That would stop MITM attacks, or make them detectable, though in practice almost no one does the verification.

Also note that the connection between the app and server is TLS-protected, so any MITM attack would need to be carried out by compromising the server itself.

  • $\begingroup$ Note verifying is easy, one doesn't need to be side by side; jjust read some part of the numbers over the call. $\endgroup$
    – kelalaka
    May 5 '20 at 1:12
  • 1
    $\begingroup$ The question is not addressed directly in the X3DH spec. It seems they believe that MitM is possible because in two places they say "you may check" and later they say "you don't have cryptographic assurance without checking". Also, TLS is not used. I don't know where you see that. My point is that if I can't/don't check, the MitM could be on the SignalServer (or somewhere else) and that person can read all of your messages. If that is the case, it isn't even clear why the X3DH thing is needed. Just use regular Elliptic Curve DH one time. If I have to compare public keys anyway. $\endgroup$ May 5 '20 at 18:57
  • $\begingroup$ I'm asking because I am curious if this can be applied to an automated situation where the parties do not have the ability to confirm out of band with each other. Therefore, if the X3DH doesn't add some "magic" over traditional DH, and a MitM is possible, I would just want to know to figure out if there is some other way to detect them. $\endgroup$ May 5 '20 at 19:07
  • $\begingroup$ @CryptoCurious as pointed out in the quote I've included, authentication is outside the scope of X3DH. TLS is used to protect client/server comms by Signal and WhatsApp, which you've mentioned in your question. The point of X3DH is not to solve the MITM problem, but to add asynchronous support, improve deniability and protection against key compromise. BTW a question on what are the improvements of X3DH over (ephemeral) DH would be a great one which I would also be interested in. $\endgroup$
    – Conrado
    May 5 '20 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.