I am trying to solve the next question:

A client needs authenticate to a server. The client and a system share the server public-key. Denoted here as K. The client sends to the system a message requiring an authentication, and the server responds with a nonce. What does the client send to the server as respost in order to prevent replay attack

  1. The result of encrypt a nonce with symmetric cryptography and a key K.
  2. The result of sum K to the nonce.
  3. A OK message
  4. The result of encrypt a nonce with asymmetric cryptography and a key K.
  5. The digest of the nonce

Could you help me with this question please?. For me this question is strange because (1) and (2). Specifically, I think that I do not need to send any key K to the server because this key is a public key. Thus, I think the respost is or (2) or (5). Could you help me, please?

  • 1
    $\begingroup$ To be honest, I'm confused by the scenario. The client appears to need to authenticate to the server, but the client doesn't have any non-public data; wouldn't an attacker be able to perform the same protocol as the client? If the message that the client initially sends is an encrypted (with K) password, well, that sort-of works (the plaintext message is the non-public data), however since none of responses refer back to the message, I don't see how any of them deal with an adversary that replays the encrypted password. You might want to think about "what is this replay attack?" $\endgroup$ – poncho Jul 20 '20 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.