11
$\begingroup$

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible.

Standard DHKE

The simple protocol on the multiplicative version as this

Alice and Bob agree on the modulus $p$ and a base $g$ ( For security see Safe Primes )

\begin{array}{lcl} \text{Alice} & \text{Transmit} & \text{Bob}\\ \hline a \stackrel{R}{\leftarrow} \mathbb{Z_p}& & b \stackrel{R}{\leftarrow} \mathbb{Z_p}\\ \text{calculates } A = g^a & \xrightarrow{A} & \text{calculates } B = g^b\\ & \xleftarrow{B} & \text{calculates } s = B^a = (g^a)^b = g^{ab} \\ \text{calculates } s = A^b = (g^b)^a = g^{ab} & & \end{array}

Therefore both sides have agreed on the $s = g^{ab}$ and

Man-in-the-Middle DHKE

Alice and Bob agree on the modulus $p$ and a base $g$ \begin{array}{lcccl} \text{Alice} &\! \text{Trans}\! & \text{MITM} &\! \text{Trans}\! & \text{Bob}\\ \hline a \stackrel{R}{\leftarrow} \mathbb{Z_p}, A = g^a& \xrightarrow{A} & & &b \stackrel{R}{\leftarrow} \mathbb{Z_p},B = g^b\\ & \xleftarrow{T} & t \stackrel{R}{\leftarrow} \mathbb{Z_p}, T = g^t & \xrightarrow{T} & \\ & &\! s_{TA}\! =\! A^t\! =\! (g^a)^t\! =\! g^{at}\! \\ s'\! =\! T^b\! =\! (g^t)^a\! =\! g^{at} & & & \xleftarrow{B} & s= T^b = g^{bt} & & \\ & &\! s_{TB}\! =\! B^t\! =\! (g^b)^t\! =\! g^{bt}\! \\ \end{array}

Now, it is clear that $s \neq s'$ and MITM can listen to the communications by using the keys decrypt, read, encrypt, and transfer, more. This can be detected by fingerprinting or prevented by digital signatures as in TLS.

The Telegram Backdoor (Fixed in 2013)

Alice and Bob agree on the modulus $p$ and a base $g$ \begin{array}{lcccl} \text{Alice} & \text{Trans} & \text{Telegram} & \text{Trans} & \text{Bob}\\ \hline a \stackrel{R}{\leftarrow} \mathbb{Z_p}, A = g^a& & & &b \stackrel{R}{\leftarrow} \mathbb{Z_p},B = g^b\\ & \xrightarrow{A} & t \stackrel{R}{\leftarrow} \mathbb{Z_p}, T = g^t & \xleftarrow{B,nB} & nB \stackrel{R}{\leftarrow} \mathbb{Z_p}\\ & & & \xrightarrow{T} & \\ & & nA = A^t \oplus B^t \oplus nB & & \\ & \xleftarrow{T,nA} & & & & \\ s' = T^a \oplus nA & & & & s= T^b \oplus nB\\ \end{array}

Where the $nA$ is the nonce of Alice and $nB$ is the nonce of Bob.

Now we can see that $s = s'$ since $s = T^b \oplus nB = g^{bt} \oplus nB$ and

\begin{align} s' &= T^a \oplus nA \\ &= g^{ta} \oplus A^t \oplus B^t \oplus nB\\ &= g^{at} \oplus g^{at} \oplus g^{bt} \oplus nB\\ &= g^{bt} \oplus nB \\ &= s \end{align}

Therefore the fingerprinting will not work to detect the MITM attack, however, The server has already information to listen to the communication or more.


Are there any other examples of DHKE backdoors?

$\endgroup$
3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.