Skip to main content

Questions tagged [man-in-the-middle]

A man-in-the-middle (MITM) attack is an active attack where the attacker is able to interpose himself between the sender and receiver. The attacker may monitor and/or modify some or all of the messages sent between the two endpoints.

23 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
14 votes
0 answers
942 views

The backdoor of Telegram on Diffie-Hellman Key Exchange and possibly other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...
kelalaka's user avatar
  • 49k
5 votes
0 answers
176 views

Multilinear trapdoor commitments secure against concurrent man-in-the-middle attacks

I am trying to understand how to apply a multi-trapdoor commitment described by Gennaro and what makes them secure against a concurrent MiM attack. There are two ways to construct a multi-trapdoor ...
omnomnom's user avatar
  • 491
3 votes
0 answers
373 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...
Bastian's user avatar
  • 31
3 votes
0 answers
174 views

Is the "Pico" alternative to passwords vulnerable to man-in-the-middle?

Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting. Regarding the paper, ...
chris000r's user avatar
  • 519
3 votes
0 answers
197 views

Is MITM possible after key exchange phase done successfully in RSA?

Is MITM attack theoretically possible after public/private key pair exchange is done successfully? Say Alice and Bob have genuine public keys of each other. Is MITM possible further during the ...
user40349's user avatar
2 votes
0 answers
96 views

Questions about TLS 1.3 inspection with commercial middleboxes

i'm trying to learn how commercial (for example PaloAlto or Fortigate) middleboxes intercept and decrypt TLS 1.3 traffic. To do that I started observing the TLS traffic between the client, middlebox ...
nkovana's user avatar
  • 21
2 votes
0 answers
480 views

MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
izac's user avatar
  • 89
2 votes
0 answers
221 views

Is it possible to perform one-way Diffie-Hellman MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
d33tah's user avatar
  • 363
1 vote
0 answers
44 views

Dealing with MITM attack in e-voting systems

I've read many e-voting papers that use El-Gamal scheme which I recall is vulnerable to man-in-the-middle attack, yet I find no discussion or even mentioning of it in those papers. -Does anyone knows ...
ShAr's user avatar
  • 160
1 vote
0 answers
36 views

Can attacker eavesdrop on the user credentials during WPA2 (802.1X) handshake?

In a WPA2 (802.1X) scenario, there are 3 entities -> Supplicant (client), Authenticator (router) and Authentication server (Radius server). Radius server performs the authentication process and, as ...
hexHujer's user avatar
1 vote
0 answers
36 views

Proof that exchanged variable was not modified with MITM

If I understand correctly, the core of man in the middle attack is in being able to replace an exchanged variable (public key) with another. Hence to detect a MITM one needs to check if the exchanged ...
user369070's user avatar
1 vote
0 answers
94 views

attacks and defenses on multi party Diffie-Hellman protocol

I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property. However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...
Crypto123's user avatar
1 vote
0 answers
216 views

Security of the Needham-Schroeder public key protocol after a minor adjustment

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer: We have the Needham Schroeder Public Key Protocol:...
CowNorris's user avatar
  • 111
1 vote
0 answers
1k views

Diffie-Hellman combined with DSA/RSA

we have learned Diffie-Hellman, RSA and DSA (Digital Signature Algorithm) in university. Because DH is vulnerable of Man-in-the-Middle we had the task to program the DH combined with RSA to protect ...
L3n95's user avatar
  • 111
1 vote
0 answers
149 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...
ytti's user avatar
  • 153
0 votes
0 answers
28 views

Is the MITM protection provided by BLE LESC passkey mechanism bidirectional?

I'm trying to understand whether the passkey mechanism described in BLE LESC pairing provides bidirectional MITM protection. As far as I understand, A and B will generate the same shared secret using ...
cheapjuice's user avatar
0 votes
0 answers
27 views

How two secure elements can safely authenticate each other without a third party?

Assume there are multiple secure elements, and also multiple man-in-the-middle or malwares. How can any two secure elements authenticate each other without a third party and hard coding something in ...
MJay's user avatar
  • 103
0 votes
0 answers
33 views

How can I impersonate Bob without creating a new session

Good morning, I've been struggling with this protocol for the last few days and I'm out of ideas now. The goal is to impersonate Bob by just modifying or dropping packages. The attacker(me) is a Proxy ...
Goel77's user avatar
  • 1
0 votes
0 answers
237 views

Diffie-Hellman man-in-the-middle attack

Diffie-Hellman Key Exchange Basic Protocol: Let G be a cyclic group of order $n$ and generator $g$. Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$. ...
Leafar's user avatar
  • 325
0 votes
0 answers
40 views

Server stored, encypted messaging app

For my personal research, I have to create a messaging app, but security is only important part of application, security from MITM (man in the middle attack), at device end, and at server level. (note:...
Jay seen's user avatar
  • 101
0 votes
0 answers
237 views

How does DHE-RSA work and why is PFS guaranteed?

How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.
NightRain23's user avatar
0 votes
0 answers
161 views

How to decrypt plain text x using man in the middle attack

Suppose Alice want to share a plain text $x = 5$ to Bob; using RSA, DHKE, and El-Gamal. My question is if Man-in-the-middle attack is applied then weather oscar can compute/decrypt plain text in all ...
Hafiz Siddiq's user avatar
0 votes
1 answer
350 views

Needham–Schroeder fix by adding opponent's identity to the first message

Recap: Needham–Schroeder is as follows: $A \rightarrow B : \{A, N_a\}_{pk_B}$ $B \rightarrow A : \{N_a, N_b\}_{pk_A}$ $A \rightarrow B : \{N_b\}_{pk_B}$ Then, there is a MITM attack by Lowe ...
iesiyok's user avatar