Recently Active 'man-in-the-middle' Questions

5

votes

4answers

8k views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...

answered May 5 at 19:16

CryptoCurious

1

0

votes

1answer

44 views

Possibility of Man-in-the-Middle on X3DH

I'm reading about the security of the Signal protocol (used in WhatsApp) and in particular, the X3DH part used to establish authentication, all papers seem to gloss over Man in the Middle attacks. Is ...

diffie-hellman key-exchange man-in-the-middle

answered May 4 at 18:59

Conrado

4,8191 gold badge16 silver badges32 bronze badges

0

votes

0answers

42 views

Diffie-Hellman man-in-the-middle attack

Diffie-Hellman Key Exchange Basic Protocol: Let G be a cyclic group of order $n$ and generator $g$. Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$. ...

diffie-hellman authentication man-in-the-middle

asked May 3 at 11:32

Leafar

2932 silver badges10 bronze badges

1

vote

1answer

26 views

If two hosts are using a transparent IP level authentication and encryption, is their communication subject to both MITM or replay attacks?

Encryption process for any outgoing packet to the specified "remote IP": -original payload P is encrypted (the bytes after the IP header) using RC4 with the preestablished key ...

authenticated-encryption md5 rc4 man-in-the-middle replay-attack

modified Apr 25 at 23:33

Adrian Self

1388 bronze badges

5

votes

0answers

117 views

Multilinear trapdoor commitments secure against concurrent man-in-the-middle attacks

I am trying to understand how to apply a multi-trapdoor commitment described by Gennaro and what makes them secure against a concurrent MiM attack. There are two ways to construct a multi-trapdoor ...

commitments man-in-the-middle

modified Apr 15 at 23:45

R1w

1,4642 gold badges9 silver badges33 bronze badges

1

vote

1answer

118 views

Triple Diffie-Hellman and MITM

While reading about Triple Diffie-Hellman, I was wondering how it can prevent MITM if the server decides to spoof key sets. For example, Alice and Bob are connected using a server. Alice ----- ...

encryption diffie-hellman man-in-the-middle

modified Mar 3 at 17:03

Community♦

1

0

votes

0answers

23 views

Can Alice encrypt a message to Bob without hiding anything from Eve? [duplicate]

I know that if Alice and Bob both have secret-public key pairs, they can use RSA for example. If we remove the possibility that Alice can know anything which Eve doesn't (ie Alice's secret key), is ...

man-in-the-middle

asked Feb 29 at 20:41

zabop

1011 bronze badge

1

vote

3answers

178 views

Negotiate a secure connection without certificates?

I would like to have a simple experience for a user for setting up a secure connection between two computers against a MITM attack. Something like the following: A number (possibly base64) appears ...

encryption rsa public-key signature man-in-the-middle

modified Jan 16 at 19:16

kelalaka

18.8k5 gold badges46 silver badges77 bronze badges

1

vote

0answers

37 views

attacks and defenses on multi party Diffie-Hellman protocol

I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property. However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...

encryption diffie-hellman attack man-in-the-middle

asked Jan 5 at 17:28

Crypto123

111 bronze badge

0

votes

0answers

33 views

Server stored, encypted messaging app

For my personal research, I have to create a messaging app, but security is only important part of application, security from MITM (man in the middle attack), at device end, and at server level. (note:...

encryption rsa aes diffie-hellman man-in-the-middle

modified Dec 31 '19 at 7:03

Jaikey Sarraf

1011 bronze badge

2

votes

1answer

107 views

How is Diffle Hellman with RSA immune to man in the middle?

Alice and Bob want to exchange keys, Alice sends his half (the public key of the ephemeral key pair) signed with his private key and makes the public key available. Eve is bridging the connection so ...

rsa public-key diffie-hellman authentication man-in-the-middle

modified Dec 10 '19 at 11:54

Gaurav Pant

1255 bronze badges

0

votes

0answers

57 views

How does DHE-RSA work and why is PFS guaranteed?

How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.

rsa diffie-hellman certificates man-in-the-middle forward-secrecy

asked Nov 10 '19 at 17:40

NightRain23

533 bronze badges

0

votes

1answer

64 views

Observing cipher suites and certificate algorithms without man-in-the-middle

I manage a proxy server. Is it technically possible to observe and determine which cipher suite is selected between end points (client and server) without changing their SSL certificate, without ...

encryption tls certificates man-in-the-middle

modified Oct 11 '19 at 10:03

cygnusv

4,5371 gold badge16 silver badges39 bronze badges

2

votes

1answer

157 views

Man-in-the-middle attack on text-book RSA PKE

I am attempting to solve the following problem: I know the following: 3 messages are being sent between Alice and Bob, all messages are encrypted with the known public key $(d,N)$: Alice sends ...

encryption rsa public-key man-in-the-middle

modified Oct 7 '19 at 11:51

Maarten Bodewes♦

70.3k10 gold badges105 silver badges237 bronze badges

2

votes

1answer

474 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...

attack man-in-the-middle

modified Sep 28 '19 at 18:05

Squeamish Ossifrage

40.7k3 gold badges78 silver badges167 bronze badges

0

votes

1answer

35 views

Is it necessary to have a certificate when we use TLS

When we say a communication is secured by the latest version of TLS, can we say that Man-in-the-Middle attack is not possible? Do not consider the situations that we can down grade the communication ...

authentication tls man-in-the-middle

answered Sep 28 '19 at 14:40

Steffen Ullrich

1,2536 silver badges9 bronze badges

2

votes

3answers

836 views

Diffie-Hellman algorithm and MITM attack

How does the Diffie-Hellman algorithm prevent MITM attack? I have tried to search about it but i couldn't find any understandable reasons.

diffie-hellman man-in-the-middle

modified Sep 28 '19 at 10:04

puzzlepalace

3,8021 gold badge12 silver badges37 bronze badges

1

vote

0answers

144 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...

protocol-design man-in-the-middle pki identity-based-encryption

modified Sep 26 '19 at 15:25

Patriot

1,9252 gold badges8 silver badges33 bronze badges

2

votes

5answers

789 views

Is use of pre-shared key for sharing session key in symmetric key cryptography vulnerable to MITM?

Consider the following protocol: ...

symmetric key-exchange man-in-the-middle

modified Sep 26 '19 at 3:21

Patriot

1,9252 gold badges8 silver badges33 bronze badges

3

votes

1answer

4k views

MiTM on RSA public key encryption

a) Alice just generated a new pair of public and private RSA keys (pkA , skA ) = ((N, e), d) and would like to start a private conversation with Bob. How can Alice interact with Bob and exchange a ...

rsa diffie-hellman man-in-the-middle

modified Sep 25 '19 at 12:19

Patriot

1,9252 gold badges8 silver badges33 bronze badges

1

vote

1answer

79 views

Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time

I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them ...

elliptic-curves key-exchange man-in-the-middle

answered Sep 8 '19 at 18:10

mentallurg

8546 silver badges15 bronze badges

0

votes

1answer

163 views

Authentication and integrity

I was trying to solve this problem: Sometimes Alice needs to send a file to Bob, guaranteeing her identity and the file integrity (no confidentiality required); the two parties are sharing a secret w ...

authentication integrity man-in-the-middle

modified Aug 22 '19 at 23:02

Community♦

1

0

votes

1answer

76 views

Needham–Schroeder fix by adding opponent's identity to the first message

Recap: Needham–Schroeder is as follows: $A \rightarrow B : \{A, N_a\}_{pk_B}$ $B \rightarrow A : \{N_a, N_b\}_{pk_A}$ $A \rightarrow B : \{N_b\}_{pk_B}$ Then, there is a MITM attack by Lowe ...

protocol-design man-in-the-middle needham-schroeder

modified Aug 19 '19 at 18:01

Community♦

1

0

votes

1answer

197 views

How is STS more secure than regular DH

I'm trying to understand the STS protocol (using the wikipedia page as source), but I don't see how this protocol is any more secure than DH regarding man in the middle attacks. If Alice and Bob don'...

diffie-hellman man-in-the-middle

answered Jul 27 '19 at 19:49

Mark

2,0905 silver badges14 bronze badges

1

vote

1answer

66 views

How are public keys securely and reliably obtained across the internet?

I've just decided to start learning all about PKIs, and I have come across what seems like a paradox. When fetching a public key from either a server or a CA, how can we be sure that the public key ...

public-key tls certificates man-in-the-middle pki

answered Jun 30 '19 at 15:32

Gilles 'SO- stop being evil'

12.4k3 gold badges34 silver badges65 bronze badges

0

votes

1answer

135 views

Entity authentication protocol by encryption

I'm not a cryptography expert, so excuse me if the question seems very trivial. I need to know if this protocol is secure against a MiTM attacks and ensure a safe entity authentication method. We ...

encryption authentication authenticated-encryption man-in-the-middle replay-attack

modified May 28 '19 at 12:06

thinker.92

1171 silver badge7 bronze badges

0

votes

1answer

71 views

Is this man in middle atack possible in quantum cryptography? [duplicate]

Lets consider there is channel between Alice and Bob, sequered with quantum cryptography. To put it simple, Alice is left, Bob is right and the quantum states are 'up' ~ U and 'down' ~ D. Alice ...

quantum-cryptography man-in-the-middle

modified May 22 '19 at 11:46

poncho

108k3 gold badges174 silver badges278 bronze badges

1

vote

2answers

309 views

What can I do, if my SRP password verifier was stolen?

I've got a system that works like this: ...

authentication man-in-the-middle srp

answered May 19 '19 at 16:42

malbrain

11 bronze badge

7

votes

3answers

2k views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...

aes diffie-hellman man-in-the-middle

answered Mar 11 '19 at 22:00

Squeamish Ossifrage

40.7k3 gold badges78 silver badges167 bronze badges

0

votes

0answers

50 views

How to decrypt plain text x using man in the middle attack

Suppose Alice want to share a plain text $x = 5$ to Bob; using RSA, DHKE, and El-Gamal. My question is if Man-in-the-middle attack is applied then weather oscar can compute/decrypt plain text in all ...

rsa diffie-hellman elgamal-encryption man-in-the-middle

modified Jan 23 '19 at 20:51

kelalaka

18.8k5 gold badges46 silver badges77 bronze badges

1

vote

0answers

91 views

Security of the Needham-Schroeder public key protocol after a minor adjustment

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer: We have the Needham Schroeder Public Key Protocol:...

public-key key-exchange protocol-analysis man-in-the-middle needham-schroeder

modified Jan 15 '19 at 12:28

CowNorris

1113 bronze badges

2

votes

1answer

299 views

Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack

Trying to turn bookish knowledge to practical: Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, ...

attack protocol-analysis man-in-the-middle

modified Jan 5 '19 at 19:23

kelalaka

18.8k5 gold badges46 silver badges77 bronze badges

0

votes

1answer

403 views

Public key on Server Key Exchange Generation vs Public key on Server's Certificate

To understand the distinction between TLS 1.2 and TLS 1.3. I am stuck in the past understanding for TLS and the current reference I am studying: As I know certificate goes with owner's public key, ...

public-key diffie-hellman tls man-in-the-middle

modified Dec 27 '18 at 11:26

Gilles 'SO- stop being evil'

12.4k3 gold badges34 silver badges65 bronze badges

2

votes

1answer

185 views

Detect MITM with hashed session-key — Is my protocol secure?

I have the following setup: An app ("client") wants to communicate securely with a device I created ("server"). The client has the public key of the server (and a hashed password) preinstalled. I use ...

public-key diffie-hellman protocol-design symmetric man-in-the-middle

modified Nov 14 '18 at 16:37

fgrieu

101k9 gold badges213 silver badges428 bronze badges

1

vote

2answers

82 views

How is it possible for a VPN connection to be created through the ISP?

I will be theoretical here. Let's say you want to create a VPN connection with some VPN provider. You have to agree on some key to encrypt the data. how can you get the key without your ISP knowing it?...

encryption keys man-in-the-middle

answered Jul 9 '18 at 1:02

Weikeng Chen

5042 silver badges13 bronze badges

-1

votes

2answers

474 views

MD5 hash functions to prove integrity of a download

It doesn't take a lot of time on the crypto StackExchange to realise the sentiment around MD5 hash functions is poor. My questions are: If it's such a bad idea to make use of MD5 hash functions why ...

collision-resistance md5 man-in-the-middle

modified Jun 20 '18 at 18:14

Future Security

2,9651 gold badge5 silver badges23 bronze badges

6

votes

1answer

346 views

What is 'Carry-forward verification' defense against MITM?

Wikipedia article on Man-in-the-middle attack mentions, in the list of defenses against it, some method called "Carry-forward verification", but it does not explain it. I am curious about different ...

authentication key-exchange man-in-the-middle

modified Jun 14 '18 at 3:52

e-sushi

16.6k9 gold badges69 silver badges198 bronze badges

0

votes

1answer

219 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...

tls certificates man-in-the-middle

modified Apr 28 '18 at 0:41

Community♦

1

-1

votes

1answer

139 views

ECDH vs MITM ablity to change content

We all know how DH is great, and ECDH is much greater, but only in case of Eve spying on public keys, so how can ECDH defeat the ablity of "Eve" to change the public keys between Bob and Alice with ...

encryption diffie-hellman man-in-the-middle

modified Feb 15 '18 at 5:57

Squeamish Ossifrage

40.7k3 gold badges78 silver badges167 bronze badges

2

votes

2answers

143 views

Transmit half the bits of the $g^a$ and $g^b$ as MITM countermeasure in DH key exchange?

I remember this trick from one of my crypto courses way back then, but I can't find the details, and I'm unable to figure out the logic behind it. I'm talking about a countermeasure to the MITM ...

diffie-hellman man-in-the-middle

answered Feb 6 '18 at 1:20

Squeamish Ossifrage

40.7k3 gold badges78 silver badges167 bronze badges

1

vote

1answer

96 views

Is it Possible to Generate a Duplicate DH Session Key from 2 Pairs of DH Keys?

This might sound pointless at first, but I want to know if it's computationally feasible to generate the same resulting session key in 2 different DH key exchanges. The purpose would be for a man-in-...

public-key diffie-hellman attack man-in-the-middle

modified Feb 5 '18 at 5:31

Community♦

1

vote

2answers

73 views

Is it impossible to have a decentralized service using email addresses as login?

Let's say we have a decentralized service S distributed on a network of 1000 nodes/servers. Is it possible to have a registration/sign up scheme using email address ...

public-key man-in-the-middle

answered Jan 30 '18 at 23:06

Acccumulation

1312 bronze badges

3

votes

1answer

988 views

Man-in-the-middle attack on Diffie-Hellman with shared public keys?

Is it correct to say if the public key is known to all users beforehand, Diffie-Hellman key exchange is not vulnerable to man in the middle attack? Sample key exchange ( assuming all users public ...

diffie-hellman man-in-the-middle

modified Jan 22 '18 at 6:38

Maarten Bodewes♦

70.3k10 gold badges105 silver badges237 bronze badges

4

votes

1answer

3k views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...

key-exchange man-in-the-middle dictionary-attack ipsec

modified Jan 17 '18 at 17:02

Mecki

1577 bronze badges

1

vote

1answer

35 views

Organizational Internal Man In The Middle Scenario

Question. I'm a software developer. I design and write secured systems for my customer. My customer recently downward directed that all traffic to/from my server be routed through a new appliance. I ...

encryption public-key man-in-the-middle

modified Dec 30 '17 at 1:56

Maarten Bodewes♦

70.3k10 gold badges105 silver badges237 bronze badges

1

vote

1answer

557 views

MITM defense in Diffie-Hellman protocol

Let's consider that Alice and Bob both know a shared secret $secret$ and don't know each other DH public keys. They want to authenticate each other and their keys using only $secret$. Let's also ...

diffie-hellman authentication key-exchange man-in-the-middle

modified Jul 1 '17 at 14:34

Community♦

1

3

votes

0answers

160 views

Is the “Pico” alternative to passwords vulnerable to man-in-the-middle?

Maybe someone has already heard about "Pico" by Frank Stajano. In short: It is a model for an alternative for using passwords for authentication and seems to be very interesting. Regarding the paper, ...

authentication attack man-in-the-middle

modified Jun 1 '17 at 4:24

otus

29.8k5 gold badges56 silver badges141 bronze badges

2

votes

2answers

1k views

Prevent MITM attack while encrypting data by using ElGamal ECC?

I am using ElGamal ECC to encrypt my plain text data. I want to ensure that my data is safe from a Man-In-The-Middle attack. What methodology I can adopt to achieve this goal? How can we prevent a ...

elliptic-curves elgamal-encryption man-in-the-middle

modified May 27 '17 at 13:19

Maarten Bodewes♦

70.3k10 gold badges105 silver badges237 bronze badges

0

votes

2answers

249 views

Securing an end-to-end encrypted cloud based address book

I am analyzing an existing end-to-end encrypted, cloud based service (e.g. email, file storage or chat) which also has a public cloud based address book (for managing contacts) so that users of the ...

encryption public-key authentication hmac man-in-the-middle

modified May 12 '17 at 5:43

rmalayter

2,16312 silver badges23 bronze badges

1

vote

0answers

165 views

HMAC usage in hybrid encryption scheme [duplicate]

Consider the following hybrid encryption scheme (B3||4 is for concatenated IV and AES-CBC encrypted message): ------------------------------------------------------...

encryption man-in-the-middle aes rsa hmac

Apr 10 '17 at 12:00

ddnomad

1265 bronze badges

Questions tagged [man-in-the-middle]

Related Tags