Recently Active 'man-in-the-middle' Questions

9

votes

0answers

146 views

The backdoor of Telegram on Diffie-Hellman Key Exchange and possible other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...

modified 2 days ago

kelalaka

29.1k7 gold badges70 silver badges121 bronze badges

11

votes

1answer

3k views

Is quantum key distribution safe against MITM attacks too?

i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution ...

key-exchange man-in-the-middle quantum-key-distribution

modified Nov 15 '20 at 4:57

fgrieu♦

108k9 gold badges228 silver badges459 bronze badges

1

vote

1answer

317 views

Triple Diffie-Hellman and MITM

While reading about Triple Diffie-Hellman, I was wondering how it can prevent MITM if the server decides to spoof key sets. For example, Alice and Bob are connected using a server. Alice ----- ...

encryption diffie-hellman man-in-the-middle

modified Oct 29 '20 at 18:01

Community♦

1

2

votes

1answer

62 views

MitM with regard to unauthenticated clients

I'm trying to understand how man-in-the-middle attacks are prevented during key exchanges, and am confused by this Wikipedia statement: Use of mutual authentication, in which both the server and the ...

authentication key-exchange man-in-the-middle

modified Aug 21 '20 at 15:00

kelalaka

29.1k7 gold badges70 silver badges121 bronze badges

0

votes

0answers

15 views

What advantage does Pairing using Legacy Pairing (BLE 4.0,4.1 devices) give me over a simple connection between 2 devices?

BLE 4.2 uses something called LESC (LE Secure Connection) for significantly enhancing the link encryption between 2 devices (using public private key pair model). But prior to that the way devices ...

man-in-the-middle

asked Jul 21 '20 at 6:38

Manish Kaul

1

5

votes

4answers

9k views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...

public-key diffie-hellman authentication certificates man-in-the-middle

answered May 5 '20 at 19:16

CryptoCurious

1

0

votes

1answer

87 views

Possibility of Man-in-the-Middle on X3DH

I'm reading about the security of the Signal protocol (used in WhatsApp) and in particular, the X3DH part used to establish authentication, all papers seem to gloss over Man in the Middle attacks. Is ...

diffie-hellman key-exchange man-in-the-middle

answered May 4 '20 at 18:59

Conrado

5,3991 gold badge19 silver badges35 bronze badges

0

votes

0answers

65 views

Diffie-Hellman man-in-the-middle attack

Diffie-Hellman Key Exchange Basic Protocol: Let G be a cyclic group of order $n$ and generator $g$. Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$. ...

diffie-hellman authentication man-in-the-middle

asked May 3 '20 at 11:32

Leafar

2932 silver badges10 bronze badges

1

vote

1answer

30 views

If two hosts are using a transparent IP level authentication and encryption, is their communication subject to both MITM or replay attacks?

Encryption process for any outgoing packet to the specified "remote IP": -original payload P is encrypted (the bytes after the IP header) using RC4 with the preestablished key ...

authenticated-encryption md5 rc4 man-in-the-middle replay-attack

modified Apr 25 '20 at 23:33

Adrian Self

1418 bronze badges

5

votes

0answers

131 views

Multilinear trapdoor commitments secure against concurrent man-in-the-middle attacks

I am trying to understand how to apply a multi-trapdoor commitment described by Gennaro and what makes them secure against a concurrent MiM attack. There are two ways to construct a multi-trapdoor ...

commitments man-in-the-middle

modified Apr 15 '20 at 23:45

R1w

1,5862 gold badges13 silver badges36 bronze badges

0

votes

0answers

26 views

Can Alice encrypt a message to Bob without hiding anything from Eve? [duplicate]

I know that if Alice and Bob both have secret-public key pairs, they can use RSA for example. If we remove the possibility that Alice can know anything which Eve doesn't (ie Alice's secret key), is ...

man-in-the-middle

asked Feb 29 '20 at 20:41

zabop

1012 bronze badges

1

vote

3answers

181 views

Negotiate a secure connection without certificates?

I would like to have a simple experience for a user for setting up a secure connection between two computers against a MITM attack. Something like the following: A number (possibly base64) appears ...

encryption rsa public-key signature man-in-the-middle

modified Jan 16 '20 at 19:16

kelalaka

29.1k7 gold badges70 silver badges121 bronze badges

1

vote

0answers

47 views

attacks and defenses on multi party Diffie-Hellman protocol

I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property. However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...

encryption diffie-hellman attack man-in-the-middle

asked Jan 5 '20 at 17:28

Crypto123

111 bronze badge

0

votes

0answers

34 views

Server stored, encypted messaging app

For my personal research, I have to create a messaging app, but security is only important part of application, security from MITM (man in the middle attack), at device end, and at server level. (note:...

encryption rsa aes diffie-hellman man-in-the-middle

modified Dec 31 '19 at 7:03

Jay seen

1011 bronze badge

2

votes

1answer

125 views

How is Diffle Hellman with RSA immune to man in the middle?

Alice and Bob want to exchange keys, Alice sends his half (the public key of the ephemeral key pair) signed with his private key and makes the public key available. Eve is bridging the connection so ...

rsa public-key diffie-hellman authentication man-in-the-middle

modified Dec 10 '19 at 11:54

Gaurav Pant

1255 bronze badges

0

votes

0answers

76 views

How does DHE-RSA work and why is PFS guaranteed?

How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.

rsa diffie-hellman certificates man-in-the-middle forward-secrecy

asked Nov 10 '19 at 17:40

NightRain23

533 bronze badges

0

votes

1answer

71 views

Observing cipher suites and certificate algorithms without man-in-the-middle

I manage a proxy server. Is it technically possible to observe and determine which cipher suite is selected between end points (client and server) without changing their SSL certificate, without ...

encryption tls certificates man-in-the-middle

modified Oct 11 '19 at 10:03

cygnusv

4,6071 gold badge17 silver badges42 bronze badges

2

votes

1answer

193 views

Man-in-the-middle attack on text-book RSA PKE

I am attempting to solve the following problem: I know the following: 3 messages are being sent between Alice and Bob, all messages are encrypted with the known public key $(d,N)$: Alice sends ...

encryption rsa public-key man-in-the-middle

modified Oct 7 '19 at 11:51

Maarten Bodewes♦

75.9k11 gold badges117 silver badges257 bronze badges

2

votes

1answer

548 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...

attack man-in-the-middle

modified Sep 28 '19 at 18:05

Squeamish Ossifrage

42.4k3 gold badges83 silver badges175 bronze badges

0

votes

1answer

36 views

Is it necessary to have a certificate when we use TLS

When we say a communication is secured by the latest version of TLS, can we say that Man-in-the-Middle attack is not possible? Do not consider the situations that we can down grade the communication ...

authentication tls man-in-the-middle

answered Sep 28 '19 at 14:40

Steffen Ullrich

1,2887 silver badges9 bronze badges

2

votes

3answers

2k views

Diffie-Hellman algorithm and MITM attack

How does the Diffie-Hellman algorithm prevent MITM attack? I have tried to search about it but i couldn't find any understandable reasons.

diffie-hellman man-in-the-middle

modified Sep 28 '19 at 10:04

puzzlepalace

3,8421 gold badge15 silver badges39 bronze badges

1

vote

0answers

145 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...

protocol-design man-in-the-middle pki identity-based-encryption

modified Sep 26 '19 at 15:25

Patriot

1,9782 gold badges9 silver badges39 bronze badges

2

votes

5answers

831 views

Is use of pre-shared key for sharing session key in symmetric key cryptography vulnerable to MITM?

Consider the following protocol: ...

symmetric key-exchange man-in-the-middle

modified Sep 26 '19 at 3:21

Patriot

1,9782 gold badges9 silver badges39 bronze badges

3

votes

1answer

4k views

MiTM on RSA public key encryption

a) Alice just generated a new pair of public and private RSA keys (pkA , skA ) = ((N, e), d) and would like to start a private conversation with Bob. How can Alice interact with Bob and exchange a ...

rsa diffie-hellman man-in-the-middle

modified Sep 25 '19 at 12:19

Community♦

1

vote

1answer

109 views

Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time

I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them ...

elliptic-curves key-exchange man-in-the-middle

answered Sep 8 '19 at 18:10

mentallurg

1,4491 gold badge11 silver badges17 bronze badges

0

votes

1answer

171 views

Authentication and integrity

I was trying to solve this problem: Sometimes Alice needs to send a file to Bob, guaranteeing her identity and the file integrity (no confidentiality required); the two parties are sharing a secret w ...

authentication integrity man-in-the-middle

modified Aug 22 '19 at 23:02

Community♦

1

0

votes

1answer

147 views

Needham–Schroeder fix by adding opponent's identity to the first message

Recap: Needham–Schroeder is as follows: $A \rightarrow B : \{A, N_a\}_{pk_B}$ $B \rightarrow A : \{N_a, N_b\}_{pk_A}$ $A \rightarrow B : \{N_b\}_{pk_B}$ Then, there is a MITM attack by Lowe ...

protocol-design man-in-the-middle needham-schroeder

modified Aug 19 '19 at 18:01

Community♦

1

0

votes

1answer

349 views

How is STS more secure than regular DH

I'm trying to understand the STS protocol (using the wikipedia page as source), but I don't see how this protocol is any more secure than DH regarding man in the middle attacks. If Alice and Bob don'...

diffie-hellman man-in-the-middle

answered Jul 27 '19 at 19:49

Mark

3,6386 silver badges18 bronze badges

1

vote

1answer

70 views

How are public keys securely and reliably obtained across the internet?

I've just decided to start learning all about PKIs, and I have come across what seems like a paradox. When fetching a public key from either a server or a CA, how can we be sure that the public key ...

public-key tls certificates man-in-the-middle pki

answered Jun 30 '19 at 15:32

Gilles 'SO- stop being evil'

13.5k3 gold badges37 silver badges71 bronze badges

0

votes

1answer

167 views

Entity authentication protocol by encryption

I'm not a cryptography expert, so excuse me if the question seems very trivial. I need to know if this protocol is secure against a MiTM attacks and ensure a safe entity authentication method. We ...

encryption authentication authenticated-encryption man-in-the-middle replay-attack

modified May 28 '19 at 12:06

thinker.92

1171 silver badge7 bronze badges

0

votes

1answer

75 views

Is this man in middle atack possible in quantum cryptography? [duplicate]

Lets consider there is channel between Alice and Bob, sequered with quantum cryptography. To put it simple, Alice is left, Bob is right and the quantum states are 'up' ~ U and 'down' ~ D. Alice ...

quantum-cryptography man-in-the-middle

modified May 22 '19 at 11:46

poncho

115k5 gold badges186 silver badges295 bronze badges

1

vote

2answers

363 views

What can I do, if my SRP password verifier was stolen?

I've got a system that works like this: ...

authentication man-in-the-middle srp

answered May 19 '19 at 16:42

malbrain

11 bronze badge

7

votes

3answers

2k views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...

aes diffie-hellman man-in-the-middle

answered Mar 11 '19 at 22:00

Squeamish Ossifrage

42.4k3 gold badges83 silver badges175 bronze badges

0

votes

0answers

76 views

How to decrypt plain text x using man in the middle attack

Suppose Alice want to share a plain text $x = 5$ to Bob; using RSA, DHKE, and El-Gamal. My question is if Man-in-the-middle attack is applied then weather oscar can compute/decrypt plain text in all ...

rsa diffie-hellman elgamal-encryption man-in-the-middle

modified Jan 23 '19 at 20:51

kelalaka

29.1k7 gold badges70 silver badges121 bronze badges

1

vote

0answers

112 views

Security of the Needham-Schroeder public key protocol after a minor adjustment

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer: We have the Needham Schroeder Public Key Protocol:...

public-key key-exchange protocol-analysis man-in-the-middle needham-schroeder

modified Jan 15 '19 at 12:28

CowNorris

1113 bronze badges

2

votes

1answer

324 views

Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack

Trying to turn bookish knowledge to practical: Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, ...

attack protocol-analysis man-in-the-middle

modified Jan 5 '19 at 19:23

kelalaka

29.1k7 gold badges70 silver badges121 bronze badges

0

votes

1answer

545 views

Public key on Server Key Exchange Generation vs Public key on Server's Certificate

To understand the distinction between TLS 1.2 and TLS 1.3. I am stuck in the past understanding for TLS and the current reference I am studying: As I know certificate goes with owner's public key, ...

public-key diffie-hellman tls man-in-the-middle

modified Dec 27 '18 at 11:26

Gilles 'SO- stop being evil'

13.5k3 gold badges37 silver badges71 bronze badges

2

votes

1answer

208 views

Detect MITM with hashed session-key — Is my protocol secure?

I have the following setup: An app ("client") wants to communicate securely with a device I created ("server"). The client has the public key of the server (and a hashed password) preinstalled. I use ...

public-key diffie-hellman protocol-design symmetric man-in-the-middle

modified Nov 14 '18 at 16:37

fgrieu♦

108k9 gold badges228 silver badges459 bronze badges

1

vote

2answers

82 views

How is it possible for a VPN connection to be created through the ISP?

I will be theoretical here. Let's say you want to create a VPN connection with some VPN provider. You have to agree on some key to encrypt the data. how can you get the key without your ISP knowing it?...

encryption keys man-in-the-middle

answered Jul 9 '18 at 1:02

Weikeng Chen

5043 silver badges13 bronze badges

-1

votes

2answers

523 views

MD5 hash functions to prove integrity of a download

It doesn't take a lot of time on the crypto StackExchange to realise the sentiment around MD5 hash functions is poor. My questions are: If it's such a bad idea to make use of MD5 hash functions why ...

collision-resistance md5 man-in-the-middle

modified Jun 20 '18 at 18:14

Future Security

3,0201 gold badge5 silver badges24 bronze badges

6

votes

1answer

348 views

What is 'Carry-forward verification' defense against MITM?

Wikipedia article on Man-in-the-middle attack mentions, in the list of defenses against it, some method called "Carry-forward verification", but it does not explain it. I am curious about different ...

authentication key-exchange man-in-the-middle

modified Jun 14 '18 at 3:52

e-sushi

16.9k9 gold badges69 silver badges204 bronze badges

0

votes

1answer

230 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...

tls certificates man-in-the-middle

modified Apr 28 '18 at 0:41

Community♦

1

-1

votes

1answer

175 views

ECDH vs MITM ablity to change content

We all know how DH is great, and ECDH is much greater, but only in case of Eve spying on public keys, so how can ECDH defeat the ablity of "Eve" to change the public keys between Bob and Alice with ...

encryption diffie-hellman man-in-the-middle

modified Feb 15 '18 at 5:57

Squeamish Ossifrage

42.4k3 gold badges83 silver badges175 bronze badges

2

votes

2answers

155 views

Transmit half the bits of the $g^a$ and $g^b$ as MITM countermeasure in DH key exchange?

I remember this trick from one of my crypto courses way back then, but I can't find the details, and I'm unable to figure out the logic behind it. I'm talking about a countermeasure to the MITM ...

diffie-hellman man-in-the-middle

answered Feb 6 '18 at 1:20

Squeamish Ossifrage

42.4k3 gold badges83 silver badges175 bronze badges

1

vote

1answer

99 views

Is it Possible to Generate a Duplicate DH Session Key from 2 Pairs of DH Keys?

This might sound pointless at first, but I want to know if it's computationally feasible to generate the same resulting session key in 2 different DH key exchanges. The purpose would be for a man-in-...

public-key diffie-hellman attack man-in-the-middle

modified Feb 5 '18 at 5:31

Community♦

1

vote

2answers

75 views

Is it impossible to have a decentralized service using email addresses as login?

Let's say we have a decentralized service S distributed on a network of 1000 nodes/servers. Is it possible to have a registration/sign up scheme using email address ...

public-key man-in-the-middle

answered Jan 30 '18 at 23:06

Acccumulation

1412 bronze badges

3

votes

1answer

1k views

Man-in-the-middle attack on Diffie-Hellman with shared public keys?

Is it correct to say if the public key is known to all users beforehand, Diffie-Hellman key exchange is not vulnerable to man in the middle attack? Sample key exchange ( assuming all users public ...

diffie-hellman man-in-the-middle

modified Jan 22 '18 at 6:38

Maarten Bodewes♦

75.9k11 gold badges117 silver badges257 bronze badges

4

votes

1answer

3k views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...

key-exchange man-in-the-middle dictionary-attack ipsec

modified Jan 17 '18 at 17:02

Mecki

1577 bronze badges

1

vote

1answer

37 views

Organizational Internal Man In The Middle Scenario

Question. I'm a software developer. I design and write secured systems for my customer. My customer recently downward directed that all traffic to/from my server be routed through a new appliance. I ...

encryption public-key man-in-the-middle

modified Dec 30 '17 at 1:56

Maarten Bodewes♦

75.9k11 gold badges117 silver badges257 bronze badges

1

vote

1answer

605 views

MITM defense in Diffie-Hellman protocol

Let's consider that Alice and Bob both know a shared secret $secret$ and don't know each other DH public keys. They want to authenticate each other and their keys using only $secret$. Let's also ...

diffie-hellman authentication key-exchange man-in-the-middle

modified Jul 1 '17 at 14:34

Community♦

1

Questions tagged [man-in-the-middle]

Related Tags