Recently Active 'man-in-the-middle' Questions

0

votes

1answer

22 views

Domain Keys Identified Mail (DKIM)

If a company uses Domain Keys Identified Mail ("sender adds a special signature which includes author name / date signed by RSA Private Key. Receiver verifies the signature by looking up the ...

answered 11 hours ago

mti2935

5825 silver badges7 bronze badges

1

vote

1answer

154 views

Why is DH key exchange still useful, if a public key certificate is used?

EDIT: According to Gilles's comments and fgrieu's answer below, I would like to summarize what I have learned, and what's still needs explanation: DHKE is necessary for forward secrecy even when PKI ...

diffie-hellman man-in-the-middle forward-secrecy

modified Jun 8 at 11:32

fgrieu♦

112k9 gold badges242 silver badges476 bronze badges

0

votes

1answer

34 views

Method to mitigate MitM attack for DH key exchange

Plain DH key exchange protocol is vulnerable to MitM attack. I checked the SRP (RFC 2945) but did not fully understand why it can help. I thought of a fix to mitigate MitM problem by using a pre-...

diffie-hellman key-exchange man-in-the-middle

answered Jun 3 at 17:06

SAI Peregrinus

4,05313 silver badges23 bronze badges

1

vote

0answers

39 views

TLS 1.3 Handshake - Usage of MAC and Digital Signature for CertificateVerify and Finished Message

I was wondering, why the TLS 1.3 handshake employs two different 'messages' that compute an authentication code over the whole handshake. As far as I understand, the CertificateVerify "message&...

public-key tls mac man-in-the-middle

modified May 29 at 18:18

Bastian

112 bronze badges

2

votes

1answer

46 views

Dishonest verifier running a concurrent zero-knowledge protocol

Suppose Alice and Bob are engaged in the graph 3-colorability Zero-knowledge protocol in which Alice permutes a coloring $\varphi:V\rightarrow \{1,2,3\}$ for a graph $G(V,E)$, and then sends a ...

zero-knowledge-proofs attack commitments man-in-the-middle soundness

answered Apr 20 at 23:07

Chris Peikert

4,9701 gold badge17 silver badges24 bronze badges

-1

votes

1answer

42 views

Can X3DH algorithm implementation be avoided to thwart Man-in-the-Middle Attack during End-to-End Encryption with Diffie-Hellman Algo, When using SSL

For End-to-End Encryption in chats using Diffie-Hellman Algo the concept of Extended Triple Diffie-Hellman (X3DH) is used to prevent Man-in-the-middle attack (MITM) (courtesy: https://www.qed42.com/...

diffie-hellman tls man-in-the-middle

answered Mar 18 at 19:20

bk2204

3364 bronze badges

3

votes

0answers

189 views

Is MITM possible after key exchange phase done successfully in RSA?

Is MITM attack theoretically possible after public/private key pair exchange is done successfully? Say Alice and Bob have genuine public keys of each other. Is MITM possible further during the ...

rsa authentication key-exchange protocol-analysis man-in-the-middle

modified Mar 14 at 9:53

R1w

1,7563 gold badges15 silver badges37 bronze badges

1

vote

1answer

508 views

Triple Diffie-Hellman and MITM

While reading about Triple Diffie-Hellman, I was wondering how it can prevent MITM if the server decides to spoof key sets. For example, Alice and Bob are connected using a server. Alice ----- ...

encryption diffie-hellman man-in-the-middle

modified Feb 26 at 19:07

Community♦

1

0

votes

1answer

58 views

Does a man-in-the-middle attack apply in this scenario?

Disclaimer: I am aware that the question's title does not adequately describe what I am asking, but it is the best I could come up with. Any improvement is welcome. I am a university student studying ...

encryption keys man-in-the-middle

modified Feb 11 at 18:00

fgrieu♦

112k9 gold badges242 silver badges476 bronze badges

11

votes

0answers

268 views

The backdoor of Telegram on Diffie-Hellman Key Exchange and possible other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...

diffie-hellman man-in-the-middle backdoors

modified Jan 15 at 10:19

kelalaka

36.1k9 gold badges79 silver badges141 bronze badges

11

votes

1answer

3k views

Is quantum key distribution safe against MITM attacks too?

i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution ...

key-exchange man-in-the-middle quantum-key-distribution

modified Nov 15 '20 at 4:57

fgrieu♦

112k9 gold badges242 silver badges476 bronze badges

2

votes

1answer

68 views

MitM with regard to unauthenticated clients

I'm trying to understand how man-in-the-middle attacks are prevented during key exchanges, and am confused by this Wikipedia statement: Use of mutual authentication, in which both the server and the ...

authentication key-exchange man-in-the-middle

modified Aug 21 '20 at 15:00

kelalaka

36.1k9 gold badges79 silver badges141 bronze badges

0

votes

0answers

17 views

What advantage does Pairing using Legacy Pairing (BLE 4.0,4.1 devices) give me over a simple connection between 2 devices?

BLE 4.2 uses something called LESC (LE Secure Connection) for significantly enhancing the link encryption between 2 devices (using public private key pair model). But prior to that the way devices ...

man-in-the-middle

asked Jul 21 '20 at 6:38

Manish Kaul

1

5

votes

4answers

9k views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...

public-key diffie-hellman authentication certificates man-in-the-middle

answered May 5 '20 at 19:16

CryptoCurious

1

0

votes

1answer

149 views

Possibility of Man-in-the-Middle on X3DH

I'm reading about the security of the Signal protocol (used in WhatsApp) and in particular, the X3DH part used to establish authentication, all papers seem to gloss over Man in the Middle attacks. Is ...

diffie-hellman key-exchange man-in-the-middle

answered May 4 '20 at 18:59

Conrado

5,6841 gold badge20 silver badges37 bronze badges

0

votes

0answers

89 views

Diffie-Hellman man-in-the-middle attack

Diffie-Hellman Key Exchange Basic Protocol: Let G be a cyclic group of order $n$ and generator $g$. Alice chooses $a \in \{0,\ldots,n-1\}$ and Bob chooses $b \in \{0,\ldots,n-1\}$. ...

diffie-hellman authentication man-in-the-middle

asked May 3 '20 at 11:32

Leafar

2932 silver badges10 bronze badges

1

vote

1answer

31 views

If two hosts are using a transparent IP level authentication and encryption, is their communication subject to both MITM or replay attacks?

Encryption process for any outgoing packet to the specified "remote IP": -original payload P is encrypted (the bytes after the IP header) using RC4 with the preestablished key ...

authenticated-encryption md5 rc4 man-in-the-middle replay-attack

modified Apr 25 '20 at 23:33

Adrian Self

1398 bronze badges

5

votes

0answers

139 views

Multilinear trapdoor commitments secure against concurrent man-in-the-middle attacks

I am trying to understand how to apply a multi-trapdoor commitment described by Gennaro and what makes them secure against a concurrent MiM attack. There are two ways to construct a multi-trapdoor ...

commitments man-in-the-middle

modified Apr 15 '20 at 23:45

R1w

1,7563 gold badges15 silver badges37 bronze badges

0

votes

0answers

27 views

Can Alice encrypt a message to Bob without hiding anything from Eve? [duplicate]

I know that if Alice and Bob both have secret-public key pairs, they can use RSA for example. If we remove the possibility that Alice can know anything which Eve doesn't (ie Alice's secret key), is ...

man-in-the-middle

asked Feb 29 '20 at 20:41

zabop

1012 bronze badges

1

vote

3answers

193 views

Negotiate a secure connection without certificates?

I would like to have a simple experience for a user for setting up a secure connection between two computers against a MITM attack. Something like the following: A number (possibly base64) appears ...

encryption rsa public-key signature man-in-the-middle

modified Jan 16 '20 at 19:16

kelalaka

36.1k9 gold badges79 silver badges141 bronze badges

1

vote

0answers

56 views

attacks and defenses on multi party Diffie-Hellman protocol

I tried to create a 4 partied Diffie-Hellman implementation for 4 people using its cyclic group property. However, I am not sure regarding those 2 issues, and would appreciate if you could elaborate ...

encryption diffie-hellman attack man-in-the-middle

asked Jan 5 '20 at 17:28

Crypto123

111 bronze badge

0

votes

0answers

36 views

Server stored, encypted messaging app

For my personal research, I have to create a messaging app, but security is only important part of application, security from MITM (man in the middle attack), at device end, and at server level. (note:...

encryption rsa aes diffie-hellman man-in-the-middle

modified Dec 31 '19 at 7:03

Jay seen

1011 bronze badge

2

votes

1answer

144 views

How is Diffle Hellman with RSA immune to man in the middle?

Alice and Bob want to exchange keys, Alice sends his half (the public key of the ephemeral key pair) signed with his private key and makes the public key available. Eve is bridging the connection so ...

rsa public-key diffie-hellman authentication man-in-the-middle

modified Dec 10 '19 at 11:54

Gaurav Pant

1255 bronze badges

0

votes

0answers

94 views

How does DHE-RSA work and why is PFS guaranteed?

How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.

rsa diffie-hellman certificates man-in-the-middle forward-secrecy

asked Nov 10 '19 at 17:40

NightRain23

533 bronze badges

0

votes

1answer

74 views

Observing cipher suites and certificate algorithms without man-in-the-middle

I manage a proxy server. Is it technically possible to observe and determine which cipher suite is selected between end points (client and server) without changing their SSL certificate, without ...

encryption tls certificates man-in-the-middle

modified Oct 11 '19 at 10:03

cygnusv

4,6671 gold badge18 silver badges43 bronze badges

2

votes

1answer

238 views

Man-in-the-middle attack on text-book RSA PKE

I am attempting to solve the following problem: I know the following: 3 messages are being sent between Alice and Bob, all messages are encrypted with the known public key $(d,N)$: Alice sends ...

encryption rsa public-key man-in-the-middle

modified Oct 7 '19 at 11:51

Maarten Bodewes♦

79k12 gold badges128 silver badges273 bronze badges

2

votes

1answer

622 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...

attack man-in-the-middle

modified Sep 28 '19 at 18:05

Squeamish Ossifrage

43.6k3 gold badges88 silver badges185 bronze badges

0

votes

1answer

37 views

Is it necessary to have a certificate when we use TLS

When we say a communication is secured by the latest version of TLS, can we say that Man-in-the-Middle attack is not possible? Do not consider the situations that we can down grade the communication ...

authentication tls man-in-the-middle

answered Sep 28 '19 at 14:40

Steffen Ullrich

1,2887 silver badges9 bronze badges

2

votes

3answers

2k views

Diffie-Hellman algorithm and MITM attack

How does the Diffie-Hellman algorithm prevent MITM attack? I have tried to search about it but i couldn't find any understandable reasons.

diffie-hellman man-in-the-middle

modified Sep 28 '19 at 10:04

puzzlepalace

3,8721 gold badge15 silver badges40 bronze badges

1

vote

0answers

146 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...

protocol-design man-in-the-middle pki identity-based-encryption

modified Sep 26 '19 at 15:25

Patriot

2,4163 gold badges12 silver badges47 bronze badges

2

votes

5answers

852 views

Is use of pre-shared key for sharing session key in symmetric key cryptography vulnerable to MITM?

Consider the following protocol: ...

symmetric key-exchange man-in-the-middle

modified Sep 26 '19 at 3:21

Patriot

2,4163 gold badges12 silver badges47 bronze badges

3

votes

1answer

5k views

MiTM on RSA public key encryption

a) Alice just generated a new pair of public and private RSA keys (pkA , skA ) = ((N, e), d) and would like to start a private conversation with Bob. How can Alice interact with Bob and exchange a ...

rsa diffie-hellman man-in-the-middle

modified Sep 25 '19 at 12:19

Community♦

1

vote

1answer

139 views

Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time

I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them ...

elliptic-curves key-exchange man-in-the-middle

answered Sep 8 '19 at 18:10

mentallurg

1,6211 gold badge11 silver badges17 bronze badges

0

votes

1answer

183 views

Authentication and integrity

I was trying to solve this problem: Sometimes Alice needs to send a file to Bob, guaranteeing her identity and the file integrity (no confidentiality required); the two parties are sharing a secret w ...

authentication integrity man-in-the-middle

modified Aug 22 '19 at 23:02

Community♦

1

0

votes

1answer

182 views

Needham–Schroeder fix by adding opponent's identity to the first message

Recap: Needham–Schroeder is as follows: $A \rightarrow B : \{A, N_a\}_{pk_B}$ $B \rightarrow A : \{N_a, N_b\}_{pk_A}$ $A \rightarrow B : \{N_b\}_{pk_B}$ Then, there is a MITM attack by Lowe ...

protocol-design man-in-the-middle needham-schroeder

modified Aug 19 '19 at 18:01

Community♦

1

0

votes

1answer

471 views

How is STS more secure than regular DH

I'm trying to understand the STS protocol (using the wikipedia page as source), but I don't see how this protocol is any more secure than DH regarding man in the middle attacks. If Alice and Bob don'...

diffie-hellman man-in-the-middle

answered Jul 27 '19 at 19:49

Mark

5,28610 silver badges22 bronze badges

1

vote

1answer

75 views

How are public keys securely and reliably obtained across the internet?

I've just decided to start learning all about PKIs, and I have come across what seems like a paradox. When fetching a public key from either a server or a CA, how can we be sure that the public key ...

public-key tls certificates man-in-the-middle pki

answered Jun 30 '19 at 15:32

Gilles 'SO- stop being evil'

14.7k3 gold badges39 silver badges75 bronze badges

0

votes

1answer

199 views

Entity authentication protocol by encryption

I'm not a cryptography expert, so excuse me if the question seems very trivial. I need to know if this protocol is secure against a MiTM attacks and ensure a safe entity authentication method. We ...

encryption authentication authenticated-encryption man-in-the-middle replay-attack

modified May 28 '19 at 12:06

thinker.92

1271 silver badge7 bronze badges

0

votes

1answer

79 views

Is this man in middle atack possible in quantum cryptography? [duplicate]

Lets consider there is channel between Alice and Bob, sequered with quantum cryptography. To put it simple, Alice is left, Bob is right and the quantum states are 'up' ~ U and 'down' ~ D. Alice ...

quantum-cryptography man-in-the-middle

modified May 22 '19 at 11:46

poncho

121k6 gold badges193 silver badges314 bronze badges

1

vote

2answers

399 views

What can I do, if my SRP password verifier was stolen?

I've got a system that works like this: ...

authentication man-in-the-middle srp

answered May 19 '19 at 16:42

malbrain

11 bronze badge

7

votes

3answers

2k views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...

aes diffie-hellman man-in-the-middle

answered Mar 11 '19 at 22:00

Squeamish Ossifrage

43.6k3 gold badges88 silver badges185 bronze badges

0

votes

0answers

97 views

How to decrypt plain text x using man in the middle attack

Suppose Alice want to share a plain text $x = 5$ to Bob; using RSA, DHKE, and El-Gamal. My question is if Man-in-the-middle attack is applied then weather oscar can compute/decrypt plain text in all ...

rsa diffie-hellman elgamal-encryption man-in-the-middle

modified Jan 23 '19 at 20:51

kelalaka

36.1k9 gold badges79 silver badges141 bronze badges

1

vote

0answers

125 views

Security of the Needham-Schroeder public key protocol after a minor adjustment

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer: We have the Needham Schroeder Public Key Protocol:...

public-key key-exchange protocol-analysis man-in-the-middle needham-schroeder

modified Jan 15 '19 at 12:28

CowNorris

1113 bronze badges

2

votes

1answer

369 views

Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack

Trying to turn bookish knowledge to practical: Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, ...

attack protocol-analysis man-in-the-middle

modified Jan 5 '19 at 19:23

kelalaka

36.1k9 gold badges79 silver badges141 bronze badges

0

votes

1answer

619 views

Public key on Server Key Exchange Generation vs Public key on Server's Certificate

To understand the distinction between TLS 1.2 and TLS 1.3. I am stuck in the past understanding for TLS and the current reference I am studying: As I know certificate goes with owner's public key, ...

public-key diffie-hellman tls man-in-the-middle

modified Dec 27 '18 at 11:26

Gilles 'SO- stop being evil'

14.7k3 gold badges39 silver badges75 bronze badges

2

votes

1answer

232 views

Detect MITM with hashed session-key — Is my protocol secure?

I have the following setup: An app ("client") wants to communicate securely with a device I created ("server"). The client has the public key of the server (and a hashed password) preinstalled. I use ...

public-key diffie-hellman protocol-design symmetric man-in-the-middle

modified Nov 14 '18 at 16:37

fgrieu♦

112k9 gold badges242 silver badges476 bronze badges

1

vote

2answers

84 views

How is it possible for a VPN connection to be created through the ISP?

I will be theoretical here. Let's say you want to create a VPN connection with some VPN provider. You have to agree on some key to encrypt the data. how can you get the key without your ISP knowing it?...

encryption keys man-in-the-middle

answered Jul 9 '18 at 1:02

Weikeng Chen

5143 silver badges13 bronze badges

-1

votes

2answers

547 views

MD5 hash functions to prove integrity of a download

It doesn't take a lot of time on the crypto StackExchange to realise the sentiment around MD5 hash functions is poor. My questions are: If it's such a bad idea to make use of MD5 hash functions why ...

collision-resistance md5 man-in-the-middle

modified Jun 20 '18 at 18:14

Future Security

3,0521 gold badge6 silver badges24 bronze badges

6

votes

1answer

349 views

What is 'Carry-forward verification' defense against MITM?

Wikipedia article on Man-in-the-middle attack mentions, in the list of defenses against it, some method called "Carry-forward verification", but it does not explain it. I am curious about different ...

authentication key-exchange man-in-the-middle

modified Jun 14 '18 at 3:52

e-sushi

16.9k12 gold badges71 silver badges206 bronze badges

0

votes

1answer

235 views

Digital certificate issuing man-in-the-middle attack

While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key). To certify a domain ...

tls certificates man-in-the-middle

modified Apr 28 '18 at 0:41

Community♦

1

Questions tagged [man-in-the-middle]

Related Tags