Questions tagged [man-in-the-middle]

A man-in-the-middle (MITM) attack is an active attack where the attacker is able to interpose himself between the sender and receiver. The attacker may monitor and/or modify some or all of the messages sent between the two endpoints.

Filter by
Sorted by
Tagged with
11
votes
1answer
3k views

Is quantum key distribution safe against MITM attacks too?

i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution ...
23
votes
2answers
27k views

Why is TLS susceptible to protocol downgrade attacks?

A recent blog post from Ivan Ristić (expert extraordinaire on all things SSL) says: all major browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions ...
7
votes
3answers
2k views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...
9
votes
1answer
2k views

How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶

I am trying to solve something and I have but I have no idea anymore. Maybe anyone of you has an idea/solution/hint. Given is a block cipher $F$ with key length $n$. It looks like this: $$c = ENC_{k1}...
11
votes
0answers
268 views

The backdoor of Telegram on Diffie-Hellman Key Exchange and possible other examples?

Diffie-Hellman Key-Exchange (DHKE) should be used carefully during the end-to-end encryption. A man-in-the-middle (MITM) attack is possible. Standard DHKE The simple protocol on the multiplicative ...
5
votes
4answers
9k views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...
1
vote
1answer
8k views

What is a man-in-the-middle attack (for instance in Diffie-Hellman)?

I'm new to cryptography and I just started learning about the Diffie-Hellman key agreement. I read that this system is vulnerable to a man-in-the-middle attack when used alone. What kind of attack is ...
5
votes
4answers
19k views

Diffie-Hellman and man-in-the-middle attacks

See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman? How do we combat this? I have two questions: Is one solution for both Alice and Bob just ...
3
votes
1answer
1k views

Man-in-the-middle attack on Diffie-Hellman with shared public keys?

Is it correct to say if the public key is known to all users beforehand, Diffie-Hellman key exchange is not vulnerable to man in the middle attack? Sample key exchange ( assuming all users public ...
2
votes
1answer
369 views

Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack

Trying to turn bookish knowledge to practical: Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, ...
1
vote
2answers
399 views

What can I do, if my SRP password verifier was stolen?

I've got a system that works like this: ...
2
votes
2answers
164 views

Transmit half the bits of the $g^a$ and $g^b$ as MITM countermeasure in DH key exchange?

I remember this trick from one of my crypto courses way back then, but I can't find the details, and I'm unable to figure out the logic behind it. I'm talking about a countermeasure to the MITM ...
1
vote
0answers
171 views

HMAC usage in hybrid encryption scheme [duplicate]

Consider the following hybrid encryption scheme (B3||4 is for concatenated IV and AES-CBC encrypted message): ------------------------------------------------------...
1
vote
3answers
193 views

Negotiate a secure connection without certificates?

I would like to have a simple experience for a user for setting up a secure connection between two computers against a MITM attack. Something like the following: A number (possibly base64) appears ...
1
vote
1answer
102 views

Is it Possible to Generate a Duplicate DH Session Key from 2 Pairs of DH Keys?

This might sound pointless at first, but I want to know if it's computationally feasible to generate the same resulting session key in 2 different DH key exchanges. The purpose would be for a man-in-...
0
votes
1answer
34 views

Method to mitigate MitM attack for DH key exchange

Plain DH key exchange protocol is vulnerable to MitM attack. I checked the SRP (RFC 2945) but did not fully understand why it can help. I thought of a fix to mitigate MitM problem by using a pre-...