Skip to main content
10 votes

ECDH Man-in-the-middle active attack

Diffie-Hellman (and variants such as ECDH) protect against passive eavesdroppers, but not (at least by themselves) against active man-in-the-middle attacks. An active MITM can substitute his own keys ...
Gordon Davisson's user avatar
9 votes
Accepted

Why is SRP considered to be resistant to MITM attack?

As has already been commented: The fact that you can intercept and relay all messages does not actually constitute an attack on the protocol because you do not know the shared key afterwards. If the ...
Elias's user avatar
  • 4,923
7 votes
Accepted

How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶

As far as I know your attack is the best attack known, unless something better has very recently been published. Please note that for DES as the basic cipher the chosen $A$ may not work, but you can ...
kodlu's user avatar
  • 22.7k
7 votes

Diffie-Hellman algorithm and MITM attack

The problem lies in the trust of the public key. If an attacker can simply replace one of the exchanged public keys with his own then an active MitM attack is possible. The attacker simply replaces ...
Maarten Bodewes's user avatar
  • 93.2k
7 votes
Accepted

How is Diffle Hellman with RSA immune to man in the middle?

He [Ed: Eve] then sends his half to Alice signed and establishes a connection. Now Alice is communicating with Eve and Eve is decrypting the message and sending to Bob. Eve can only sign with her own ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes

Does humanly verifiable one time pad authentication exist?

I'll use $m\boxplus k$ for combining characters $m$ and $k$ by addition (modulo $n=28$) within the character set, or strings of individual characters of equal-length, rather than " m ⊕ k " in the ...
fgrieu's user avatar
  • 142k
6 votes
Accepted

In Diffie-Hellman, can everything be sent in plaintext?

TLDR: Diffie-Hellman key exchange works differently Yes, DH is vulnerable to MitM. Long answer: Diffie-Hellman key exchange isn't about sending the public key with some kind of signature, but about ...
Samuel Shifterovich's user avatar
5 votes

How does Bluetooth pairing (SSP with numeric comparison) work?

I think that you miss the point of this method. You can think of this SSP as a key-exchange protocol between two devices which have nothing shared between them a priori and also the entire ...
Bush's user avatar
  • 2,140
5 votes
Accepted

Proof that any key exchange protocol is vulnerable to MitM attacks in the absence of shared information or trust

It has nothing to do with information theoretic. You just need to construct an adversary and argue that it works. In this case, the adversary is simple. Let $A$ and $B$ be parties with no secret ...
Yehuda Lindell's user avatar
5 votes

Can a man in the middle tell what kind of encryption you're using from a key exchange?

There are subfields of cryptography research dedicated to make it hard to detect what ciphers and key exchange algorithms are being used. There are several rigorous approaches: Making the ...
Wilson's user avatar
  • 929
4 votes

Is this Diffie-Hellman key exchange variant vulnerable to man-in-the-middle attacks?

It is secure against private key exposure but not against replay attacks by Eve. A three-way protocol avoids this, and doesn't need to use timestamps. The description below is from Delfs and Knebl's ...
kodlu's user avatar
  • 22.7k
4 votes
Accepted

How are public keys securely and reliably obtained across the internet?

In a public-key infrastructure, there are two ways a public key can be trusted: either because it's signed by a certificate authority that you trust, or because you already have it in a list of ...
Gilles 'SO- stop being evil''s user avatar
3 votes

Does DTLS in WebRTC protect from active Man-in-the-Middle?

WebRTC uses DTLS-SRTP and according to RFC 5764 DTLS-SRTP supports certificates for both client and server. However in the context of WebRTC the direct connection established between the users is ...
Elias's user avatar
  • 4,923
3 votes

SRP and compromised verifier

As pointed by the question, in SRP an attacker knowing the verifier can impersonate the server. That's not against the security objectives of SRP. To carry the attack, the attacker also needs to know ...
fgrieu's user avatar
  • 142k
3 votes
Accepted

Why are some websites seemingly immune to self-signed certificate MitM attacks?

The short answer is HTTP Strict Transport Security . When a web application issues HSTS Policy to user agents, conformant user agents behave as follows: Automatically turn any insecure ...
tangrs's user avatar
  • 145
3 votes
Accepted

Does humanly verifiable one time pad authentication exist?

Create an "alphabet" containing every single possible tweet character exactly once, and construct a tabula recta based on this "alphabet". Let a plaintext character be a checksum. Calculate the ...
Meler Lawler's user avatar
3 votes

Does humanly verifiable one time pad authentication exist?

I've recently been interested in adding message integrity and authentication to hand ciphers, as I belong to a group of hobbyist classical cipher puzzle solvers, so discussions in this vein get people ...
Aaron Toponce's user avatar
3 votes
Accepted

Is there a way to inercept encrypted https connections by mimicking a cert authority?

Yes, this works, but the trick is that you'd need a certificate and private key signed by a certificate authority that authenticates the specific location you are browsing to. This certificate has to ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes

Is there a method/protocol to validate a self-signed certificate by comparing a shortened hash?

TL;DR: Using words instead of strings / images may be a good solution for short, easy-to-verify codes and using locality / time dependent verification codes strengthens short hashes as would using ...
SEJPM's user avatar
  • 46.1k
3 votes

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

As far as I understood the problem, the difference between IKEv1 Aggressive and Main Mode is how the hashed PSK is sent. Of course, the PSK itself is never sent to the other side as both sides need ...
Mecki's user avatar
  • 187
3 votes
Accepted

Public key on Server Key Exchange Generation vs Public key on Server's Certificate

TLS ≤1.2 allows different types of handshakes where the key exchange and the authentication rely on different mechanisms. The type of handshake is determined by the choice of cipher suite. The page ...
Gilles 'SO- stop being evil''s user avatar
3 votes

Diffie-Hellman algorithm and MITM attack

The answer depends on the attack your are interested in. For passive attackers who are eavesdropping on the exchanging of information, the attacker has to solve an instance of the Diffie-Hellman ...
kkl's user avatar
  • 383
3 votes

Public-key/asymmetric encryption where you can only leak the decrypted message by leaking your password

Your idea of an encryption method including a nonce, and in a way that Alice cannot recover the nonce is practical; however it doesn't solve your problem. One possibility would be a variant of El ...
poncho's user avatar
  • 148k
2 votes

Vulnerabilities if encrypting the same data with 2 different keys

Yes, this does help Eve, in the sense that it reduces her costs below what you might have naively expected of a $b$-bit key. Fortunately, this help is not enough to matter for AES-256. This is the ...
Squeamish Ossifrage's user avatar
2 votes
Accepted

Is this Diffie-Hellman key exchange variant vulnerable to man-in-the-middle attacks?

Short answer: No, it is not vulnerable to man-in-the-middle attacks, assuming that Alice and Bob each have the right signature verification key of the other party. Yet, the man-in-the-middle attack ...
aguellie's user avatar
  • 171
2 votes

Does humanly verifiable one time pad authentication exist?

Authentication in one-time pad systems was a problem in WW2. How it was solved historically in the SOE at least: an agent has a pre-agreed error pattern (like making a spelling mistake in the seventh ...
Henno Brandsma's user avatar
2 votes

Does humanly verifiable one time pad authentication exist?

I didn't think it has to be this complicated, but the complexity is slowly creeping up. We make every message the same length, from your question 160 characters, my method adds an extra message (the ...
daniel's user avatar
  • 912
2 votes

Does humanly verifiable one time pad authentication exist?

Use a secret permutation of the alphabet as the top and side of the tabula recta used to encrypt and decrypt messages.
Meler Lawler's user avatar
2 votes

Negotiate a secure connection without certificates?

There are two possible standard ways to handle this, depending on whether you just want to verify this connection or whether you want to verify another device. First note that all MITM-attacks (by ...
SEJPM's user avatar
  • 46.1k
2 votes

Negotiate a secure connection without certificates?

If you have a side channel where you can verify a string is identical you can simply do a Diffi Hellman key exchange and then verify both sides have the same resulting key. If the side channnel is ...
Meir Maor's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible