9
votes
Accepted
Why is SRP considered to be resistant to MITM attack?
As has already been commented:
The fact that you can intercept and relay all messages does not actually constitute an attack on the protocol because you do not know the shared key afterwards. If the ...
- 4,933
7
votes
Accepted
How can I attack a Triple-Block cipher with 2 keys (like 3DES) with a cost of ≤ 2⁵⁶
As far as I know your attack is the best attack known, unless something better has very recently been published.
Please note that for DES as the basic cipher the chosen $A$ may not work, but you can ...
- 23.7k
7
votes
Diffie-Hellman algorithm and MITM attack
The problem lies in the trust of the public key. If an attacker can simply replace one of the exchanged public keys with his own then an active MitM attack is possible. The attacker simply replaces ...
- 94.5k
7
votes
Accepted
How is Diffle Hellman with RSA immune to man in the middle?
He [Ed: Eve] then sends his half to Alice signed and establishes a connection. Now Alice is communicating with Eve and Eve is decrypting the message and sending to Bob.
Eve can only sign with her own ...
- 94.5k
6
votes
Does humanly verifiable one time pad authentication exist?
I'll use $m\boxplus k$ for combining characters $m$ and $k$ by addition (modulo $n=28$) within the character set, or strings of individual characters of equal-length, rather than " m ⊕ k " in the ...
- 146k
6
votes
Accepted
In Diffie-Hellman, can everything be sent in plaintext?
TLDR:
Diffie-Hellman key exchange works differently
Yes, DH is vulnerable to MitM.
Long answer:
Diffie-Hellman key exchange isn't about sending the public key with some kind of signature, but about ...
5
votes
Accepted
Proof that any key exchange protocol is vulnerable to MitM attacks in the absence of shared information or trust
It has nothing to do with information theoretic. You just need to construct an adversary and argue that it works. In this case, the adversary is simple. Let $A$ and $B$ be parties with no secret ...
- 28.2k
5
votes
Can a man in the middle tell what kind of encryption you're using from a key exchange?
There are subfields of cryptography research dedicated to make it hard to detect what ciphers and key exchange algorithms are being used. There are several rigorous approaches:
Making the ...
- 949
4
votes
Accepted
How are public keys securely and reliably obtained across the internet?
In a public-key infrastructure, there are two ways a public key can be trusted: either because it's signed by a certificate authority that you trust, or because you already have it in a list of ...
3
votes
Accepted
Does humanly verifiable one time pad authentication exist?
Create an "alphabet" containing every single possible tweet character exactly once, and construct a tabula recta based on this "alphabet".
Let a plaintext character be a checksum. Calculate the ...
- 325
3
votes
Does humanly verifiable one time pad authentication exist?
I've recently been interested in adding message integrity and authentication to hand ciphers, as I belong to a group of hobbyist classical cipher puzzle solvers, so discussions in this vein get people ...
- 246
3
votes
Does DTLS in WebRTC protect from active Man-in-the-Middle?
WebRTC uses DTLS-SRTP and according to RFC 5764 DTLS-SRTP supports certificates for both client and server.
However in the context of WebRTC the direct connection established between the users is ...
- 4,933
3
votes
SRP and compromised verifier
As pointed by the question, in SRP an attacker knowing the verifier can impersonate the server. That's not against the security objectives of SRP.
To carry the attack, the attacker also needs to know ...
- 146k
3
votes
Accepted
Why are some websites seemingly immune to self-signed certificate MitM attacks?
The short answer is HTTP Strict Transport Security
.
When a web application issues HSTS Policy to user agents, conformant
user agents behave as follows:
Automatically turn any insecure ...
- 145
3
votes
What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?
As far as I understood the problem, the difference between IKEv1 Aggressive and Main Mode is how the hashed PSK is sent.
Of course, the PSK itself is never sent to the other side as both sides need ...
- 187
3
votes
Accepted
Public key on Server Key Exchange Generation vs Public key on Server's Certificate
TLS ≤1.2 allows different types of handshakes where the key exchange and the authentication rely on different mechanisms. The type of handshake is determined by the choice of cipher suite. The page ...
3
votes
Diffie-Hellman algorithm and MITM attack
The answer depends on the attack your are interested in.
For passive attackers who are eavesdropping on the exchanging of information, the attacker has to solve an instance of the Diffie-Hellman ...
- 393
3
votes
Public-key/asymmetric encryption where you can only leak the decrypted message by leaking your password
Your idea of an encryption method including a nonce, and in a way that Alice cannot recover the nonce is practical; however it doesn't solve your problem.
One possibility would be a variant of El ...
- 151k
2
votes
Vulnerabilities if encrypting the same data with 2 different keys
Yes, this does help Eve, in the sense that it reduces her costs below what you might have naively expected of a $b$-bit key. Fortunately, this help is not enough to matter for AES-256.
This is the ...
- 49.5k
2
votes
Does humanly verifiable one time pad authentication exist?
Authentication in one-time pad systems was a problem in WW2. How it was solved historically in the SOE at least: an agent has a pre-agreed error pattern (like making a spelling mistake in the seventh ...
- 3,852
2
votes
Does humanly verifiable one time pad authentication exist?
I didn't think it has to be this complicated, but the complexity is slowly creeping up.
We make every message the same length, from your question 160 characters, my method adds an extra message (the ...
- 912
2
votes
Does humanly verifiable one time pad authentication exist?
Use a secret permutation of the alphabet as the top and side of the tabula recta used to encrypt and decrypt messages.
- 325
2
votes
Accepted
ECDH vs MITM ablity to change content
Traditionally Eve does not meddle with what she sees on the wire she's eavesdropping. That task is reserved for Mallory, the MITM, or malarkey-in-the-middle.
From a protocol perspective, it makes no ...
- 49.5k
2
votes
Negotiate a secure connection without certificates?
There are two possible standard ways to handle this, depending on whether you just want to verify this connection or whether you want to verify another device.
First note that all MITM-attacks (by ...
- 46.4k
2
votes
Negotiate a secure connection without certificates?
If you have a side channel where you can verify a string is identical you can simply do a Diffi Hellman key exchange and then verify both sides have the same resulting key.
If the side channnel is ...
- 12k
2
votes
Does humanly verifiable one time pad authentication exist?
You could use a slight variant of Encrypt-last-block CBC-MAC (ECBC-MAC) with a random single-character permutation plus a one-time pad character per MAC tag "digit". ECBC-MAC is easy to ...
- 21
2
votes
What can I do, if my SRP password verifier was stolen?
In SRP, if the server-side password verifier leaks, that does not immediately allow login to the server. That "only" exposes the password to brute force search in a dictionary (each password test ...
- 146k
2
votes
Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack
Let begin with some definitions;
Passive attack: When the attacker only observes and not interacts with any of the parties it is called the Passive Attack. Detection of a passive attack is difficult ...
- 49.5k
2
votes
Is this man in middle atack possible in quantum cryptography?
Is there something wrong it this scenario?
Obviously, yes. Any such QKD system would require an authenticated channel back from Bob to Alice; that's to make sure that Bob is the one that's actually ...
- 151k
2
votes
Entity authentication protocol by encryption
In general, no, this is not safe, and in the cases where it is safe it's wasteful.
The safe (but wasteful) cases are those where you're already using an Authenticated Encryption with Associated Data (...
- 5,899
Only top scored, non community-wiki answers of a minimum length are eligible