Skip to main content
Cryptography

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • $\begingroup$ What identification scheme? Based on the supposed shared secret that they think they have? Then how does Bob distinguish Mallory from Alice, if the former does an active attack on both phases? $\endgroup$ Commented Jun 8, 2013 at 13:06
  • $\begingroup$ @HennoBrandsma, yes, in original draft authentication is based on shared secret, so if channel is secure, in most trivial case Alice could just send Bob plaintext password. Mallory does not know Alice's random symmetric session key, as it was encrypted for Bob only. If Mallory forges Alice request to hold her key instead of Alice's, Mallory won't be able to forward Bob's response back to Alice, as she does not know original key. Mallory is also unable to obtain shared secret told by Alice to Bob by listening, as it's encrypted by random symmetric key, which Mallory was unable to retrieve. $\endgroup$ Commented Jun 8, 2013 at 14:30
  • $\begingroup$ If they already share a secret password, cannot they base their scheme on that? Like SRP? Why bother with the RSA? $\endgroup$ Commented Jun 8, 2013 at 14:34
  • $\begingroup$ When Alice first meets Bob, she has to tell him her random chosen persistent secret for Bob to recognize her later - like registration. Bob assumes nothing about Alice upon their first meet. Alice cannot use DH due to MITM threat, so she sends her secret encrypted by Bob's public key - and the only way Mallory could interfere with this is to "register" herself too, without getting access to Alice-Bob communication. They don't use the same session key derived from Alice's secret because I've thought it's safer to choose random key each time. $\endgroup$ Commented Jun 8, 2013 at 14:56
  • 1
    $\begingroup$ First, the PKE may need to be IND-CCA1 or IND-CCA2, depending on whether its used by any other people and whether Bob will permanently abort on a single failed attempt. $\:$ Second, this is very much not forward-secure. $\;\;$ $\endgroup$ Commented Jun 8, 2013 at 20:29