D   A   T   A   W   O   K

• home
• projects
• keyring
• NOTES
• feed
• propaganda

Cryptographic Key Exchange Protocols

Conventions

• E(K,M): encrypt M using the key K.
• D(K,C): decrypt D using the key K.

Actors

• Alice: protocol first partecipant.
• Bob: protocol second partecipant.
• Eve: eavesdropper.
• Mallory: malicious active attacker.
• Trent: trusted arbitrator.

Notes

In the described attacks it is assumend that Mallory is an active attacker, that is an entity that is able to intercept, remove or modify the messages from the communication channel (e.g. Ethernet).

In a broadcast channel such as a radio network it is almost impossible to replace one message with another.

A Key Distribution Center (KDC), usually impersonated by Trent, is the actor in charge to hold and distribute, on demand, the keys (both public and session).

Using Symmetric Cryptography

Alice and Bob both share a secret key with Trent, KA and KB respectively.

1. Alice calls Trent and requests a session key to communicate with Bob.
2. Trent generates a random key K. Trent sends to Alice: E(KA,K) and E(KB,K).
3. Alice decrypts her copy of the session key.
4. Alice sends to Bob E(KB,K).
5. Bob decrypts his copy of the session key.
6. Both Alice and Bob use K to communicate securely.

Using Public Key Cryptography

Public key cryptography can be used to encrypt the whole communication traffic: Alice encrypts using Bob's public key and Bob encrypts using Alice's public key. However, encrypt traffic using PKC (public key crypto) is computationally expensive, thus an hybrid scheme is often adopted.

Public key cryptography is used to exchange a session key that will be used by a symmetric cipher to encrypt the session traffic.

1. Alice gets Bob's public key Bpub from the KDC.
2. Alice generates a random session key K and sends to Bob E(Bpub, K).
3. Bob decrypts E(Bpub, K) using his private key Kpvt.
4. Both Alice and Bob use K to communicate securely.

The public key exchange protocol can be implemented without Trent's support. In this case Alice asks directly to Bob for his public key.

MITM attack

The protocol is passive to the Man in the Middle attack.

1. In the step '1' Mallory intercepts the KDC reply and substitutes his public key in place of B's one.
2. Mallory intercepts message 2. Decrypts it and gets K.
3. Mallory encrypts the same message using the Bob's public key and sends it to Bob.
4. Both Alice and Bob use K to communicate, but Mallory knows K.

Diffie-Hellman

The protocol allows Alice and Bot to jointly establish a shared secret key over an insecure channel. The peculiarity of the protocol is that the two parties could have no prior knowledge of each other.

1. A public parameter G is shared between the parties.
2. Alice computes X = f(G,Asec), where Asec is secret, and sends it to Bob.
3. Bob computes Y = f(G,Bsec), where Bsec is secret, and sends it to Alice.
4. Alice computes Z = f(Y,Asec).
5. Bob computes Z = f(Y,Bsec).

The protocol requirements are that:

• there is a function f such that f(f(G,Asec),Bsec) = f(f(G,Bsec),Asec).
• it should be computationally infeasible to derive 'sec' from f(G,sec).

The simplest, and original, implementation of the protocol uses the multiplicative group of integers modulo p, where p is prime and g is a primitive root modulo p. These two values are chosen in this way to ensure that the resulting shared secret can take on any value from 1 to p-1.

1. Alice and Bob agree to use a certain modulus p and base g.
2. Alice chooses a secret integer 'a', then sends X = g^a mod p to Bob.
3. Bob chooses a secret integer 'b', then sends Y = g^b mod p to Alice.
4. Alice computes Z = Y^a mod p.
5. Bob computes Z = X^b mod p.
6. K is derived from Z. Both Alice and Bob use K to communicate securely.

Unfortunately, "as-is", the protocol is vulnerable to MitM attack.

Using Digital Signatures

Trent sign both Alice's and Bob's public keys. When Alice and Bob receive the keys, they each verify Trent's signature. Now they know that the key belongs to the other person. Obviously, both parties must have received via a secure channel the Trent's public key to verify it's signature.

The only vulnerability in this architecture is constituted by Trent's private key. If is compromised then Mallory can sign it's own key as a key that belongs to another party, e.g. Alice.

Proudly self-hosted on a cheap Raspberry Pi