Question

Consider the following 4-message protocol:

1. A → S: (B, {(A, K1)}KpbS)
2. S → B: A
3. B → S: (A, {(B, K2)}KpbS)
4. S → A: (B, {K2}K1)
And the following attack trace:
1. I(A) → S: (B, {(A, K)}KpbS)
2. S → B: A
3. B → S: (A, {(B, K2)}KpbS)
4. S → I(A): (B, {K2}K)
Which one of these changes to the protocol messages would fix the attack trace above, such as the attack then becomes impossible:
a) 3. B → S: (A, {(B, {K2}KpbA)}KpbS)
b) 4. S → A: (B, {K2, A}K1)
c) 2. S → B: {A}KpbB
d) 2. S → B: B
e) 3. B → S: (A, {(B, {K2}KprS)}KpbS)
f) 1. A → S: {(B, A, K1)}KpbS
g) 1. A → S: (A, {(B, K1)}KpbS)
h) 4. S → A: (B, {K1}K2)
i) 4. S → A: (A, B, {K2}K1)
j) 2. S → B: A, B
Explain your answer below :

Answer 1

The best solution to fix the attack trace is option c) 2. S → B: {A}KpbB, which ensures that the message from the server to B is encrypted with B's public key, thwarting the interceptor's ability to deceive B.

Step-by-step explanation:

The student's question relates to an attack on a cryptographic protocol involving a series of communications between two parties (A and B) and a server (S). The attack occurs because an interceptor (I) replaces the initiator's (A's) message with its own, compromising the key exchange process.

To fix the attack trace, the protocol must ensure that the interceptor cannot use the information gained from the server for its own advantage and that the server can verify the legitimacy of the messages it receives.

Options a, b, c, and f involve enhancing the security by adding encryption with the intended recipient's public key (which the interceptor does not possess), including more identifying information in the encrypted messages, or combining both parties' information in one encrypted message.

Based on the provided choices, option c appears to be the most effective as it ensures that only B can decrypt the message from the server, which includes A's identity. This change would prevent the interceptor from deceiving B into believing it is A, since B would expect the message to be encrypted with B's public key and it would also ensure that A's identity is confirmed.