Suppose that someone suggests the following way to Alice and Bob to confirm that

Question

Suppose that someone suggests the following way to Alice and Bob to confirm that the two of them are in the possession of the same secret key. (Assume that a third party is tasked with distributing shared keys.) Alice creates a random bit string, representing a random integer, which is of the same length as the secret key. Then she XORs the random string with the key and sends the result over to Bob over an open channel. Bob XORs the incoming message with the secret key, gets some string representing a number, increments it by 1, XORs it with the key he has, and sends back the resulting message back to Alice. Alice checks, and if what she receives is the original random string minus 1, she has verified that Bob has the same secret key. Is there any flaw in this scheme? Explain. 9. 5 points

Explanation / Answer

Solution:

Suppose that someone suggests the following way to Alice and Bob to confirm that the two of them are in the possession of the same secret key. (Assume that a third party is tasked with distributing shared keys.) Alice creates a random bit string, representing a random integer, which is of the same length as the secret key. Then she XORs the random string with the key and sends the result over to Bob over an open channel. Bob XORs the incoming message with the secret key, gets some string representing a number, increments it by 1, XORs it with the key he has, and sends back the resulting message back to Alice. Alice checks, and if what she receives is the original random string minus 1, she has verified that Bob has the same secret key. Is there any flaw in this scheme? Explain.

The above algorithm is prone to Man in the middle attack because of having same secret key between Alice and Bob.

The attacker can intervene between the transfer of the messages and can send the message which is coming from Alice and sending it back by incrementing 1. Since the XOR operation which Bob is doing twice is nullifying the effect. The number which Bob will send back after increment and XORing it back will be the exact same message is 1 less than what will be sent back to Alice.

Now what attacker does is simply sent back the data which is from Alice by decrementing 1 back to Alice, now Alice will verify the attacker as Bob.

Because the value is same and the session will be published and the attacker will Masquerade himself to be Bob.

I hope this helps if you find any problem. Please comment below. Don't forget to give a thumbs up if you liked it. :)

Related Questions

Navigate

• Browse (All)
• Browse S
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.