next up previous
Next: About this document Up: Contents Previous: Security

Eve in the middle

There is one well-known attack Eve can mount on the exponential key agreement protocol. The attack does not depend on Eve being able to solve the modular logarithm problem. Instead, the attack depends on Eve being able to convince Alice and Bob they are communicating with each other, when they are actually communicating with Eve! Alice innocently sends her AlicePart across the network towards Bob. Eve intercepts this message. She calculates her own EvePart by choosing a number E and raising 2 to the power of E, and sends EvePart to Alice, pretending that she is Bob and that the number she sends is really BobPart. Alice calculates her key by raising EvePart to the power of A. Eve can calculate the same key by raising AlicePart to the power of E. Now when Alice sends a message through the network to Bob, encrypted with her key, Eve can intercept and decrypt the message.

In order to ensure that Alice and Bob do not detect the attack, Eve also carries out the same deception with Bob. Pretending to be Alice, Eve sends EvePart to Bob. Bob takes EvePart to be AlicePart, and sends his number BobPart to Alice. Eve intercepts this number. Now she knows the key Bob will use as well. Every time Alice sends a message to Bob, Eve intercepts it, decrypts it (using the key she shares with Alice), reads it, and re-encrypts it (using the key she shares with Bob), and then forwards it on to Bob. Similarly, every time Bob sends a message to Alice, Eve intercepts it, then decrypts and re-encrypts it using the appropriate keys. Thus Eve gets to see every message sent, and Alice and Bob never suspect a thing. (Eve can use the same approach to actually change the messages.)

This attack demonstrates the need for communicating parties to securely identify each other. There are ways to do this, but there are also many ways for the parties to insecurely identify each other, i.e. to use cryptographic techniques to convince themselves they are being secure when in fact they are not.


next up previous
Next: About this document Up: Contents Previous: Security

Lisa Eckstein
Thu Nov 21 10:52:33 EST 1996