3 ms·
Same grayhatter, here and there. In talking with another person who understands the system, we both are unable to determine how that attack is possible. Could y
by grayhatter 10y ago
Same grayhatter, here and there. In talking with another person who understands the system, we both are unable to determine how that attack is possible. Could you explain how, by stealing Alice's key, you could impersonate Bob to Alice?
- lvh 10y agoI'm writing this up, and then I realized I asked Jason to put an example in his opening post, and I'm not sure I can do much better. In the original issue description, there's an interaction where Mallory successfully dupes Alice. Is there a specific step you feel doesn't work?
- grayhatter 10y agoSorry, I must have spaced out half way through writing that reply. I originally intended to write something along the lines of, "How is the attack solved by your example." I'm trying to wrap my head around the fix for this attack without key signing. (Short of reading the source for noise)
- lvh 10y agoWhich example are you referring to? The HN comment with the AKE?
- grayhatter 10y agoYour top comment on HN. What's part am I missing that if we used hash(long_key pair + emp_key pair) protects us if the long term is known by an attacker? Why couldn't the attacker intercept the emp_keys. I'm assuming there's no key signing done here.
- baby 10y agoAnother explanation here: https://www.cryptologie.net/article/372/key-compromise-impersonation-attacks-kci/ https://www.cryptologie.net/article/372/key-compromise-imper...