15 ms·
This depends on your goals. If you only want to communicate, a secure channel with a shared secret can be established with the Diffie-Hellman key exchange. How
by raimue 9y ago
This depends on your goals. If you only want to communicate, a secure channel with a shared secret can be established with the Diffie-Hellman key exchange.
However, this will not authenticate the other party, which means ensuring that you are actually communicating with the expected partner and not with a man in the middle. For this, the partners need to present something only they know. This would usually be solved with asymmetric crypto, like verifying certificates signed by a trusted third-party or using previously seen public keys in a trust-on-first-use scenario.
- apparentiguana 9y agoThanks for the info! I've been reading up on Diffie-Hellman, wasn't sure if it was susceptible to MITM, but glad to know that it is. My goal is to enable a mostly-automated way to have devices on a network discover and authenticate each other. As a thought experiment, I was trying to determine if two devices plugged into a malicious router could communicate securely, but everything I've found so far seems to indicate that it isn't possible without a shared secret. Do you know how web vendors do it? Does Chrome/Firefox/etc have any base keys stored to ensure you aren't working with a censored internet?
- stephenr 9y agoThat's what the root Certs are for. Firefox ships with its own, chrome uses the platform ones.
- apparentiguana 9y agoOh gotcha, thanks! Really appreciate the info, I'll go read up on root certs.