Lecture
In cryptography, a key-agreement protocol — is a protocol whereby two or more parties can agree on a cryptographic key in such a way that both parties influence the outcome. If everything is done correctly, this prevents unwanted third parties from imposing a key choice on the negotiating parties. Protocols that are useful in practice also do not reveal to any eavesdropping party which key was agreed upon.
In many key-exchange systems, one party generates a key and simply sends this key to the other party — the other party has no influence on the key. Using a key-agreement protocol avoids some of the key-distribution problems associated with such systems.
Protocols in which both parties influence the final derived key are the only way to achieve perfect forward secrecy.
The first widely known public-key agreement protocol that met the above criteria was the Diffie-Hellman key exchange, in which the two parties jointly raise a random-number generator to a power in such a way that an eavesdropper cannot practically determine the resulting value used to create the shared key.
Exponential key exchange by itself does not require any prior agreement or subsequent authentication between the participants. It is therefore called an anonymous key-agreement protocol.
Anonymous key exchange, such as Diffie-Hellman, does not provide authentication of the parties and is therefore vulnerable to “man-in-the-middle” attacks.
A large number of cryptographic authentication schemes and protocols have been developed to provide authenticated key agreement and to prevent “man-in-the-middle” and related attacks. These methods generally bind the agreed key mathematically to other agreed-upon data, such as the following:
A widely used mechanism for defending against such attacks is the use of digitally signed keys, whose integrity must be guaranteed: if Bob's key is signed by a trusted third party vouching for his identity, Alice can be fairly confident that the signed key she received is not an interception attempt by Eve. When Alice and Bob have a public-key infrastructure, they can digitally sign the agreed Diffie-Hellman key, or exchange Diffie-Hellman public keys. Such signed keys, sometimes signed by a certificate authority, are one of the main mechanisms used to secure web traffic (including HTTPS, SSL, or Transport Layer Security protocols). Other specific examples include MQV, YAK, and the ISAKMP component of the IPsec protocol suite for securing Internet Protocol communications. However, for these systems to work correctly, they require careful verification by certificate authorities of the correspondence between identifying information and public keys.
Hybrid systems use public-key cryptography to exchange secret keys, which are then used in symmetric-key cryptography systems. Most practical cryptographic applications use a combination of cryptographic functions to implement an overall system that provides all four desirable properties of secure communication (confidentiality, integrity, authentication, and non-repudiation).
Password-authenticated key-agreement protocols require the separate establishment of a password (which may be shorter than the key) in such a way that it remains confidential and its integrity is guaranteed. They are designed to protect against man-in-the-middle attackers and other active attacks on the password and the established keys. For example, DH-EKE, SPEKE, and SRP are password-authenticated variants of the Diffie-Hellman algorithm.
If you have a guaranteed way to verify a shared key over a public channel, you can take part in a Diffie-Hellman key exchange to obtain a short-term shared key, and then subsequently authenticate that the keys match. One way — is to use voice-authenticated key reading, as in PGPfone. However, voice authentication assumes that it is impossible for a man-in-the-middle to forge one participant's voice to the other in real time, which may be an undesirable assumption. Such protocols can be designed to work even with a small public value, such as a password. Variations on this theme have been proposed for Bluetooth pairing protocols.
In an attempt to avoid using any additional out-of-band authentication factors, Davies and Price proposed using the interlock protocol of Ron Rivest and Adi Shamir, which has been subjected to both attacks and subsequent improvements.
Secret-key (symmetric) cryptography requires an initial exchange of a shared key in a confidential and guaranteed manner. If everything is done correctly, a “man-in-the-middle” attack is prevented. However, without the use of public-key cryptography, undesirable key-management problems may arise.
Comments