MODULE – 3

Entity Authentication
T h e s e c urity s e rv ic e w e w ill s tu d y is e nt it y au t he n t ic a t io n .

T h is m e a ns c h e c k in g t he ide n t it y o f a pe rs o n o r s ys te m .

T h e re a re m a ny w a ys to do th is , n ot a ll o f t he m u s e c rypto g r aph y.

B ut h e re , w e w ill fo c us o n h o w c ryp to g ra ph y h e lps in au th e n t ic a tio n.

M an y c rypt og ra phic m e th o ds u s e ran d o m n u m be rs t o w o rk s e c ure ly, s o w e w ill a ls o le arn

a bo u t h ow ra n do m nu m b e rs a re g e ne rat e d .

W e w ill a ls o lo o k a t t he ide a of fre s h ne s s , w h ic h m e a ns m a kin g s u re a m e s s a g e is n e w a n d

n ot re us e d b y a t ta c k e rs .
A t t he end o f thi s c ha pt er yo u sh o uld b e a b le t o :

• D i scu ss a num b e r o f d iffer en t m ec ha ni sm s fo r r a nd o m ly g en era ting va l ues

t ha t a re sui ta b l e fo r us e in cr yp to g ra phy .

• C o m pa r e d iffere nt te chni q ues fo r pr o vi d ing fr esh nes s.

• R e co g n ize a num b er o f d iffer ent a pp ro a che s t o pr o v id ing ent ity

a ut hen tic a tio n.

• A p pr ec ia te th e li m i ta t io ns o f p a ss w o r d -b a se d a p pr o a ch es to p ro v id i ng en tit y

a ut hen tic a tio n.

• E x pla in t he p rin cip le b ehi nd d y na m ic pa s sw o rd sc hem e s

Entity Authentication
E n tit y a u the ntic a t io n m e a ns pro vin g the id e nti ty o f a p er so n o r a sy st em b e fo re

a ll o w i ng a cc es s.

E x a m p le: W he n y o u lo g in t o G m a il, it ch eck s if yo u a re re a lly (n o t a n

a t ta c k er ).

Why it’ s important

•T o p re ve n t a tt a c ke r s fro m p re te n d in g t o b e s o m e o n e e ls e .
•T o m ak e s ur e c o m m u n ic a tio n h a ppe ns o n ly b e tw e e n tru s t e d pa rt ie s .
8.1 Random number generation

W ha t ’ s the D ea l w i th R a nd o m nes s i n C ry pt o g ra p hy?

Im a g ine yo u’ re lo c k ing yo ur se cr et s in a b o x . Y o u ne ed a k e y t ha t no o n e e lse

k no w s . If so m eo ne c a n g u ess yo ur k ey, t hey ca n o p en t he b o x . T h a t’ s w her e

ra nd o m ne ss co m e s in .

G oo d ra nd o m n e s s = s tron g, s ec re t, un pre d ict ab le k e y

B ad ran do m ne s s = w e a k, gu e ss a ble , re u se d ke y
8.1.1 The need for randomness
M os t cry pto graphic t ools s ta rt w it h o rg an ize d (s t ru ct ure d) inform a tion and t urn it int o s om e t hing t hat

loo ks co m ple t e ly ran dom a nd un orga nized . T h is is ve ry im po rt an t t o ke e p t hin gs s afe .

▶ W he n y ou e nc ry pt a m e s s ag e (u sin g s om et hin g c alle d a bloc k or s tre am c iphe r), t he e nc rypt ed re s ult

(c alle d c iphe r t e xt) s ho uld lo ok like rand om g ibbe ris h.

▶ If it s till h as pa tt erns or s t ru ct ure , a hac ke r co uld le arn s om e t hing us e fu l by ju st look ing at it.
A c t ually , c iph er t ex t c an s om et im e s ev en be us ed as a s ourc e o f ran dom n es s its e lf!

▶ T he res ult of a ha sh fu nc tio n (a t ool t hat s cram ble s d at a int o a fixe d-size out put) s ho uld a lso look
c om ple te ly ra ndo m . Ev en tho ug h it ’ s no t alw ay s lis te d as a re quire m e nt , h as h ou tput s a re oft en

us e d t o m ak e s e c re t ke ys be c aus e th ey loo k unpre dic ta ble .

8.1.2 What is randomness?

W h at do e s “ ra nd o m ” re a lly m e a n ?

•P e o ple h av e be e n tryin g to de fine ra n do m n e s s fo r h un d re d s o f y e ars — bu t

it’ s tric k y b e c a u s e ran d o m ne s s is a b o ut t h in g s yo u c a n ’ t pre d ic t or

guess.

•E ve n th o ug h it’ s h ard to de s c rib e e xa c tly, w e a ll u nd e rs t an d r an d om n e s s

a s b e in g u n pre d ic ta b le a nd un c e rt ain .

•F o r e xa m ple , if yo u g e t ra nd o m n u m b e rs o r bit s (0 s a n d 1 s ), you w a nt t h e m

t o b e h a rd t o g u e s s a nd no t re la te d to t h e pre viou s nu m b e rs yo u g o t.
Iro nic a lly, h o w e ve r, a lt h ou g h ran d o m ne s s is h a rd t o d e fin e , th e re are m a n y

w a ys th a t w e w ou ld lik e ran d o m ne s s t o b e ha v e t h at a re e a s ily id e n tifia b le .

A ra n do m nu m b e r g e n e ra tio n pro c e s s is o fte n a s s e s s e d b y a pplying a s e rie s o f

s t at is tic al te s t s . M a ny o f t h e s e t e s t s a re fairly in tu it iv e an d in c lu d e c he c k s s u c h a s ,

o n a ve ra g e , o ve r th e g e n e ra tio n o f m a n y ra n do m o ut pu ts :

• d oe s 1 a ppe a r in t h e o u tpu t o f t h e pro c e s s a ppro xim at e ly a s oft e n a s 0 do e s ?

• d oe s a 0 fo llo w a 1 in th e o ut pu t of th e pro c e s s appro x im a t e ly a s o fte n as a 1 fo llo w s a
1?

• d oe s t he s t rin g 0 0 0 o c c u r in t h e o u tpu t o f t he pro c e s s a ppro xim at e ly a s oft e n

a s t h e s t ring 1 1 1 ?
8.1.3 Non-deterministic generators

W h at are N on -d e te rm in is t ic G e n e ra to rs ?

•T h e s e g e n e ra to rs c re a te tr ue ra nd o m n e s s b y u s in g u npr e dic t ab le t h in g s from

t he ph ys ic al w orld .

•T h e y are v e ry g oo d at pr od u c in g ra n do m nu m b e rs be c au s e na t ur e its e lf is
ra n do m .

•B u t, t h e y c a n be e xp e ns ive a n d s o m e tim e s s lo w .
Two Types of Non-deterministic Generators:
1. Hardware-based generators
T h e s e u s e s pe c ia l ph ys ic a l d e v ic e s t o m e a s u re ra n d om n at u ral e ve n ts , lik e :

• T h e ra n d om tim ing o f r ad ioa c t iv e d e c a y (at om s b re a k in g d ow n )

• T iny e le c tric a l n ois e from s e m ic o nd u c to rs (th e rm a l n o is e )
• R an d om m o ve m e n t s o f e le c t ro nic s ig na ls o r o s c illat or s
• N ois e fr om e le c tric a l d e vic e s
• Q u a nt u m e ffe c t s , lik e lig h t pa rtic le s (ph o to n s ) b o u nc in g aro u n d
T h e y k e e p pro d uc in g ran d o m d a ta as lon g a s t h e y a re po w e re d .

B e c au s e th e y n e e d s pe c ia l e q uipm e n t , th e y c o s t m o re a n d s o m e t im e s g e n e ra t e ra n do m n e s s s lo w e
2. Software-based generators
•T h e s e do n ’ t n e e d s pe c ia l h ar dw a re b ut u s e u npr e dic t ab le b e h av ior d e te c t e d b y yo ur
c o m pu te r’ s e x is t in g pa rts , lik e :

• T im in g o f yo ur k e ys t rok e s (w h e n yo u pre s s k e ys )
• T h e s ys te m c lo c k ’ s e xa c t t im e
• H o w lo n g th e ha rd d rive ta k e s to fin d d at a
• T im in g o f m o us e c lic ks o r m o v e m e nt s
• N e tw o rk a c t iv it y
•T h e s e ar e c h e a pe r an d fa s t e r b u t n ot a s “ s tro n g ” o r s e c ure a s h a rd w ar e -ba s e d

ra n do m n e s s .

•It ’ s s a fe r to c om b ine s e v e ral of th e s e s o urc e s t o g e t be tt e r ra n d om n e s s .

Hardware Example: Radioactive Decay
• Im a g ine a s pe c ia l s e n s o r w at c h in g a t in y pie c e o f ra d io a c t iv e m a t e ria l.
• T h e s e n s o r m e a s ure s t he e x ac t tim e w h e n at o m s ra n d om ly bre a k d o w n .

• B e c au s e th is t im in g is u n pre d ic t ab le , t he d e vic e us e s it t o g e n e ra te ra n do m nu m b e rs lik e :

10 110 01 101
• T h e s e n u m b e rs are re a lly ra nd o m b e c a u s e n o o n e c an pre d ic t w he n th e at o m s d e c a y.

Software Example: Mouse Movement

• W h e n yo u m o ve yo u r m o u s e , yo u r c om pu t e r n o te s t he e x ac t p os itio n a n d s pe e d e ve ry m illis e c on d

• S in c e yo ur h an d m o v e m e n ts ar e n’ t p e rfe c tly p re dic t ab le , t he c o m pu te r c o lle c t s t h e s e c h a n g e s .

• It th e n c on v e rts th is in form a t io n in to ra n d om n um b e rs lik e :

01 00 110 01 0

• T h e s e n u m b e rs he lp m ak e th ing s like s e c u re pas s w or ds o r e n c rypt ion ke y s .

8.1.4 Deterministic generators

What is a deterministic generator?

•It’ s a co m pu ter a lg o rit hm th a t p ro d uce s pseudorandom numbers — num b ers
th a t l o o k r a nd o m b ut a re a ct ua ll y c rea te d in a pr ed ic ta b le w a y .

•If yo u k no w t he s ta rti ng po i nt (c a lle d th e seed), yo u ca n fig ure o ut the w ho le

se q ue nce .

•S o , t he o utp ut is N O T tru ly r a nd o m , b ut i t lo o k s ra nd o m to a nyo ne w ho

d o e sn’ t k no w the se ed .
How does it work?
•Y o u g ive th e a lg orith m a seed (a s e c re t s ta rtin g nu m b e r, like a k e y).
•T h e alg o rith m us e s t he s e e d to g e n e rat e a lon g s t rin g o f n um be rs t ha t loo k
ra n do m .

•E ve ry t im e yo u u s e th e s am e s e e d , yo u g e t t he e xa c t s a m e o ut pu t.
8.2 Providing freshness

What is in Cryptography?
•Freshness m ea n s m a k ing su re a m es sa g e is and

•Im a g ine yo u se nd a s ec re t m e ssa g e li k e:

“ I a m A n a nya , l et m e in .”

•A n a tt a c k er co u ld c a pt ure it a nd r ep la y the sa m e m es sa g e la t er to tri ck t he

sy st em .

•F res hne ss m e ch a nism s pr ev en t t his re pla y a t ta c k .

Three Common Freshness Mechanisms
[Link]
1 . T he se nd er pu ts the ins id e the m ess a g e.

2 .R ec eiv e r c hec k s i f the ti m e is “ r ec ent eno ug h.”

3 .E xa m p le : O nlin e b a nk ing O T P va l id fo r .

W e a k nes s: R eq uire s s ync hro nized clo ck s b et w e en se nd er a nd rec ei ve r.

2. Nonces (Number used once)
•R e ce iv er se nd s a ra nd o m c ha lle ng e n um b er (no nc e) → s end er m ust
re ply inc lud i ng th a t n um b er .

•S in ce the num b e r i s fr esh a nd uniq ue , the re ply p ro v es the s end e r i s

liv e .

•E x a m pl e: W he n lo g g in g in, th e s er ve r s end s a ra nd o m co d e → yo ur
d e vic e m u st use it to rep ly.

• B es t fo r a v o id i ng re pla y s.
[Link] Numbers
3 .M es sa g e s a r e n um b er ed (1 , 2 , 3 , … ).

4 .R ec eiv e r o n ly a cce pt s m e ssa g es in o r d er .

5 .E xa m p le : V id e o ca ll p a ck e ts a r e nu m b ere d s o o ld /r ep la y ed p a ck ets

a r e ig n o re d .

6 .W e a k ne ss : W o rk s w ell o nly in co nt inuo u s c o m m unic a tio n.

8.2.4 Comparison of freshness mechanisms

Mechanism R e al-life an a lo g y St re n g t hs W e a k ne s s e s

N eeds
O T P v alid for 3 0
Clock-based Q u ic k , s im ple s yn c h ro nize d
sec
c lo c ks

C o urie r/ pac k a g e Ea s y to ve rify M u s t tr ac k la s t

Sequence num.
n um b e rs ord e r n u m be r

A TM c h alle ng e V e ry s e c u re , n o
Nonce-based S low e r (2 s t e ps )
q ue s tion c lo c k s ne e d e d
8.3 Fundamentals of entity authentication

T he ent ity a ut hen tic a tio n is the a s sur a nce t ha t a g iv en ent ity is

inv o lv e d a nd cur re ntly a c tiv e in a c o m m unic a ti o n s ess io n. T hi s m e a ns

th a t e nti ty a ut hent ica tio n re a lly inv o lv es a s sur a nce o f b o th:

Identity. the id e nti ty o f th e e ntit y w ho is m a k ing a cla i m to b e

a ut hen tic a te d ;

Freshness. tha t t he cla i m e d e ntit y is ‘ a liv e’ a nd inv o lv ed in t he

cu rre nt se ssi o n.
Why both are needed?
• If identity is m is s ing → Y ou don’ t kno w is c om m u nic at ing .

• If freshness is m is sin g → A n at ta ck er c ould ca pt ure yo ur log in info an d replay it lat er t o fool t he

s ys t e m .
Who/What is an “ Entity” ?
•A n entity c an be :
• A human (y ou log g ing in).
• A device (y our phon e provin g it ’ s g e nu ine ).
• E ve n data ( a piec e of so ft w are proving a uth en tic it y).
Example problem:
W he n y ou t y pe a pas s w o rd int o a c om put e r →

•A re w e aut he nt ic at ing ?

•O r a re w e jus t aut he nt ica tin g t he ?

T his is th e human– computer gap (s im ila r t o dig it al s ig nat ures ).

Types of Entity Authentication
1. Unilateral Authentication (one-way)
•O nly one s ide prov es it s id en tit y .
•E xam ple : ATM login
• Y o u pro ve (by c ard + P IN ) to th e b ank.

• B u t t he ban k (A TM m ac hine ) do es not prove it se lf to yo u.

• P rob lem : A t tac ke rs ca n s et up fake A T M s → s te al c ard + P IN .

2. Mutual Authentication (two-way)

•B ot h s ide s prov e t he ir ide nt ity t o e ac h ot he r.
•E xam ple : Online banking with HTTPS
• Y o u pro ve yo urse lf w it h y ou r lo gin + pas sw ord.
• T he ban k pro ve s it s elf w ith a digital certificate.
• M ore s ec ure , pre ve nt s fak e s e rv ers or phis hing .
8.3.1 A problem with entity authentication

The Problem
•Entity authentication = proves identity only at one moment.
•E x a m pl e:
• A lice e nte rs her ca r d + P IN a t A T M → B a nk k no w s it ’ s A l ice .
• R ig ht a fte r, a t ta c k er pus hes A lic e a w a y → B a n k st ill thin k s i t’ s
A lice , b ut it’ s n o t.

•S o , a uthe nti ca t io n i s v a lid only at login, n o t fo r t he w ho l e s ess io n.

The Solution (Using Cryptography)
•A ft er lo g in , the sy ste m a ls o s ets up a secret key w it h A lic e.
•T ha t k ey is use d fo r a ll futur e m e ss a g es .
•S in ce o nly A lice a nd the b a nk k no w t he k ey, a tta ck e rs o n t he n et w o r k
ca n’ t hij a ck the se ssi o n.

•Authentication works only for a moment → to protect the whole session, we

use a secret cryptographic key.
8.3.2 Applications of entity authentication
Access Control
•E nt it y a ut he ntic a ti o n is us ed t o decide who can enter or use something.
•Y o u pr o v e y o ur id e ntit y → yo u g et a c ces s.
•H a p pe ns i n (a t t he m o m ent o f e ntr y).

Examples:
•A T M → Y o u ent er P IN → B a nk le ts yo u a cc es s y o ur a cc o unt .
•O ffic e b uild in g → Y o u sw ipe ID ca r d → D o o r un lo ck s.
•E m a i l lo g in → U se rna m e + pa ssw o r d le ts yo u a cc es s y o ur m a ilb o x .
Part of a Cryptographic Process
•E n tity a ut h e nt ic at io n is als o u s e d in s ide b ig g e r cryptographic protocols.
•U s u ally h a ppe n s at the start of a secure connection.
•P u rpos e : T o m a k e s u re b ot h s id e s a re re a lly w ho th e y c la im , b e for e e x c h an g in g
s e n s itive d at a.

Examples:
•S e c u re w e bs it e (H T T P S) → Y o u r b ro w s e r c he c ks t he w e b s ite ’ s c e rt ific at e (is th is
re a lly th e ba n k ?).

•K e y e xc h a ng e → W h e n t w o d e vic e s ag re e on a s e c re t k e y, th e y au t he n t ic a t e e a c h ot he r
firs t (m ut u al a u th e n tic a tio n).

•V id e o c a ll ap ps (Z o o m , W h at s A pp) → T he y a u th e n tic a te e a c h o th e r be fo re e n c ryptin g

t he c a ll.
8.4 Passwords

P a ss w o r d s a re st ill o ne o f th e m o s t p o pul a r t ec hniq u es fo r

pr o v id ing id en tit y in fo rm a t io n, a l tho ug h the y h a ve m a ny o b v io u s

fla w s. W e w ill b rie fly l o o k a t s o m e o f the se fla w s a s m o t iva tio n

fo r enh a nce d t ech niq ue s. W e w i ll a l so r ee xa m i ne t he use o f

cr yp to g r a phy fo r pa s sw o rd pr o te ct io n. N o te th a t i n th is s ec tio n w e

us e t he t er m ‘ p a ss w o r d ’ ve ry lo o s ely , sinc e m u ch o f o ur

d is cus sio n eq ua lly a p plie s t o t he lik e s o f P IN s a n d pa ssp hr a se s.

8.4.1 Problems with passwords
1 .L e ngt h

■ T o o sho r t
■ T o o lo ng
2 . C o m ple xit y

■ H a r d t o r em em b e r
■ W o rk a r o unds
3 . R ep ea ta b il ity

■ P a s sw o r d re use
■ P re dic ta b le va ria t io ns
■ Se c urit y ri sk
4 . V ul ner a b ilit y

■ A t ta c k s
■ W ea k cho ic e
8.4.2 Cryptographic password protection

A b ig c om pa n y w an t s t o le t m a ny u s e rs lo g in u s in g pa s s w o rd s .

•T h e s im ple s t w a y is t o k e e p a central file (d a ta b a s e ) w ith a ll u s e rn a m e s an d t h e ir

pa s s w o rd s .

•W h e n a us e r t ype s a pa s s w o rd , th e s ys t e m c o m pa re s it w it h w h a t’ s s to re d in th e
file .

The problem:
•T h a t file b e c o m e s a big treasure fo r a t ta c k e rs . If s om e o n e ha c k s it , th e y g e t all the
passwords.
•E ve n tru s t e d s ys t e m ad m inis t rat o rs c o u ld s e e e ve ryo n e ’ s pas s w ord s , w hic h is not
 C rypt og raphy ca n m ak e pas s w o rd sy s te m s s afer.

•T he co m pute r doe s n’ t a ct ua lly n ee d t o know yo ur re al pas s w o rd .

•It only ne e ds a w ay to ch ec k if t he pa ss w ord y ou t y pe is correct or not.
•S o, ins te ad o f s av ing th e re al pas sw ord, t he sy s t em s av es a scrambled version (us ing c ry pto g ra ph y).
•W h en yo u log in, y our pas s w ord is s c ra m ble d ag ain and co m pa re d w it h t he st ore d ve rsio n. If t he y
m at c h → yo u’ re au th en tic at ed .

Protecting Password Databases with Hashing

•In st e ad of s avin g re al pas s w ords in t he da tab as e, t he s ys t em sa ve s t he ir has h va lue s (s c ram ble d
ve rsio ns ).

•A ha sh fu nc tion is o ne -w ay → y ou ca n s cram ble th e pas s w o rd , b ut yo u c anno t g e t it bac k from t he

ha sh .

•T his w ay , e ve n if a hac ke r s te als t he dat abas e , th ey c an’ t ea sily re co ver t he orig inal pas s w ords .
UN IX P as sw ord P ro te c tio n (Fig ure 8 .2 )

1 .A ra ndom num b er (s alt ) is m ade us ing t he sy s t em c loc k.

2 .Y our pas sw ord (m a x 8 c harac t ers ) is turne d in to a s ec re t ke y .

3 .A fixe d m es s ag e (all 0 s ) is sc ram b led w it h t his ke y u sin g D E S +.

4 .T he s c ra m bling is repe at ed 2 5 tim es (t o s low dow n hac ke rs ).

5 .T he final s c ra m ble d re su lt = pas sw ord im ag e.

6 .S y st e m s to re s only : s alt + pa ss w ord im ag e in / e tc / pas sw d.

7 .W he n y ou lo g in, the s y st e m s cram ble s y ou r pas s w o rd ag ain a nd c he c ks if it m at c he s.

8.5 Dynamic Password Schemes
Reg u lar pa ss w ords have t w o m ain proble m s :

1 .V ulne rabilit y : T h ey c an b e s t ole n e as ily.

2 .R e pe at ab ility : O nc e s t ole n, th ey c an b e u se d o ve r a nd ov er.

A dy nam ic pas s w o rd sc he m e (als o c alle d a one -t im e pas sw ord s c he m e ) ke eps th e id ea of a

pas s w o rd but m ake s it m uc h m ore s ec ure by :

1 .Lim it ing e xpos ure: T he pas s w ord is no t c on st ant ly ex po se d, s o it is harde r to s t ea l.

2 .C h ang ing e ac h t im e : E ve ry log in at te m pt g en erat e s a ne w pas s w o rd or dy nam ic da ta, s o

st ole n pas sw ords c anno t b e re us e d.

The s e sc he m e s are an im port ant m e th od for aut he nt ic atin g u se rs and a re w ide ly us ed in to ke n-

bas ed sy s te m s , like int erne t ban king or phone ba nkin g.

8.5.1 Idea behind dynamic password schemes
I n a no r m a l p a s sw o r d sy s te m , yo u us e the s a m e pa s s w o r d e ver y ti m e yo u l o g i n. B ut in a dyna m ic pa s sw o r d

s che m e , y o ur p a s sw o r d cha nge s e ve ry t im e yo u lo g in — it ’ s ge ne ra t ed a uto m a tic a lly us ing a p a ss w o rd

f unct io n.
How It Works
[Link] Function (like a formula)
1 . I nst ea d o f ty pin g a f ixe d p a ss w o rd, t he s ys t em use s a special function (a k ind o f m a the m a t ic a l f o rm ula o r

a lg o ri thm ).

2 . T hi s f unc ti o n is o ft e n st o r ed o n a smart token ( lik e a s m a ll e le ct r o nic devic e o r a pp ).

3 . T he t o k e n m a y lo o k l ik e a tiny calculator — y o u e nte r so m e i nput , a nd it sho w s y o u a ne w pa s sw o r d e a ch t im e.

[Link] to the Function

1 . T he f unct io n nee ds so m e input t o cr ea t e t he dy na m ic p a ss w o rd.

2 . T hi s i nput m us t b e fresh (ne w e ver y t im e) so t ha t o ld p a s sw o r ds c a n’ t b e re use d b y a t ta c k er s .

3 . T o ens ure f re sh nes s, the r e a r e thr ee m a in m e th o ds:

Types of Freshness Mechanisms
[Link]-based method
1 . B o th the us e r’ s t oke n an d t he se rve r h ave synchronized clocks .

2 . T he current time (like t he m inut e or s ec on d) is us ed to c re at e t he pas sw ord.

3 . E xam ple : like O T P s t hat ch ang e ev ery 3 0 s ec on ds (G o og le A ut he nt ica tor w orks th is w ay ).

[Link] number-based method

1 . B o th the us e r and t he s e rve r ke e p t rac k of a count or sequence number t hat inc re as e s ea ch tim e y ou lo g in .

2 . T he ne xt pa ss w ord de pe nds on t he ne xt num b er in t he s e que nc e .

[Link]-based (Challenge– Response)

1 . T he s erve r s en ds a random number (challenge) t o t he us er.

2 . T he us e r e nt e rs t his num be r in to t he t oke n, and th e t oke n g e ne rat es a response u sin g t he pas sw ord

func t ion.

3 . T he s erve r c he ck s if t he re s po ns e is c orrec t .

4 . T his e ns ures t hat e ve ry log in a tt e m pt us e s a uniq ue ra ndom ch alle ng e.

Local use of PIN (in simple words)
W he n y ou u se a P IN on y ou r o w n sm all de vic e ( like a to ke n or s ec urit y k ey ), it ’ s s afer be c aus e :

•Y ou are e nt e rin g the P IN on y ou r o w n d ev ice , not on a public m ac hin e lik e a n A T M .

•S o, it’ s harde r fo r s om e on e t o s e e or st e al y our P IN .
•T he P IN is us e d only ins ide t he de vic e a nd is no t s e nt t o a ny se rve r.

Two-Factor Authentication
T his m e ans t he re are t w o t hin gs ne e de d t o pro ve it’ s yo u:

1 .S o m e thin g y ou kno w → y our P IN

2 .S om e t hing y ou h ave → yo ur de vice / t oke n

S o e ve n if so m e one kno w s y our P IN , w it hout y our de vic e th ey c an’ t log in .

Dynamic Response
E ve ry t im e y ou log in:

•T he sy s te m g ive s a ne w ra ndom ch alle ng e.

•Y ou r d ev ice us e s it t o m ak e a ne w u nique c ode (re spon se ).
•S o, the pas s w o rd ch ang e s e ac h t im e .
 8.6 Zero-knowledge mechanisms

A Zero-Knowledge mechanism is a w a y fo r o n e pe rs o n (th e prover) to prov e to a n o th e r

pe rs o n (t he verifier) t ha t t he y k n ow s o m e s e c re t — without revealing the secret itself.

It’ s u s e d in authentication — pro v in g yo ur ide n t it y — b u t in a m o re s e c ure w a y th a n

pa s s w o rds .

N o rm a lly, to prov e w ho you a re , yo u s h a re s om e info rm a tion — like a pa s s w o rd or P IN .

B u t w h a t if yo u c o u ld prov e you th e p as s w ord without actually saying it?

T h at ’ s w ha t zero-knowledge proof d o e s .

It a llow s s o m e o n e t o pro ve t he y k n ow s o m e th in g a bo u t

w h at th a t s om e th in g is .
Concept Meaning

Prover T he pe rso n w ho k n o w s th e s ecr et .

Verifier T he pe rso n ch eck ing t he t rut h.

P ro v e yo u k no w th e s ecr et without
Goal
revealing it
O p eni ng a l o ck e d b o x t o s ho w yo u
Example k no w t he co d e , b ut no t sa y ing t he
co d e
8.6.1 Motivation for zero-knowledge
T his se ct io n e xp la in s why w e ne ed zero-knowledge proofs —

b e ca us e n o rm a l w a y s o f pr o v ing w ho y o u a r e (li k e p a ss w o rd s o r to k e ns)

ha v e problems.
Problem 1: Both sides must trust each other
I n m o s t lo gi n sy st e m s,

t he user a nd the server m u st t rus t ea c h o t her .

•W he n y o u lo g in w i th a password, y o u t rus t th e w e b sit e t o store it safely.

•W he n y o u us e a smart card or token, b o th sid es sha r e a secret key.
B ut so m et im e s, t w o pe o pl e o r s ys t em s m a y no t trust each other at all —

f o r e xa m p le , w he n t hey a re competitors o r strangers .

I n suc h c a se s , it ’ s ris k y to sha r e a ny s e cr et .

Zero-knowledge he lp s h er e —
it le ts y o u prove who you are w it ho ut sha r ing a ny se cr e t o r ne edi ng t r ust .
Problem 2: Information leaks every time you log in
E ve ry t im e y ou us e a no rm al pas sw ord or O T P :

•Y ou reveal some information.

•A ha ck er w at ch ing m ig ht learn something useful.
Fo r e xa m ple :

•A password is fully vis ible w h en ty ped .

•A one-time password (O T P ) or to ke n s en ds ch alle ng e– re spon se da ta t ha t c an b e recorded and m ay be
reu se d.

S o, e ve n g ood s y s te m s s till le ak a bit of inform at ion e ve ry t im e th ey are us e d

 MODULE – 3
Chapter – 2
C ry pto g ra phic P ro to c o ls
9.1 Protocol basics
W e b eg in b y pro vi d ing t w o d iffer ent , b ut re la te d , m o ti va t io ns fo r the

ne ed fo r c ryp to g r a ph ic p ro t o co ls.

9.1.1 Operational motivation for protocols

In t he re a l w o rld, w e do n ’ t u s e c ry pto g ra ph ic t oo ls (lik e e n c ryptio n o r

a ut h e nt ic at ion ) a ll b y t h e m s e lv e s fo r ju s t o n e s m all t as k .

In s te a d , m o s t re a l a pplic a tio ns a re c om p le x — th e y h an d le m a n y t ype s of

d at a , inv o lv e m a n y pe ople or s ys t e m s , a n d m u s t pe rfo rm s e ve ra l s t e ps

s e c u re ly.

S o, w e ne e d pro to c o ls — i.e ., w e ll-d e fine d ru le s th a t t e ll u s h ow , w h e n, an d

b e tw e e n w h om c rypt o g ra ph y s h o u ld b e u s e d.
[Link] security needs:
1 . W he n s e nding da ta , w e m ay ne e d to keep it secret and als o prove who sent it.

2 . E xam ple : S en ding a b ank m es s ag e — it m us t be bot h private a nd authentic .

[Link] data, different protection:

1 . N o t a ll dat a ne e ds th e s am e s e cu rit y .

2 . E xam ple :

1 . P rod uc t n am e → c an be se e n by an yo ne .

2 . C red it c ard n um be r → m us t be hid de n (e nc rypt ed ).

[Link] people or systems are involved:

1 . E xam ple : In an o nline pay m en t, t he re ’ s yo u, th e s ho p, y our ba nk, and th e s ho p’ s ban k.

2 . S o, w e n ee d c le ar ru les ab out who sends what and how it’ s prot e ct e d.

[Link] happen in order:

1 . E xam ple : A t an A T M , firs t y ou m us t prove who you are (authenticate), th en only y ou c an take money.

2 . S o, c ry pto g ra ph y m u st be applie d in t he rig ht orde r.

9.1.2 Environmental motivation for protocols

D iffer ent co m p ute rs use d iffe re nt s ys te m s , so ft w a re, a n d la n g ua g es .

S t ill, t hey m us t c o m m unica te a nd s ta y s ecu re — t his is p o ss ib le o nl y

b e ca us e o f pr o to c o ls .

O n the Int ern et, a ll c o m put er s fo ll o w a co m m u nica tio n pr o to c o l c a lle d

T C P / IP , w hich hel ps the m se nd a nd re ce ive d a t a c o rr ect ly , e v en i f the y a re

d iffe re nt.

A cr yp to g r a phic p ro t o co l w o rk s in t he sa m e w a y —

it g iv es a co m m o n se t o f rul es to a chie v e s ecu rit y (lik e k e ep ing d a t a s ec ret

9.1.3 Components of a cryptographic protocol
A cr yp to g r a phic p ro t o co l is lik e a s tep -b y-s te p p la n t ha t te lls ho w tw o o r m o r e

pa rti es sho u ld c o m m unic a te se cur ely to a ch iev e a g o a l (li k e a uthe nti ca t io n o r

en cry pt io n).
1. Protocol Assumptions
B ef o r e t he co m m unic a t io n s ta r ts , so m e t hing s m ust a lr ea dy b e t rue o r re a dy .

I t a nsw e rs t he qu es tio n:

“ W ha t m us t b e in pla c e b ef o r e s ta rt ing? ”

Ex a m pl es :

•Ea c h p er so n a lre a dy ha s the ir se cr e t k e y .

•T he de vice s the y a re us ing a re s ec ure a nd no t ha c k ed .
•T he en cr yp ti o n m e tho d b ein g us ed is st ro ng e no ugh.
So , t hes e a re t he s t a rt ing co ndi ti o ns ne e ded f o r the p ro t o c o l t o w o rk pr o pe rl y.
2. Protocol Flow
T his de s cribe s th e o rd er of c om m unic at ion — w h o s en ds w h at a nd w he n.

It a ns w e rs:

“ W h o s en ds a m e s sa ge t o w hom , an d in w hat orde r?”

E xam ple :

1 .P e rs on A s e nds th e firs t m e s s ag e.

2 .P ers on B replie s.

3 .P ers on A c onfirm s t he reply .

E ac h e xc han ge is c alle d a s te p or pas s in th e prot oc ol.

S o t his is b as ica lly t he s e que nc e of m es s ag e s b et w ee n part icipan ts .

3. Protocol Messages
T h is pa rt ta lks a b ou t w h a t is ins id e e ac h m e s s a g e be in g s e n t.

It a ns w e rs :

“ W h at in form a t io n d o e s e ac h m e s s a g e c o nt a in ? ”

E xa m ple :

•T h e firs t m e s s ag e m ig h t c o n ta in a u s e r’ s ID an d a ra nd o m n u m b e r.
•T h e s e c o nd m ig ht c o n ta in a n e n c rypt e d re s po n s e or a d ig ita l s ig n a tu re .
T h e s e m e s s ag e c on t e nt s are w h a t he lp ve rify id e n tity, e ns ure int e g rit y, o r s e t up

e n c rypt io n .
4. Protocol Actions
T his e xplains w h at ea ch pe rs on (or c om put e r) n ee ds t o do be fo re s en ding or aft er re ce iving a m es s ag e .

It a ns w e rs:

“ W h at ac tion s m us t b e d one be tw e en st e ps? ”

E xam ple s :

•E nc ry ptin g o r d ec ry pt ing a m e s s ag e.
•C he ck ing a dig it al s ign at ure.
•V erify ing tha t a m e ss ag e is valid.
T he s e a ct ion s m a ke su re e ve ry m es s ag e is c orrec t and se c ure .
9.2 From objectives to a protocol

W h e n w e m a ke a c r ypto g ra ph ic pro t oc o l, w e s ta rt w it h a re a l pro b le m — lik e “ h o w c an

t w o pe o ple t alk s a fe ly w it ho u t o th e rs he a rin g ? ”

T h e n w e c re a te s t e ps o r ru le s t o s o lv e t h at p rob le m u s ing c rypto g ra ph y (like e n c rypt io n ).

S o, it m e an s — w e g o fro m w ha t w e w a nt to pr ot e c t → to m ak ing a c le a r pla n (pr ot oc ol)

t ha t k e e ps it s afe .
9.2.2 Challenges of the stages of protocol design

Stage 1: Defining the Objectives

T h is is w h e re w e fin d w h a t pro ble m w e ne e d to s olve .

E xa m ple :

B ob (a m e rc h a nt ) is g o in g to re c e ive a c o n tra c t fro m A lic e .

H e w a nt s to b e s u re t h at la te r A lic e c an n o t de ny th a t s h e s e nt t h e c o n tr ac t .

S o, th e ob je c tive is :

M ak e s u re A lic e c a nn o t d e n y s e n d in g t he c o n tra c t.
Stage 2: Determining the Protocol Goals
N ow w e tu rn t h e o b je c t ive in t o a c le a r s e c urit y g oa l u s ing c ry pto g ra ph y.

Ex am p le :

A t th e e nd of th e pro c e s s , B o b s h ou ld h a ve pro of th a t A lic e re a lly s e n t t he c o nt ra c t.

T h is pro o f is c a lle d no n -re pu dia tio n — m e an ing A lic e c a nn o t d e ny h e r ac t ion la te r .

S o, th e g o al is :

B ob m us t ha ve n o n-re pu d iat io n o f th e c on tr ac t r e c e iv e d fro m A lic e .

Stage 3: Specifying the Protocol
H e re w e d e c id e e xa c t ly h ow t o a c hie ve t he g o a l.

W e c ho o s e th e c rypto g r aph ic m e t h od an d de fine w h a t m e s s a g e s a re e x c h an g e d.

Ex am p le :

•A lic e s e n ds o ne m e s s a g e t o B ob .
•T h e m e s s a g e c on t ain s :
• T h e c o n tra c t , a n d
• H e r d ig it al s ig na t ure o n t he c o n tra c t — w ritt e n a s S ig A lic e (c o nt ra c t).
T h e d ig ita l s ig n a tu re prov e s th a t th e m e s s a g e re a lly c a m e fro m A lic e .

E ve n if s he tr ie s to de ny it la t e r, B ob c an s h ow t he s ig n e d c o n tra c t a s proo f.
Standards for Cryptographic Protocols
M ak in g y ou r ow n c rypt og ra phic pro to c o l is ve ry h a rd a n d ris ky.

S o, it ’ s be t te r t o u s e s ta nd a rd pro t oc ols th at are a lre ad y te s t e d a n d a ppro ve d by e xp e rts .

Some common standard protocols

•PKCS – u s e d fo r pub lic -k e y c rypt og rap hy.
•ISO/IEC 11770 – u s e d fo r au t he nt ic a t io n a n d k e y s ha ring .
•SSL/TLS – us e d for s e c u re on lin e c o m m un ic at ion (like H T T P S w e b s ite s ).

Why use them?

B e c au s e th e y a re safe, tested, and reliable.
But there are two problems:
[Link] Complexity:
S om e s ys t e m s ha v e s pe c ia l n e e d s , a n d n o e xis t in g s ta n d ard fit s t h e m e x a c tly.

T h e n, d e ve lop e rs m a y n e e d t o c re a te a n e w c u s to m prot o c o l.

E xa m ple : T h e m a d e t he ir o w n pro to c o ls .

[Link] of Fit:
A s t an d a rd m u s t b e u s e d e xa c tly as it is .

If yo u c h a n g e e ve n a s m a ll p art , it m ig h t lo s e it s s e c u rit y.

E xa m ple : C h an g in g a s m a ll de t a il in A E S o r T L S c a n m ak e it u n s a fe .
9.2.3 Assumptions and actions

T his pa rt ta lk s a b o ut the ex tr a d e ta i ls n eed ed t o m a k e th e s im ple pr o to co l

b e tw ee n A lice a nd B o b (sen d ing a sig ne d c o ntr a ct ) a ct ua ll y w o rk co r re ct ly a nd

se cur el y.
P ro b l em s in t he s im pl e p ro t o co l :

1 .B o b m ig ht no t k no w w hich d ig it a l s ig na t ure m et ho d t o us e.

2 .A lic e m i gh t no t ha ve a s ig na t ure k ey t o si gn the co ntr a ct .

3 .B o b m i g ht n o t h a ve A lice ’ s pub lic k ey to che ck her sig na tur e.

4 .B o b m i g ht fo r g et to ve rify th e s ig na t ure , so he c a n’ t b e sur e t he

co ntr a ct is re a lly fro m A lic e.

Assumptions (Things that must be true before running the protocol):
B efo r e t he p ro to c o l s ta r ts:

✅ A li ce a nd B o b a g ree o n w hi ch d ig ita l si g na tur e sch em e t he y w ill use .

✅ A li ce ha s her sig n a tur e k ey rea d y.
✅ B o b ha s A l ice ’ s pub l ic (v er ifica tio n) k ey to c hec k he r s ig na t ure .
Actions (What must happen during the protocol):
A fter B o b r ec eiv es th e s ig ned co nt ra ct:

✅ B o b m ust ve ri fy A lic e’ s d ig it a l s ig na t ure .

T his st ep pr o v es tha t th e m e ssa g e r ea ll y c a m e fr o m A lice a nd ha s no t

b e en c ha ng e d .
• Assumptions → W ha t m ust b e re a d y before sta rti ng (k ey s,

m et ho d s , a g re em ent s).

• Actions → W h a t m us t b e d o ne after rec eiv in g the m es sa g e

(ve rify si g na tur e).

9.2.4 The wider protocol design process
D es ig ning a cr ypt o g ra phic pr o to co l is j ust o ne pa rt o f th e w o r k . E v en

if t he d es ig n is g o o d , p ro b l em s ca n ha pp en if it ’ s no t use d o r b uilt

co rre ct ly.
Common mistakes that cause problems:
[Link] coding – T he w a y enc ry pt io n o r ha s hing is w ri tt en i n the p ro g ra m

m a y ha v e m is ta k es.

[Link] weak algorithms – U sin g o ld o r un sa fe m et ho d s lik e D E S o r M D 5 .

[Link] steps – F o rg et tin g a n im p o rt a nt a ct io n in t he p ro t o co l.

[Link] key management – N o t k ee pin g se cre t k ey s s a fe.

9.3 Analysing a simple protocol

T h is pa rt ta lks a b ou t s t ud yin g on e s im ple c rypt og rap hic prot o c ol (a s e t o f ru le s t o s e n d

m e s s a g e s s e c u re ly).

W e are n o t le a rn in g t o d e s ig n n e w pro to c o ls h e re — ins t e a d, w e are le a rnin g to :

1 .U nd e rs t a nd ho w c rypt og rap hic prot o c ols w o rk,

2 .S e e th a t th e re a re m a n y w ays t o d e s ig n t he m (e a c h w ith g o od an d ba d po int s ), a n d

3 .L e a rn h o w to c he c k if a pro to c o l is r e ally s a fe a n d d o e s w ha t it s h ou ld.

In s h ort :

It’ s a bo u t le arn in g t o u n de rs ta n d a nd an a lys e s im ple s e c urit y pro t oc o ls ,

n ot c re a ting n e w o ne s .
9.3.1 A simple application
T his s ec t ion t alks ab out a ve ry b as ic s e c urity e xam ple to he lp u s u nde rst an d how c ry pt og ra ph ic prot oc ols

w ork.

E ve n t houg h this e xam ple is to o s im ple for rea l life , it’ s s till g oo d fo r le arnin g and a naly s is.
The Situation
T he re a re t w o pe ople — A lic e a nd B ob — c onne c te d t o t he s am e ne tw ork.

N o w a nd t he n, B o b w a nt s t o c he c k if A lic e is s t ill online (aliv e) a nd c onn ec t e d to th e n et w o rk .

T his is ca lled a “ live ne ss c he ck .”

Im ag ine it like a “ ping ” — B ob se nd s a m e ss ag e to se e if A lic e re plies .

T he re a re m a ny pe ople (not jus t A lice an d B o b) on this ne t w o rk , a nd e ve ryo ne ch ec ks e ac h ot he r’ s live ne s s

reg u larly (lik e e ve ry fe w s e c onds ).

S o, w he n B o b g et s a reply fro m A lic e , h e m us t k now ex ac tly w hic h req ue st s he ’ s reply ing t o.

The Objectives (Goals of the Protocol)

T h e pro t oc ol (s e t of ru le s ) th e y us e m u s t a c h ie v e th re e m ain s e c urity g o a ls :

1. Data Origin Authentication

B ob s ho u ld be s u re th a t th e re ply h e re c e ive d re ally c a m e fr om A lic e ,no t fro m s o m e o n e

pre t e n din g to b e h e r.

If not achieved:
A n a tt ac k e r c o uld s e nd a fak e re ply, a n d B o b m ig h t t h in k A lic e is a live w h e n s h e ’ s n ot .
2. Freshness
T h e re p ly s h ou ld b e n e w (re c e n t), no t a n o ld m e s s a g e re pe a te d b y a n a t ta c k e r.

If not achieved:
A n a tt ac k e r c o uld t a ke a n o ld re ply fro m w he n A lic e w a s alive an d re -s e n d it la te r (a fte r

she’ s g o ne ).

B ob w ou ld b e fo o le d in t o th ink ing A lic e is s t ill a liv e .

3. Assurance that Alice’ s reply corresponds to Bob’ s request

T h e re p ly from A lic e m us t m at c h t he e x ac t re qu e s t B o b s e n t.

If not achieved:
B ob c ou ld re c e ive a re ply m e a nt fo r a d iffe re n t re q u e s t — m ayb e from a n ot he r t im e o r e ve n

fro m a n ot h e r u s e r.

T h is c a us e s c o n fus io n a nd s e c u rit y pro ble m s .

T o g e t he r, G o a l 1 + G oa l 2 e n s u re th a t A lic e is a liv e an d re s pon d in g rig h t n ow .

G oa l 3 m a k e s th e s ys te m m o re a c c u ra te a nd re lia b le .

Table 9.1: Notation used during protocol descriptions

Symbol Meaning (Simple)

rB R a n d om n um b e r (n on c e ) c re a te d by B o b

Bob Ide n t ifie r or n am e o f B ob

M e s s a g e A u th e n t ic a tio n C o de (M A C ) of th e
M A CK (d at a )
d at a u s ing a s e c re t k e y K
E K (d a ta ) D a t a e n c rypt e d w ith ke y K
S ig A (d a ta ) A lic e ’ s dig ita l s ig n a tu re on th e da t a
TA T im e s ta m p (t im e ) c re a t e d b y A lic e
TB T im e s ta m p c re a te d b y B o b
S e s s io n id e n tifie r (un iqu e ID for t ha t
ID S
s e s s io n)
CANDIDATE PROTOCOLS
W e w ill n o w e x a m in e s e ve n c an d id a te c rypt o g ra ph ic pro to c o ls a n d d is c u s s th e e xt e n t to

w h ic h th e y m e e t t he t hre e s e c u rity g o a ls . M os t im po rt an t ly, w e w ill s e e th a t:

• W hic h o n es m eet a ll thr ee g o a ls ,

• W hic h o n es nee d e xt ra c o nd i tio n s o r a s sum p tio n s t o w o rk ,

• A nd w hic h o ne s fa il e ve n if t hey lo o k o k a y a t firs t.

9.3.2 Protocol 1
T h is is a s im ple live n e s s -c h e c k prot o c ol be t w e e n B o b a n d A lic e .

B ob w an t s t o m a k e s u re th a t A lic e is a live a nd ac t ive on th e ne t w o rk .

Before They Start (Assumptions)

B e fo re ru nn ing t h is pro to c o l, 3 th ing s m us t a lre a dy b e t ru e :

[Link] can generate a random number (c a lle d a , w ritt e n a s rB ).

→ T his e ns u re s e a c h re q u e s t is n e w a nd un iqu e .

[Link] and Bob share a secret key (K).

→ O n ly th e y k no w th is k e y.

[Link] use a strong MAC algorithm.

→ MAC = — it pro ve s w h o c re a te d a m e s s a g e a n d th a t it w a s n

’ t c h a ng e d .
Step-by-Step Protocol Flow:
Step 1: Bob sends a request
• B ob c re a te s a ra n do m nu m b e r rB .

• H e a tt ac h e s it to t h e m e s s ag e :

rB || "It’ s Bob, are you OK?"

• H e s e n ds t his to A lic e .

🧠 (“ ||” m eans — jo in ing t h in g s to g e th e r.)

Step 2: Alice replies
• W h e n A lic e re c e ive s B o b ’ s m e s s ag e , s h e c re a te s h e r re ply lik e th is :

rB || Bob || "Yes, I’ m OK"

• T h e n s h e c alc u la t e s a MAC u s in g t h e ir s e c re t ke y K :

MACK(rB || Bob || "Yes, I’ m OK")

• S he s e n d s b o th to B o b:

rB || Bob || "Yes, I’ m OK" || MACK(...)

Step 3: Bob verifies the reply
W h e n B ob re c e ive s A lic e ’ s re ply, he c h e c k s :

1 .D oe s it in c lu de th e s a m e rB he s e n t?

(If ye s → th e r e ply is fre s h an d b e lon g s t o h is re q u e s t.)

2 .Is th e M A C c orre c t us in g th e s h are d ke y K ?

(If ye s → th e r e ply re a lly c a m e fro m A lic e .)

If b o th c he c k s pa s s → B ob kn o w s Alice is alive and genuine.

Does It Meet the 3 Security Goals?

Goal Explanation Achieved?

O n ly A lice (w ho k now s K ) c ould

1. Data origin authentication m a ke a valid M A C → reply ✅

d efinit e ly from A lice .

R eply c ont ains rB , a ran dom

2. Freshness n um be r uniq ue to t his s es s ion → ✅

e ns ure s n ew m e s sa g e.

R eply inc lude s rB (B ob’ s nonc e )

3. Matching request and reply a nd B ob’ s n am e → prov es it ’ s ✅

a re s po ns e t o B ob’ s m e ss ag e .
Important Protocol Parts:
If a ny p a rt is s k ippe d o r d o ne w ro ng , s e c urity is lo s t.

Part Meaning
T he th ing s th at m us t be tr ue b e fore s t art ing
Assumptions
(e .g ., s h are d k e y, ra n do m g e n e ra to r).

Flow T he o rde r o f m e s s ag e s s e nt (re q u e s t → re ply).

T he e xa c t c o n te n t o f w ha t ’ s sent and
Messages
re c e ive d .

T he c h e c k s a n d c a lc ula tion s b ot h s ide s m u s t d o

Actions
(like v e rifying M A C ).
9.3.3 Protocol 2
P rot oc ol 2 is alm os t t he s am e as P rot oc ol 1 , b ut it us e s d ig ital s ig nat ure s ins te ad o f

M A C s.
Protocol Assumptions
1 .B ob h as a s ourc e o f ran dom n um be rs (us ed to cre at e a nonc e ).

2 .A lice ha s a sig na tu re ke y pa ir:

• A privat e ke y ( for s ig ning m e s sa g es ).

• B o b ha s h er public ke y (fo r v erify ing he r s ig nat ure ).

3 .B oth ag ree t o us e a s trong d igit al s ig nat ure sc he m e .

Protocol Analysis
•O nly Alice ca n m ak e h er ow n digital signature, be c aus e only s he has he r private key.
•W h en Bob ve rifie s the s ig nat ure su cc e ss fully , he know s th e m es s ag e re ally c am e fro m Alice.
•S o, Protocol 2 als o m e et s all t hree s e cu rit y go als (aut he nt ic atio n, int eg rity , an d dat a orig in
au the nt ic at ion).
9.3.4 Protocol 3
P rot o c ol 3 lo o ks a lm o s t t h e s a m e a s P ro to c o l 1 ,

b ut th e re is o ne s m a ll diffe re n c e :

In P rot o c o l 3 , th e r e ply m e s s a g e d oe s n o t in c lu de B o b ’ s na m e (id e n tifie r).

9.3.5 Protocol 4
9.3.6 Protocol 5
Protocol Main Idea What It Uses How It Works (Simply) Security Goal Achieved
Bo b se nds a ra ndo m
S ha r ed s ec r et k e y & num b er → A l ice Ens ure s m es s a ge ca m e
U s es MAC f o r m es sa g e
Protocol 1 r a ndo m num b e r re pli es w it h m e ss a ge + fr o m A li ce , no t
a ut he nti ca t io n
( no nce ) M A C → B o b che c k s cha ng ed, a nd is f re sh
MAC
A l ice ’ s signature key Al ice s igns t he Ens ure s m es s a ge is
U s es Digital Signature
Protocol 2 an d B ob’ s m es sa ge → B o b fr o m A li ce (a ut hent ic )
i nst ea d o f M A C
verification key ver if ies he r s ig na tur e a nd no t cha n ge d
Al ice e ncr yp t s a nd
A dds encryption f o r K ee ps t he m es sa g e
Protocol 3 S ha r ed s ec r et k e y se nds m es sa g e → B o b
c o nf ident ia l ity se cr et a nd a uthe nt ic
dec ry pt s it
Al ice e ncr yp t s us ing
U s es public key P ub l ic– p r iva te k e y K ee ps m e ss a ge s ec re t
Protocol 4 Bo b ’ s p ub lic k e y →
encryption p a ir a nd o nly B o b c a n r ea d
o nly Bo b ca n dec ry pt
Al ice s igns t hen
Ens ure s se cr ec y ,
C o m b ine s digital B o t h p ub lic & pr iva t e enc ry pt s the m e s sa g e
Protocol 5 a uthe nt ici ty , a nd
signature + encryption k e y s → B o b de cr yp ts a nd
inte g rit y to g et he r
ver if ies
9.3.9 Simple protocol summary
• There is no one correct way to design a cryptographic protocol.

O u t o f t he s e v e n pro to c o ls w e s t ud ie d , th re e o f t he m a c h ie v e d a ll th re e m ain s e c urit y

g o a ls — c on fide n t ia lit y, a u th e n tic a tion , a n d fre s h n e s s — e v e n t ho u g h t h e y w e re

d iffe re n t in d e s ig n.

T h is s h ow s t ha t t h e b e s t pro t oc o l d e pe n d s o n w ha t k in d of app lic a tion or e n viro nm e nt

it is u s e d fo r.

• Designing cryptographic protocols is difficult.

M an y o f t he fla w s o r w e a k n e s s e s in th e s e prot o c o ls a re v e ry s m all a n d h ard to no t ic e .

S in c e th e e xa m ple s w e s t ud ie d a re s im ple , it b e c o m e s c le a r th a t for re a l a n d c o m ple x

s ys t e m s , d e s ig n in g a s e c ur e pro t oc o l is e ve n m ore c h a lle n g ing .

 9.4 Authentication and key establishment protocols

T h e s e c urity g oa ls in o u r e a rlie r s im ple pro t oc o l w e re q u it e basic, s o it w as d iffic ult t o s e e

w h y s uc h a pro to c o l w o u ld be n e e d e d in a re a l a pplic at io n .

H o w e v e r, b y s tu d yin g a nd an a lyzin g th o s e s im ple v e rs ion s , w e le a rn e d th e analytical skills

n e e d e d t o u nd e rs t an d more complex cryptographic protocols t ha t h a ve stronger and more realistic

security goals.
N ow , w e lo o k a g a in at Authentication and Key Establishment (AKE) protocols.

T h e re a re hundreds of AKE protocols, b e c au s e e a c h o n e is us u a lly de s ig ne d to fit the exact needs

o f t he a pplic a tio n w h e re it w ill b e u s e d .

E v e n th o ug h t her e a r e m a ny v er sio ns, t he two main security goals o f a n A K E

pr o to co l a re a lw a ys :

[Link] entity authentication – so m e tim e s o n ly one-way authentication (unila ter a l)

is nee d ed .

[Link] of a common symmetric key, n o m a tt er w het her symmetric or

public-key te chni q ues a r e us ed .
It sho u ld no t b e sur pr isi ng th a t t hes e t w o g o a ls a r e c o m b ine d in o ne pro to c o l.
1. Need to Authenticate Key Holders
B e fo re tw o pa rtie s s ha re a s e c r e t ke y, t he y m u s t firs t ve rify e a c h ot he r’ s id e nt ity —

t his proc e s s is c alle d entity authentication. W it ho u t it, a s e c re t k e y m ig h t be s h a re d w ith

a n u nk n o w n o r fa k e pe rs on . In m os t c as e s , b ot h pa rt ie s c o n firm e ac h o th e r’ s id e n tity

(m u tu a l a ut he nt ic a t io n ) b e fo re t h e k e y is e s t ab lis h e d . T h is e n s u re s th e ke y is s h a re d o n ly

b e tw e e n tr us t e d pa rt ie s .

2. Prolonging Authentication
A ut h e nt ic at io n pr ov e s id e n tity o nly fo r th a t m o m e n t in tim e . T o k e e p th a t t rus t ac t iv e fo r a

lon g e r pe rio d (lik e a c o m m un ic a tion s e s s ion ), a symmetric key is c re at e d d u rin g a u th e n tic a tion .

T h is k e y h e lps m ain ta in th e tru s t — w h e ne ve r it ’ s us e d , it c o n firm s th a t t he s a m e t w o

pa rtie s ar e s t ill c o m m u n ic a tin g s e c u re ly . T h is w a y, t he s e c u rity a c hie v e d d urin g au t he n t ic a t io n

c o n tinu e s th ro u g h ou t t he s e s s io n .
9.4.1 Typical AKE protocol goals
W h e n A lic e a n d B ob ru n a n A K E pro t oc ol, t he y h a ve s e ve r al security goals to e n s u re s a fe

c o m m un ic a tion . T h e s e g o a ls m a k e s u re th a t b ot h pa rt ie s c a n t rus t e ac h ot h e r a n d t he k e y th e y

s h are is s e c ure a n d u niq ue .

1. Mutual Entity Authentication
B o t h A lic e a nd B o b m us t co nf ir m each other’ s identity to b e s ur e t he y a r e co m m unic a ti ng w it h t he ri ght pe r so n — no t
a n a t t a ck e r.

2. Mutual Data Origin Authentication

B o t h sho u ld b e sur e tha t t he messages or data t he y r e ce ive a ct ua lly c a m e fr o m the o t her p a rt y a nd no t so m eo ne

p re te nding t o b e the m .

3. Mutual Key Establishment

A lic e a nd B o b m us t suc c es sf ully create and share the same symmetric key t ha t w il l b e use d f o r se cur e co m m unic a ti o n.

4. Key Confidentiality
T he shared key must remain secret — no o ne els e (lik e a n a t t a ck e r) sho ul d b e a b le to a cc es s o r k no w it.
5. Key Freshness
T he e st ab lish ed ke y m u st be new and not reused from any pre vio us se s sio n. T his en su re s t hat old ke y s ca nnot be

us e d for ne w a tt ac ks .

6. Mutual Key Confirmation

A ft er c rea tin g t he ke y , both Alice and Bob should have proof th at the y ac tu ally sh are t he s am e ke y .

T his c an be do ne by ex ch ang ing c rypt og ra ph ic e vid en ce us ing t he ke y.

7. Unbiased Key Control

N e it he r A lic e n or B ob sh ould have t he power to choose or control the ke y c om ple te ly .

T he ke y sh ould b e g e ne rat ed fa irly s o t hat bot h c ont ribut e to it e qua lly o r t rus t a third part y t o g e ne rate it .

Ways to achieve this:

B o th add ran dom part s t o t he ke y (ca lled joint key control).

Us e a trusted third party t o g e ne ra te and sh are t he ke y .

9.4.2 Diffie– Hellman key agreement protocol

T h e D iffie – H e llm a n pro t oc ol is a m e t ho d t h at le t s t w o pe ople (s ay A lic e a n d B o b)

c re a te a s ha re d s e c re t k e y — e v e n t ho u g h t h e y t a lk ov e r a pu blic n e tw ork w h e re a n yo ne

c a n lis t e n .

T h e m a g ic pa rt is :

t he y d on ’ t a c t ua lly t he s e c re t ke y t o e a c h o th e r, bu t s t ill e n d u p w it h t he s a m e

s e c re t !
T h e pic t ure s h o w s h o w th e Diffie– Hellman key exchange w o rk s be t w e e n Alice a n d Bob.

[Link] c h o o s e s a s e c re t n u m be r a an d Bob c ho o s e s a s e c re t n u m b e r b.
2 .B o th k n o w t w o pu b lic nu m b e rs : g (a b a s e nu m b e r) an d p (a la rg e prim e n u m be r).

3 .A lic e c a lc u lat e s gᵃ (mod p) an d s e nd s it t o B ob .

4 .B o b c a lc u lat e s gᵇ (mod p) an d s e nd s it t o A lic e .

5 .W h e n A lic e re c e ive s gᵇ, s he ra is e s it to h e r s e c re t a → (g ᵇ )ᵃ = gᵃ ᵇ .

6 .W h e n B o b re c e ive s gᵃ, he ra is e s it to h is s e c re t b → (g ᵃ )ᵇ = gᵃ ᵇ .

7 .B o th e n d u p w ith t h e same secret value gᵃᵇ, w h ic h b e c o m e s th e ir shared secret key.

E ve n t h ou g h th e y s e n d gᵃ a nd gᵇ o v e r t h e pu b lic ne t w o rk (w h ic h a nyo n e c an s e e ), n o o n e e ls e

c a n c a lc ula te gᵃᵇ w it ho u t k no w in g th e priv at e nu m b e rs a o r b.

Im a g ine A lic e a n d B ob w a nt t o m ix t he s a m e secret paint color, bu t t h e y’ re

s t an d in g fa r a pa rt w h e re ot h e rs c an s e e w ha t t he y d o .

1 .T h e y a g re e o n a public color (s a y, y e llo w ).

2 .A lic e pic ks h e r secret color (re d ), B o b pic k s his secret color (blu e ).

3 .T h e y bo t h mix t h e ir s e c re t c olo r w it h th e pu blic c o lor a nd send the result (o ra ng e

a nd g re e n is h-y e llo w ) t o e a c h o th e r.

4 .N o w A lic e ta k e s B o b’ s m ix a nd adds her secret color a g a in , an d B o b d oe s t he

s a m e w it h A lic e ’ s m ix .

5 .B o th e n d u p w ith the same final color — a un iqu e s h ad e th a t no on e e ls e c a n e as ily

guess.

T h at fin al c olo r = t he shared secret key.

This im a ge s how s a Man-in-the-Middle (MITM) attack on the Diffie– Hellman key exchange .

Simple Explanation:
•A lic e w a nts t o t alk s e cu re ly w it h B ob.
•B ut Fre d (t he at ta ck er) s e cre tly s its in t he m idd le.
•A lic e th inks s he ’ s t alking t o B o b, and B ob thin ks he ’ s t alkin g t o A lice .
•In re alit y :
• A lice s hare s a ke y w it h Fre d → g ^af
• B ob s hare s a ke y w it h Fre d → g ^bf
•Fre d c an re ad, c hang e , or fa ke all m e s sa ge s be tw e e n th em .
In short:
Fre d t rick s b oth sid es an d be c om e s the “ m idd lem an,” st e aling or alt e rin g t he ir se c ret m e s sa ge s .
Simple explanation:
A lic e an d B o b w a nt to s h a re a s e c re t ke y s e c u re ly a n d pro ve w h o t h e y a re .

1 .A lic e s e nd s h e r pu b lic va lu e ( gᵃ mod p) a n d h e r dig ita l c e rtific a te ( CertA) t o B ob .

2 .B o b s e n ds h is pu b lic va lu e ( gᵇ mod p), h is c e rt ific a te ( CertB), an d a digital signature to

pro ve t ha t t he m e s s a g e is re a lly fro m h im .

3 .A lic e s e n ds b ac k h e r signature t o pro ve h e r id e n tity.

In th e e nd , bo th s h are t he s a m e s e c re t k e y ( gᵃᵇ) a nd ar e s u re th e y a re t a lk in g t o th e re a l

pe rs o n — n ot an at ta c k e r.