English
Menu

Applied Cryptography

Which of the following is the correct combination of a weakness of Diffie–Hellman key exchange without authentication and its countermeasure?

  1. AAn eavesdropper can compute the shared secret just by seeing the public values. The countermeasure is to keep p and g secret so that the values sent cannot be intercepted on the channel
  2. BIt cannot prevent a man-in-the-middle attack in which an attacker in between runs separate key exchanges with each party. The countermeasure is to sign the public values with a certificate key to confirm the other party
  3. CThe secret values a and b are the same every time, so the shared secret never changes. The countermeasure is to run the key exchange only once and keep using the same secret for a long time
Show answer and explanation

Answer: B. It cannot prevent a man-in-the-middle attack in which an attacker in between runs separate key exchanges with each party. The countermeasure is to sign the public values with a certificate key to confirm the other party

This key exchange does not check whether a received public value really came from the other party. An attacker in between can therefore run one key exchange with A using its own value and another with B using its own value, relaying both sides while decrypting them (a man-in-the-middle attack). In TLS the server signs the key exchange with the private key of its certificate and the client verifies this with the certificate, which prevents this attack. p and g are values that may be public and need not be kept secret.

  • A. Finding the shared secret from the public values alone requires solving the discrete logarithm problem. p and g may be public.
  • B. Correct. The key exchange itself does not authenticate the other party, so it is combined with authentication by signatures and certificates.
  • C. a and b can be chosen afresh each time. Using the same secret for a long time actually increases the impact of a leak.
Practice this topic Back to topic

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

More Applied Cryptography questions

  1. In the table of NIST SP 800-57, which of the following is the combination of RSA key length (the number of bits of n) and elliptic-curve key length given as the guideline for security comparable to a 128-bit symmetric-key cipher (AES-128)?
  2. In TLS, which of the following key exchange methods provides the property that previously recorded communications cannot be decrypted even if the private key of the server certificate leaks later (forward secrecy)?
  3. In ECDSA digital signatures, a secret random number k is used for each signature. Which of the following correctly describes how k must be handled?
  4. Which of the following correctly describes the certificate chain when a browser validates a web server's certificate?
  5. In TLS certificate validation, besides the chain of signatures and the validity period, the client checks that the host name it is connecting to is included in the SAN (subject alternative name) of the certificate. Which of the following is the reason this check is indispensable?

Comparisons in this topic