Re: Servers that just want to have TLS

On Fri, 9 May 1997, David P. Kemp wrote:

> > From: "E. Gerck" <[email protected]>
> > 
> > Better, it can avoid mitm -- yes -- (which the other situation can't, of
> > course), even without user authentication, if the anonymous user knows for
> > sure a quality of the LDAP server -- which can be public.
> 
> The thing the user knows about the server must (not "can") be public.
> Otherwise, by definition, you would be doing shared-secret authentication.
> 

This may be just a play of words, but I did not restrain my example to an
anonymous server, just an anonymous user, which was the original question
(hey, could someone just stop chopping off those first lines? ;-))  

But there are some other interesting points. In the case of a non-anon
server, the anon user can know a private value of the server without
itself becoming non-anon. For example, a person might have an account at a
Bank, say he is called Skywalker (he is non-anon in that capacity, of
course), with his address and so on.  The Bank sends him a private value,
to be used only by people that have accounts in the Bank, for e-cash
deposits. The Bank also maintains services for people that are not
clients, that do not have this number. Now, Skywalker wants to contact the
bank but does not want to give his name because he wants to give the Bank
some e-cash with a blind signature, that he wants to have as anonymous
credit in his account. He can do that with the private value he received
from the bank, which is private to the public but known to the e-cash
account owners.

That is why I wrote "can". It can be must, if you may ;-)

> 
> > It is a much more common misconception to think that you need at least one
> > authenticated endpoint to avoid mitm.
> 
> I'm afraid I suffer from that misconception.  Could you post references
> to a protocol that defeats mitm attacks without authenticating either
> endpoint?
> 

Apparently, you are not alone ;-)

The Meta-Certificate protocol that is being discussed in the MCG
(http://novaware.cps.softex.br/mcg.htm).

The idea is to use multiple channels, similar in a way to spread spectrum
techniques used in communications. Suppose you can open 3 indepedent
channels of communication between you and the server. Though it is not
necessary, suppose one is a radio link over modem, another is a
cable-modem link and another a dial-up link. If all three channels agreee
on nonce exchanges (i.e., all 3 give correct results, which will be
different for each) and if the probability of attack by mitm is 10% (say)
per channel, then this means you should have a risk of 0.1% of being
affected by mitm, though both sides are perfectly anonymous.

This can be reduced to almost zero if you use virtual channels within one
channel (multiple messages time-multiplexed in different channels).

You can even use one channel if you have cooperative targets between
channel changes and you use the virtual channel technique as above.

This can applied to avoid other attacks also. It can be applied to check
multiple CAs for a certificate (a spoofing attack would change all at
once).


Yours,

Ed Gerck

______________________________________________________________________
Dr.rer.nat. E. Gerck                        [email protected]
http://novaware.cps.softex.br
P.O.Box 1201, CEP13001-970, Campinas-SP, Brazil  - Fax: +55-19-2429533