[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
XCASS security
Phill, I've taken a look at the XCASS protocol (the PDF file on the site
you pointed to, printed August 15, 2001, page 12, Fig 4).
It seems that the protocol is susceptible to the following attack:
Assume that an attacker managed to obtain the secret DH exponent of the
initiator in some ill-protected session. This means that the attacker has
the initiator's signature on some g^x, where the attacker knows x.
>From now on, the attacker can impersonate this poor initiator in the eyes
of any prospective responder, basically until the end of time.
Is that true or am I confused?
(One can ofcourse argue about the likelyhood of the attacker obtaining such
an x. I can imagine some settings where this is not so unlikey...)
I was trying to fix this without adding a flow or assuming that
the initiator knows the responder's ID ahead of time, but couldn't see how.
Ran