[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Man in the middle attacks
> From: cme@cybercash.com (Carl Ellison)
>
> Yes! If you've met Bob in person, then you have a body of common knowledge
> that most likely can be converted to a shared secret. That shared secret,
> in turn, can be used to verify that there is no eavesdropper. This
> in-person meeting is the second channel which defeats Eve.
>
> The thing which amazes me is how fragile the MITM attack is for all the
> attention it gets.
I'd like to see your proposal for converting wetware shared secrets
into a cryptographic shared secret, reliably and with more than a
trivial number of bits.
"Hey Bob, remember that restaurant we went to at the last IETF?
What was the waitress' name and how many people were at the table?"
What does that get you? About 8 bits of entropy?
And what if you remember the waitress as "Lori", but Bob remembers
her as "Lorrie"?
The nice thing about your key-centric identity scheme is it's strength
- relationships can be much more reliable when identities exist only in
CyberSpace.
So suggesting that MITM can be defeated by transferring RW "common
knowledge that is shared by only two people" into CS is not a
convincing argument, and is particularly surprising, considering
the source.