Secure intermediation of messages

Question

Suppose there's systems A, B and C.

A has an trusted relationship* with B and B has one with C. How can B intermediate a request from A to C while still providing both A and C the guarantee that they are talking to each other?

Some options I have considered:

• A can share a passkey with C and that key can be used to encrypt messages before they are sent to B and decrypted when they reach C.

*=Meaning they they are connected via an unspecified trustworthy connection.

Answer 1

First of all, when saying X and Y have a trusted relationship, it usually implies that X trusts Y and vice versa. This is not necessarily to do with the quality or guarantees of the link between them. I'm not just saying this to correct your definition, but because this trust relationship is important.

If in your case, A trusts B, and C also trusts B, then both A and C should trust that B delivers the messages that they sent without modification. There are many cryptographic examples that use a trusted 3rd party for exactly those kind of things.

If however, there's no trust in B. Only a trust in the security of the links to/from B, then it's a different story.

Encryption is probably not what you need here, or not ONLY what you need. If A and C share a key and encrypt messages between each other (via B), B won't be able to read the messages, but nothing stops it from changing the messages. Some times it's possible to make changes to encrypted message. For example, if I encrypt a message "I owe you $1000", it might be possible that B adds stuff to the message so after decryption it looks like "I owe you $10000", or change it to "I owe you $9000" (e.g. bit flipping attack). I wrote a little blog post describing this misconception in a little more detail, in case you're interested.

If you want to protect the message against modification, you should consider using some kind of a Message Authentication Code (MAC). Typically, you'd probably want to use HMAC - which uses a secure hash function to generate the MAC. This is like a signature on the message. Even the smallest modification will invalidate this signature, so it can be detected. Without knowing the key between A and C, B cannot forge this signature either.

Now nothing stops you from using Encryption + Signature. This will ensure both that those messages cannot be read nor modified.

With all that in mind, I'd still urge you not to develop/build your own solution, but rather find a suitable protocol or at the very least a library/package that provides those kind of mechanisms.