Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My university provided me with the following slide which is confusing me:

enter image description here

From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then authenticates Trudy as Alice. Other than that however I'm really able to explain what else is going on here.

Also, can this happen in symmetric key cryptography? The way I understand it, this can happen because as Alice and Bob exchange keys, Trudy could take it if the security was not good enough and then use it to pretend to send messages in place of Alice.

share|improve this question

1 Answer 1

up vote 7 down vote accepted

A man-in-the-middle attack is a simultaneous double impersonation: Charlie poses as Alice when he talks to Bob, as Bob when he talks to Alice. Since both conversations are simultaneous, Charlie can elect to pass chunks of data from Alice directly to Bob and vice-versa, adding his own parts selectively.

If Alice and Bob have a shared secret K, which Charlie does not know, then they can use encryption and MAC to prevent Charlie from doing a successful MitM (Charlie can still cut the wire and disrupt communications, though -- but he can no longer alter data without being detected, or read confidential data). The trick is to reach the point there such a secret K is shared; all the business with certificates and handshake in SSL is about doing just that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.