Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

Imagine I have a computer where all the trafic is being sent through the MitM. How would it be possible to have a secure connection through this setup?

In this case it would be OK to design a new protocol just for this. I just want to know if there is a way to do this. If there is a new protocol we need to make it unbruteforceable for the next 10 years.

EDIT: Assume you didn't exchange any keys before you got MitM'd. Absolutely every communication from/to you to/from the server is being MitM'd.

share|improve this question
Lets see if I understand this correctly. You want to know if it possible to establish trust between yourself and a remote party when there is no previous contact and no way to establish a communications channel that can provide confidentiality or integrity between you and the remote party? – this.josh Aug 21 '11 at 7:17
1  
The way you formulate this it's obviously impossible. You cannot protect against a man in the middle attack without out-of-band communication. – Nick Johnson Aug 22 '11 at 3:15
I guess both of you are correct. – Filip Haglund Aug 22 '11 at 12:01

migrated from stackoverflow.com Aug 20 '11 at 13:52

5 Answers

up vote 9 down vote accepted

The way that SSL and TLS work is that there is some way to provide authentication for at least one side.

Normally the server has a private key where the client has the fitting public key (or, more usually, some root public key of a certificate chain which certifies the public key of the server). Alternatively, also some password-based authentication methods are possible (client has password, server has some salt + salted hash).

Then we can do a key exchange (over your MitM channel), and the MitM can't do anything (other than a DoS) against our protected connection.

If you say "there can't be any earlier exchange of a (even public) key", then there is no way to do this, as the MiTM can act as the server against the client, and as the client against the server. (SSL/TLS still provides protection against a "only-reading" attacker by anonymous Diffie-Hellman key exchange, but this does not help for an active attacker which can intercept and change all packets.)

share|improve this answer
up vote 4 down vote

There is man-in-the-middle all over the place/internet and still the TLS/SSL protocol is considered to be secure.

Your traffic passes possibly a lot of machines before it reaches its destination and comes back to you. Still, there is no way to perform a viable man-in-the-middle attack on TLS (as long as you verify the peer host name!), at least none publicly known.

Being vulnerable to MITM has nothing to do with being "unbruteforceable" - the former is an aspect of secure protocol design, whereas the latter is a feature of the protocol's underlying parts - the cryptographic algorithms. So even if a protocol could be proven as absolutely secure there still exists the possibility to brute-force it. And vice versa even the hardest-to-break algorithm fails if the protocol is badly designed and exploitable by other measures than to attack the cryptography.

share|improve this answer
What if the attacker captures the initial packets, and have an ssl decrypter? – Filip Haglund Aug 20 '11 at 14:45
The attacker would still need the private key to the server's cert, which he doesn't have. – Steve Dispensa Aug 20 '11 at 16:22
Yes, having an "SSL decrypter" means the attacker either already possesses the private key or is able to break SSL - unlikely. – emboss Aug 20 '11 at 16:38
Unlikely isn't secure enough to someone who really tries hard. And wouldn't the MitM be able to start a secure connection to both the user and the server? And just tunnel the trafic from one ssl to another? While posing as the server for the user and vice versa? – Filip Haglund Aug 20 '11 at 18:41
2  
@Flip Haglund: Either you're not paying attention or you don't understand the authentication model used by TLS. The user would detect the MiTM trying to pretend to be the server. – GregS Aug 20 '11 at 19:37
up vote 4 down vote

Good protocol designs expect a MitM. Exactly how you protect yourself depends on the protocol, but it often involve verifying the server's identity (assuming you're a client). In https, this means checking and trusting the server's certificate; in ssh, it means verifying the server's key fingerprint; in OpenVPN it means trusting the server's cert.

Every secure protocol has a way to authenticate the other end of the session, which prevents a MitM.

share|improve this answer
But if the authentication passes the MitM - to what good is it? – Filip Haglund Aug 20 '11 at 16:39
1  
@Filip, these protocols assume that some kind of exchange has happened before the protocol is used. E.g., the browser has a list of CAs (certificate authorities) that it trusts before any HTTPS connection is ever established and can use those to establish a secure channel. As long as it is harder to impersonate a CA than it is to just sit on a pipe, the authentication and encryption parts of the protocol add value. – Mike Samuel Aug 20 '11 at 17:32
Forgot to add that part - This is ment to be without any key exchange before the MitM starts. Quantum crypto would work, though. However, it seems like it would be extremely easy to DoS just by sniffing it. However, it has somewhat a preshared key. – Filip Haglund Aug 20 '11 at 18:38
@Filip Haglund: It doesn't matter when the MiTM starts, it will be detected when the peers attempt authentication. – GregS Aug 20 '11 at 19:40
up vote 2 down vote

An elegant solution to this problem is Convergence. This was created by Moxie Marlenspike who has defeated SSL more times than I can count. This type of solution works even if a CA is compromised. I recommend watching SSL And The Future Of Authenticity

share|improve this answer
And how does this help if I'm behind a MitM, and can't be sure that my trust anchors are really those? – Paŭlo Ebermann Aug 20 '11 at 19:26
That was the reason to why I got to think about this problem. Even convergence seems a bit off since it would be possible to MitM that too, even though I like that idea a lot more than I like SSL. Please tell me if I'm wrong, as i would really like to be wrong with this. – Filip Haglund Aug 20 '11 at 19:27
@Paŭlo Ebermann Or if your host is behind a MITM and and all of the anchors see the same fake cert? But most importantly its far superior to having a CA. Sure there are problems, do you have a better solution? – Rook Aug 20 '11 at 19:28
@Filip Haglund and Paŭlo Ebermann Also one of the anchors can be DNSSec. It is more difficult to mitm DNSSSec and a CA. I think we can all agree its a vast improvement. – Rook Aug 20 '11 at 19:30
This is probably as far as we'll get. However, I would really like there to be a solution for this. Hopefully we'll get one later. – Filip Haglund Aug 22 '11 at 11:58
up vote 0 down vote

To be secure against MitM you have to trust:

  • your computer,
  • the party you're trying to communicate (and its computer),
  • and the CA the other party have chosen (if you're using PKI)
  • or have a secure means of transferring a secret you both know (either PSK or a password for SRP)

Nothing more, nothing less.

How it's implemented is another problem entirely. (Like the fact that your browser automatically trusts certificates issued by Pakistan, Russia, China or Terroristan-of-the-week; or can select broken ciphers, without any warning what-so-ever).

But if there's only one trusted CA or one pre-shared secret then the scheme is secure. Even if you use "free" WiFi in Terroristan embassy...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.