Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Imagine I have a computer where all the trafic is being sent through the MitM. How would it be possible to have a secure connection through this setup?

In this case it would be OK to design a new protocol just for this. I just want to know if there is a way to do this. If there is a new protocol we need to make it unbruteforceable for the next 10 years.

EDIT: Assume you didn't exchange any keys before you got MitM'd. Absolutely every communication from/to you to/from the server is being MitM'd.


migration rejected from Apr 8 '15 at 1:22

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as unclear what you're asking by RoraΖ, Eric G, Xander, schroeder, Mark Apr 8 '15 at 1:22

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

Lets see if I understand this correctly. You want to know if it possible to establish trust between yourself and a remote party when there is no previous contact and no way to establish a communications channel that can provide confidentiality or integrity between you and the remote party? – this.josh Aug 21 '11 at 7:17
The way you formulate this it's obviously impossible. You cannot protect against a man in the middle attack without out-of-band communication. – Nick Johnson Aug 22 '11 at 3:15
I guess both of you are correct. – Filip Haglund Aug 22 '11 at 12:01
up vote 11 down vote accepted

The way that SSL and TLS work is that there is some way to provide authentication for at least one side.

Normally the server has a private key where the client has the fitting public key (or, more usually, some root public key of a certificate chain which certifies the public key of the server). Alternatively, also some password-based authentication methods are possible (client has password, server has some salt + salted hash).

Then we can do a key exchange (over your MitM channel), and the MitM can't do anything (other than a DoS) against our protected connection.

If you say "there can't be any earlier exchange of a (even public) key", then there is no way to do this, as the MiTM can act as the server against the client, and as the client against the server. (SSL/TLS still provides protection against a "only-reading" attacker by anonymous Diffie-Hellman key exchange, but this does not help for an active attacker which can intercept and change all packets.)


Good protocol designs expect a MitM. Exactly how you protect yourself depends on the protocol, but it often involve verifying the server's identity (assuming you're a client). In https, this means checking and trusting the server's certificate; in ssh, it means verifying the server's key fingerprint; in OpenVPN it means trusting the server's cert.

Every secure protocol has a way to authenticate the other end of the session, which prevents a MitM.

But if the authentication passes the MitM - to what good is it? – Filip Haglund Aug 20 '11 at 16:39
@Filip, these protocols assume that some kind of exchange has happened before the protocol is used. E.g., the browser has a list of CAs (certificate authorities) that it trusts before any HTTPS connection is ever established and can use those to establish a secure channel. As long as it is harder to impersonate a CA than it is to just sit on a pipe, the authentication and encryption parts of the protocol add value. – Mike Samuel Aug 20 '11 at 17:32
Forgot to add that part - This is ment to be without any key exchange before the MitM starts. Quantum crypto would work, though. However, it seems like it would be extremely easy to DoS just by sniffing it. However, it has somewhat a preshared key. – Filip Haglund Aug 20 '11 at 18:38
@Filip Haglund: It doesn't matter when the MiTM starts, it will be detected when the peers attempt authentication. – James K Polk Aug 20 '11 at 19:40

An elegant solution to this problem is Convergence. This was created by Moxie Marlenspike who has defeated SSL more times than I can count. This type of solution works even if a CA is compromised. I recommend watching SSL And The Future Of Authenticity

And how does this help if I'm behind a MitM, and can't be sure that my trust anchors are really those? – Paŭlo Ebermann Aug 20 '11 at 19:26
That was the reason to why I got to think about this problem. Even convergence seems a bit off since it would be possible to MitM that too, even though I like that idea a lot more than I like SSL. Please tell me if I'm wrong, as i would really like to be wrong with this. – Filip Haglund Aug 20 '11 at 19:27
@Paŭlo Ebermann Or if your host is behind a MITM and and all of the anchors see the same fake cert? But most importantly its far superior to having a CA. Sure there are problems, do you have a better solution? – rook Aug 20 '11 at 19:28
@Filip Haglund and Paŭlo Ebermann Also one of the anchors can be DNSSec. It is more difficult to mitm DNSSSec and a CA. I think we can all agree its a vast improvement. – rook Aug 20 '11 at 19:30
This is probably as far as we'll get. However, I would really like there to be a solution for this. Hopefully we'll get one later. – Filip Haglund Aug 22 '11 at 11:58

To be secure against MitM you have to trust:

  • your computer,
  • the party you're trying to communicate (and its computer),
  • and the CA the other party have chosen (if you're using PKI)
  • or have a secure means of transferring a secret you both know (either PSK or a password for SRP)

Nothing more, nothing less.

How it's implemented is another problem entirely. (Like the fact that your browser automatically trusts certificates issued by Pakistan, Russia, China or Terroristan-of-the-week; or can select broken ciphers, without any warning what-so-ever).

But if there's only one trusted CA or one pre-shared secret then the scheme is secure. Even if you use "free" WiFi in Terroristan embassy...


Assuming that you are still able to contact the the other party, the solution to this problem is in a book called Applied Cryptography. Set up a simple Caesar Cipher in which a...z = 10...36 Basically, you and the other party set up a system (which is really quite easy) in which every 3rd group of 2 digits represents a real letter, and the rest is just random numbers. You can then feel free to send the resulting numbers right through your MiTM, because I can guarantee that to him they will look random. Obviously your Caesar Cipher can vary, as can the xth group, to make things thougher to figure out. Your MiTM might decide that all of the noise on the network looks suspicious, but there is a 90% chance he won't be able to figure out what it is because there are no algorithms that I know of currently written to detect this sort of method of communication. Best of all, the program to encrypt/decrypt plaintext easy to write by any programmer's standards. Numbers and special characters can be handled by looking at the corresponding ordinal and adding it into your Caesar Cipher. This solution is weak for only one reason: if your attacker knows what you are doing he will not have too much trouble brute forcing it. Other options include a customized Baconian cipher, with certain letters/digits = 1 and others = 0. This would be much harder to crack.

EDIT: This would only work if you could still contact the other party securely (ie over the phone) and they were willing to go along with what you were trying to do. It would be impossible to make this work with a random server.

Eaching a caesar Cipher is just as complicated as exchanging a key. – Christian Dec 15 '13 at 15:43
@Christian No, you only need tell the other party the first number (ie a is 128). The rest can be extrapolated from the ordinals of the letters, numbers, and special characters. – KnightOfNi Dec 16 '13 at 0:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.