126 reputation
3
bio website
location
age
visits member for 1 year, 2 months
seen Feb 9 at 16:33

Jan
30
awarded  Commentator
Jan
29
comment Mutual authentication for humans
Some good points, thank you. I think the person answering the call would typically issue the challenge anyway ("hey, you called me, so you prove who you are first"), but it's a good idea to make this part of the protocol.
Jan
29
comment Mutual authentication for humans
But how would the trusted third party be authenticated, ie. when you get a message saying "yes, authentication succeeded" how do you know it really came from them? Also, I don't understand what you mean by "use the password as a public key".
Jan
29
comment Mutual authentication for humans
OK, got it, thanks. I think that would work in software, but with a human "implementation" under less-than-ideal conditions I wouldn't want to rely on it. Even I probably wouldn't be so paranoid as to "fail" authentication because of a dropped phone call or other practical issues.
Jan
29
comment Mutual authentication for humans
That would be a nice bonus, but not essential.
Jan
29
comment Mutual authentication for humans
It would be detected next time unless I'm misunderstanding something, but by that stage the attacker has already succeeded at least once. Separate lists for the two people sounds like it could work around that. Do you see any issues with that approach?
Jan
29
comment Mutual authentication for humans
Maybe the solution is as simple as having separate challenge response lists for the two of them, so that Bob would never respond to a challenge intended for Alice?
Jan
29
comment Mutual authentication for humans
Interesting, thanks, but could you elaborate on how to prevent replay attacks? Eg. this scenario: Mallory calls Alice Alice: Challenge 1 Mallory: sorry, bad reception, let me call you back Mallory calls Bob Mallory: Challenge 1 Bob: Response 1 Mallory calls Alice back Mallory: Response 1 Alice: Oh good, it's you, Bob! In this scenario Bob had no way of knowing Challenge 1 had already been used and Alice only used it once, successfully, as far as she can tell.
Jan
29
awarded  Student
Jan
29
asked Mutual authentication for humans
Jan
28
awarded  Supporter