0

This week in class we were taught about authentication and key exchange protocols. From what I understood, I could broadly classify them into two different types:
1. Using trusted third party: Where the two parties depend on another third party to authenticate them (e.g. Needham Schroeder protocol, Kerberos etc)
2. Using shared/established keys to encrypt messages and then authenticate: This kind of protocols communicate via an encypted channel using a shared/established key.

Is it possible to securely authenticate via any other way or am I right in assuming that these are the only two classifications possible?

I feel that any other type of protocol would either be vulnerable to Man in the middle or Replay attacks.

EDIT: By encryption I mean keeping the nonce and other challenge responses secret

Improve this question
2
  • "encryption" is often used where "cryptography" is meant. Could you indicate if you do indeed mean encryption as in: protecting the confidentiality of messages, nonces or keys?
    – Maarten Bodewes
    Commented Sep 17, 2016 at 15:04
  • Hi Marteen, I mean using either an encrypted channel to send messages till you establish a shares key (encryption using public private keys or encryption using a key shared with trusted third party)
    – Limit
    Commented Sep 17, 2016 at 15:20

2 Answers 2

Reset to default
1

TLS may use pre-shared keys (PSK ciphersuites). Although keys are pre-shared, they are not used for encryption, only for authentication. Same goes for Secure Remote Password (SRP ciphersuites) which does not even using a block or stream cipher. The messages within TLS 1.2 will be authenticated using HMAC which uses a hash instead of a cipher.

So yes, authentication is certainly possible without third party or encryption.

Improve this answer
3
  • Hi Marteen, doesn't TLS fall under the second category, where we have pre shared keys and then we talk over an encrypted channel?
    – Limit
    Commented Sep 17, 2016 at 15:31
  • No, not with regard to authentication. Session keys are of course used for confidentiality of the data after authentication.
    – Maarten Bodewes
    Commented Sep 17, 2016 at 15:40
  • Thanks Marteeen! I will read about TLS and Secure Remote Password
    – Limit
    Commented Sep 17, 2016 at 17:24
1

"Is it possible to have a secure authentication protocol which
doesn't involve trusted third party and encryption of data?"

Yes.

  1. ​ "Using shared/established" signature key-pairs to skip the "to encrypt messages" part,
    where the verifier chooses an unpredictable nonce and the
    other party signs the ordered pair ​ ​ ​ nonce , actual_message ​ .

(Note: ​ Some sources inaccurately describe RSA signatures as "encryption".)

Improve this answer
1
  • I think you should add more than just a link to your comment, i.e. describe what you've linked too, why it does not involve encryption in your opinion and how it can be used for authentication. And describe also why it cannot be classified as any of the two types mentioned in the question.
    – Steffen Ullrich
    Commented Sep 17, 2016 at 7:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .