The purpose of this procedure is that Alice and Bob perform a verified Diffie-Hellman key exchange. It goes like this:
- Alice sends her supported signature schemes to Bob. It just says "supported schemes". I suppose signature schemes are meant.
- Bob selects a signature scheme.
- Alice chooses
a
and sendsA = g^a mod p
andSig_Alice(A)
to Bob. - Bob chooses
b
and sendsB = g^b mod p
andSig_Bob(B)
to Alice. - They calculate
K = g^(a*b)
as usual. - Alice sends the HMAC of all messages up to this point to Bob. I suppose this HMAC is sent over the encrypted channel because
K
has already been calculated. I have no idea whether only the messages Alice sent are meant or whether the ones she received are included, too. - Bob sends the HMAC of all messages up to this point to Alice. Again, probably over the encrypted channel.
I understand why Alice sends the HMAC of her messages to Bob: To make sure Bob actually received all the signature schemes she supports. It might be that there is a man-in-the-middle who removed all the secure signature schemes so Bob had to choose a non-secure one where the MitM can quickly fake their respective signatures so he can establish an encrypted channel between him and Alice and another one between him and Bob.
But what is the purpose of Bob sending the HMAC over his messages to Alice? What can Alice ever learn from that HMAC? If there is a MitM who faked a weak choice by Bob towards Alice, he has to already have been able to fully impersonate Bob in 4.
, so he knows K
and therefore sending the HMAC over the encrypted channel never poses any difficulty to the MitM.
Am I overlooking something? Do you know the answers to the questions I uttered in 6.
? Do 6.
and 7.
happen an parallel? It doesn't look like it in the graphic provided in the lecture where for 1.
, 3.
, and 6.
an arrow goes from Alice to Bob and for 2.
, 4.
, and 7.
, an arrow goes from Bob to Alice. I don't understand why 4.
and 3.
aren't swapped. Why would Bob wait for an answer from Alice?
H(g^(a*b))
whereH
is some hash or other key derivation scheme that is also part of the "scheme" used.