Which type of authentication is not prone to man-in-the-middle attacks?

Question

I am preparing for the CISA exam and come across material saying "challenge response-based authentication is prone to session hijacking or man-in-the-middle attacks". But the material doesn't mention which kind of authentication is strong against MiTM attacks.

According to my understanding, the above statement is not very meaningful because all types of authentication are prone to MiTM.

To prevent MiTM, we can apply more than single factors for authentication. For instance, beside a login from the browser, the user might also need to press the confirm button on the mobile app within a minute in order to complete authentication. However, there is a single authentication method not prone to MiTM. Am I correct?

Answer 1

Authentications based on key exchange methods are immune to MitM attacks by design. They do require some kind of certificate infrastructure, however. (note that the key exchange itself does not provide authentication)

Authentications based on shared secrets, public-key cryptography or certificates can also be designed to be immune to MitM attacks. Such authentications can include challenge-response mechanisms.

Two- (or multi-) factor authentication is not immune to MitM attacks, however Eve needs to be able to simultaneously intercept all the channels used, which dramatically increases the difficulty for her.

The basic idea of doing authentication that is safe from MitM is to do in sequence:

1. establish a secure (i.e. MitM-protected) channel
2. establish the identity of the other party
3. exchange authentication information

This is how your online banking is set up. DH key exchange + suitable encryption for step 1. Certificates based on a trusted root CA for step 2, standard web-form authentication for step 3.

Note that TAN lists (shared secrets), pseudo-random TAN generators (shared secrets) or SMS TANs (2FA) are often used additionally, but typically after the actual authentication.