0

This excellent question introduces "TOFU" (trust on first use - e.g. SSH storing fingerprints) and "TBFU" (trust before first use, e.g. PKI Certs, WPA pre-shared-keys).

Can MitM attack be avoided without using a 3rd party?

Obviously, TOFU is useless in the face of an already-established MitM adversary (since you end up trusting the attacker by mistake), and "TBFU" requires some kind of pre-establishment which was itself free from MitM to begin with.

Is there a means by which two strangers can upgrade a public, MitM-infected communications channel into a secured one?

For the sake of argument: assume the strangers are two HTTPS web sites (Alice and Bob), both of which have self-signed certificates only, and that the MitM attacker (Mallory) sits between the internet and one (just one) of these servers. e.g. Mallory can pretend to Bob to be Alice, and can pretend to Alice to be Bob.

The only way I can think of right now, involves real-time third parties (which is OK, but fails if the attacker is also able to MitM those as well, such as if Mallory is doing MitM twice [i.e. sits between Alice and the internet, as well as between Bob and the internet]).

Improve this question
2
  • The problem itself is described thus: Alice connects to Bob, gives Bob her public key, and asks Bob for his public key key. The MitM attacker, Mallory, pretends to be Bob, so Alice gets Mallory's key (thinking it's Bobs) and Bob gets Mallory's key too (thinking it's Alice's). Mallory sits in the middle, decrypting and reading/changing traffic at will, before re-encrypting it (to the real public key of the intended recipient) and sending it on its way.
    – cnd
    Commented Dec 13, 2021 at 7:08
  • I was hoping for some kind of mathematical solution, perhaps based on verifiable delays ( eprint.iacr.org/2018/623.pdf ) - where some aspect of the key that Alice gets from Bob contains some indication of the processing power available to Bob, which Mallory is unable to counterfeit in real time without detection ... (especially if she's got to counterfeit both sides at once)
    – cnd
    Commented Dec 13, 2021 at 7:18

1 Answer 1

Reset to default
2

An MITM free channel can only be guaranteed if one can check that the other side is the expected one. This of course means that there must be a solid expectation in the first place. The two parties being complete strangers means that there is no existing expectation about the other one yet.

One can tackle the problem by relying on one or several third parties which somehow helps to find out what to expect. Of course, one need to a) trust these parties and b) be sure that the information really come from the parties. If these trusted third parties are remote one need to ensure MITM free communication to these parties too, which of course requires again some pre-existing expectation about these parties.

There are several ways to solve this dilemma. One is to use public key infrastructures where the initial expectation and trust relationships are stored in each end device. Expectations about some stranger are derived from this by each party applying for a certificate at the trusted third party (the certificate authority: "CA"), the CA checking each party before issuing the certificate and then the CA signing the certificate. Each party then can check if the certificate was actually issued by the CA and thus check if the expectation was manipulated or not.

A concept similar to a PKI is the web of trust, which does not rely on a single or a few highly trusted CA, but instead on many peers with limited trust. The idea is that one can gain sufficient trust by asking several peers, even if each one of these is less trusted.

Completely without pre-existing trust relationships is TOFU, i.e. trust on first use. This approach can be hardened by relying not only on a single initial connection to the peer, but on many connections which use different ways to reach the peer. The hope here is that not all of these connections are affected by the MITM, i.e. the result is only seen as valid if they all agreee.

Each of these approaches has its own problems and none is fully secure. But the same can be said about trust relationships in the non-digital world.

Improve this answer
6
  • WoT sounds handy. TOFU, PKI, "requires some pre-existing expectation" all fail of course (since the MitM can interfere with them all). "sufficient trust by asking several peers" will also fail if the MitM is between you and the internet (since it can interfere with all responses). "many connections" is just the TOFU problem again. "hope" is nice, but not very scientific:-)
    – cnd
    Commented Dec 13, 2021 at 7:16
  • 1
    @cnd: WoT requires pre-existing trust relationships too. In general: neither in the digital nor in the non-digital world trust relationships just magically occur. When starting from scratch (i.e. no trust relationships to anything) all what one has is the hope that most relationships (persons, network infrastructure ...) can actually be trusted.
    – Steffen Ullrich
    Commented Dec 13, 2021 at 7:23
  • @Steffen_Ullrich: My half-baked solution at present is to ask a number of strangers to tell me about my peers (like the lying-robot riddle) in order to ascertain if any of them "do not look to them like they look to me" [e.g. peer IP addresses differ] - except this probably still fails when the MitM can interfere with their answers, as well as imitate any number of peers itself too. I'd love to avoid any proof-of-work based solution, but I'm thinking there might not actually be any other way.
    – cnd
    Commented Dec 15, 2021 at 8:38
  • @cnd: Why should a stranger be inclined to do a proof or work? What does they gain from it? If they gain something, wouldn't the MITM be able to gain the same thing too? I cannot see how this solves the problem of starting with no kind of trust relationships.
    – Steffen Ullrich
    Commented Dec 15, 2021 at 9:10
  • 1
    A proof-of-work solution might function like so (using phone calls for an example): you phone a random co-operator, and ask them to take the number that shows up on their caller ID (supposedly your own - but will be wrong (the MitM) under attack) and hash that into their "pool" and tell you the answer. Their "pool" is the "linux time from 10 seconds ago" added to their own phone number, and hashed a billion times (specifically: continuously on all their CPU cores for 10 seconds). The MitM (who has no advanced notice of what number you're about to call) cannot answer that question fast enough
    – cnd
    Commented Dec 15, 2021 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .