2

Assume that two devices are communicating via some sort of method that can be publicly viewed, and replicated. Attackers have the ability to replicate information sent between the two, and attackers can listen to the transfers. Assume that both devices can't tell if they're receiving communication from the other device, or from an attacker.

What cryptographic techniques can allow the information to not be read by the attackers (encryption), but also allow old packets of information to be validated that they came from a legitimate device? Also, how could two packets which are identical be made to not appear identical to attackers?

I'm developed a solution which I think accomplishes all of these goals, but there must have been solutions already created for this purpose. It takes the payload data, concatenates the equivalent of a two-factory authentication code which changes every few seconds, and concatenates a random number on, so identical payloads will look different. Then, the whole payload is encrypted using some sort of symmetric encryption. Both devices already have a shared secret key file.

I feel like there has to be some other sort of solution out here, but I don't know what it's called or what to research. I don't want to "roll my own crypto," and I want to find an existing, verified solution. Can anyone give me some topics to investigate?

  • What about sending {PacketNo|Encrypt{PacketNo|Payload}} ? – peterh Apr 7 '17 at 21:23
  • 1
    Re: "What cryptographic techniques can allow the information to not be read by the attackers (encryption), but also allow old packets of information to be validated that they came from a legitimate device?", look into confidentiality and authentication as concepts. – Xiong Chiamiov Apr 7 '17 at 22:48
  • 1
    what about ssh (for existing solution). – ctrl-alt-delor Apr 11 '17 at 21:38
  • @richard Yes! This is what I was thinking of. It uses the message authentication codes talks about, and it's a prepackaged solution. Thanks! – Cin316 Apr 12 '17 at 20:09
5

For hiding the data, you use encryption. For making sure it came from a known source, i.e. authentication use a message authentication code (MAC), or authenticated encryption. Note that confidentiality (making sure only the intended recipient can read the message) and authenticity (making sure the message came from a known source) are different!

For detecting and discarding resent packets, you usually add some sort of a counter or timestamp on the packets, and discard anything older than the previous ones. Most modern encryption schemes also take a random initialization vector that makes identical messages look different.

  • The techniques you described are what I'm looking for, @richard suggested uses SSH, which is a prepackaged solution that already implements these techniques. Thanks! – Cin316 Apr 12 '17 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.