How to authenticate using RSA avoiding MITM attacks

Question

During my lessons of information security the professor told as that Alice can authenticate to Bob in the following way using RSA:

1. Bob generates and sends a Nonce to Alice
2. Alice signs this Nonce with her private key and sends it back to Bob
3. Bob decrypts the packet with Alice's public key and he verifies that the same Nonce that he send is the one that he received

However, with this method a MITM attack is still possible. Eve (the attacker) can simply forward the Nonce to Alice and then forward the signed Nonce to Bob. From the Bob perspective Eve is authenticated as Alice.

Bob ----Nonce---> Eve ---Nonce---> Alice
Bob <--S(Nonce)-- Eve <--S(Nonce)- Alice

There is a way to guarantee that the signed Nonce actually arrive from the correct sender?

Answer 1

In this protocol, Alice "has* authenticated herself to Bob. Bob knows that the signature was made by Alice. Eve has merely forwarded the communication. Eve had not carried out any attack: she had not violated any security property that Alice or Bob expects.

I suspect that your difficulty comes from the fact that this is a very simplistic protocol that isn't very useful. The only information that Bob learns is Alice has been alive at some point after Bob sent the nonce. No useful communication has taken place.

To make this protocol useful, let Alice send some data in addition to the nonce: Alice send S(nonce + M) where M is some message. Then Bob knows that Alice sent the message M in response to Bob's message containing the nonce. The signature guarantees that M comes from Alice, not Eve. The nonce guarantees that M is a recent message, not some old message that Eve had stored.

Note that it's important that Mand the nonce are signed together. If Bob received S(nonce) + S(M), he would have no way to know that M isn't some old message that Alice sent earlier in a different context. If Bob and Alive want to have a conversation with multiple messages, each message needs to be signed and the signed data needs to contain an unambiguous reference to the previous data in the conversation (typically this is fine by hashing the previous message). Otherwise Eve could rearrange pieces of the conversation or mix messages from different conversations.

Answer 2

No, because that’s how the Internet works. There is no direct connection between Alice and Bob; all of their communication is forwarded by multiple third parties. According to you, every ISP between Alice and Bob is conducting a MITM attack. You do what SSL/TLS does and have Bob generate a symmetric encryption key, encrypt it with Alice’s public key, and send it to Alice who can decrypt it with her private key. The attacker can't decrypt it, because she doesn’t have the private key. Alice and Bob then use that key to encrypt all of their communication. Any eavesdropper can't decrypt the traffic, because they don’t have the key.