Here is my security protocol for the use of a service provided by server. It utilises a symmetric key:

  • Client requests to use a service
  • Server sends back nonce
  • Client sends back nonce encrypted with Alice’s key
  • Once server verifies key and checks nonce server authorises use of service

Does the use of the nonce prevent the reuse of old authorisations?

What type of symmetric encryption algorithm is best to use in this case?

Are there any serious security flaws?

  • 4
    There's not nearly enough information here to do any kind of security analysis. – forest Dec 13 '18 at 2:52

Just from the simple description you give, two security flaws stand out. There may be further flaws in an actual implementation.

  • The server needs to know Alice's key. This means the server, or anyone who compromises the server, can impersonate Alice.
  • There's no server authentication. It may be possible for someone to impersonate a server and get Alice to send sensitive information.
  • The way the question reads makes me think this is a PSK system though... – forest Dec 13 '18 at 3:12
  • @forest, even if the key was provided by the server, the server-impersonation issue is still present. A hostile server doesn't need to verify the key, it can just say "you're authorized" in response to every request. – Mark Dec 13 '18 at 3:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.