# Thought process on Network Protocol Attack

I'm preparing for an introductory information security examination in university and this is one of the tutorial question on Network Protocol attacks. I tried (a) and came to this conclusion:

Since the EPbX() is a public key encryption operation, C can decrypt any encrypted message to get back its original message, m as though it is anyone in the pair of people exchanging messages.

However, when I re-read the question, the decryption requires the use of private keys, which means it might be impossible to get the message unless C impersonates as the other to each of A and B, and is involved in the key exchange, generating 2 pairs of private keys, which seems repetitive. This confusion prevents me from doing the later part (b).

Can anyone suggest the thought process and solution to the above problem?

Here is the question description. Sorry the actual paper document is not formatted such that it allows copy over.  The protocol does not mention any random padding, which means that E(P,m) is a deterministic function. It means that, given the same public key P and message m, the result of E(P,m) is always identical.

If the attacker C can sniff E(PA, m) and E(PB, m), then they can try all possible values for m, and see which m results in the same encrypted message.

The viability of this depends on the entropy of m. If the contents of m can be reasonably guessed, then this is a viable attack. If m has high entropy (e.g. a randomly generated encryption key), then this attack is not viable. In that case, I wouldn't know how C would be able to recover the message, though I would love to know.

Question (b) is asking how this attack can be prevented. The simple answer is by including a random padding, which is distinguishable from the actual message.

So by modifying the encryption algorithm to be like E(P, m||pad), with pad being chosen randomly, the encryption function can't be exploited in the same way anymore. The attacker C doesn't know the padding, so even if C would happen to have the correct m and calculate E(PA,m), the result would not be identical, as C does not know the padding being used.