0

Is there another way to verify someones public key without a CA signing it? A challenge-response authentication including some sort of UID of the smartphone?

  1. Smartphone A generates asymmetric key pair
  2. A sends public key K1 via internet to Smartphone B
  3. B recieves a public key K2

How can B be sure that K2 = K1 ?

2

Without a CA, you need some type of other secure secret exchange. It could be a side channel exchange of the thumbprint or use of some pre-existing shared secret. Web of trust can also be used, though this is basically another form of side channel.

Using the UID as you suggest however, is likely insecure. The UID of a phone isn't a secret and an attacker could obtain the UID and then impersonate the device.

Now, if you don't actually care about the identity of the phone, it could just submit an anonymous public key and you will know that it is the same phone in the future, but you will know nothing about the identity of that phone. You don't need to involve the UID (and shouldn't) for that though.

|improve this answer|||||
  • How would you establish the side channel exchange and the exchange of the preshared key? Probably with PKI.. +1 for Web of Trust though. – Michael May 12 '14 at 14:19
  • @Michael - it depends on the situation. Possibly via a phone call, possibly via a notary public, possibly via sending a courier and/or driving to the other person yourself, possibly a facebook login, possibly something else entirely. It really depends on the level of security needed. PKI makes life easier, but it isn't a necessity, especially for small situations. – AJ Henderson May 12 '14 at 14:23
  • Indeed, in those examples there is actually always a trusted third person (unless you deliver it yourself). But you are right, it does not have to be a CA. – Michael May 12 '14 at 14:29
  • Phone call isn't a trusted third party if you know their voice. Similarly, depending on what you are trying to authenticate, something like a facebook login wouldn't be a trusted third party, so long as all you want to know is that they have control of that account. – AJ Henderson May 12 '14 at 14:44
  • +1 because you made a clear point about side channel exchange – David Dec 29 '16 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.