0

I have the following homework question that im not sure about.

Alice and bob are going to use the diffie-hellman key agreement protocol to agree on a key for use in AES. Explain briefly why they would need to use digital signatures and why they cannot use Message Authentication Codes (MACs) instead.

I find the question a bit hard to understand, im aware that MACs require a shared secret key to compute the MAC so this would have to be done first but am not sure why digital signatures need to be used ?

dmnte
  • 51
  • 5
  • DH key exchange establishes a shared secret with a remote party who has demonstrated control of a claimed public key. So say that Alice does DH key exchange with "Bob"; then she has a shared secret with a remote party that has control of a public key. But, how does Alice know that that remote party's Bob? – Nat Jun 14 '17 at 06:17

2 Answers2

2

The homework task is making an implicit assumption:

They don't have a common shared secret.

That's implicated by the fact that they do a DH key exchange and nothing else to exchange the key. A common shared secret would offer muc more possibilities, e.g. combine a DH key exchange with the shared secret as input to a KDF.

You realized yourself that a shared secret is required for MAC. So what protects the DH key exchange from man-in-the-middle attacks? Because (not-authenticated) DH key exchange is vulnerable to that.

tylo
  • 12,654
  • 24
  • 39
  • thanks for your answer I don't completely understand but I thought what saved DH from mitm was that it wasn't sending its private key by itself over the line making it to hard for mitm to find it out. But they do end up with a common secret which could be used for MAC. With digital signature public key could be used, but im still finding it hard to see why MAC cant be used – dmnte Jun 14 '17 at 12:39
  • @dmnte Do you mean a MAC where Alice already has a shared secret to verify that a message is signed by Bob? 'cause, if so, that would work. The thing that, if you already have a shared secret, you don't need either MAC or certificates; Alice could simply already know Bob's public key and recognize it as Bob's without any further verification. – Nat Jun 14 '17 at 13:30
  • @dmnte In very basic terms: If Bob and Alice have any prior secret, they can check authenticity based on that shared secret. If they don't, they can't use MAC to verify the authenticity of the message - and that Eve didn't tamper with the message. Digital signatures solve this problem by assuming the verification keys are public and everyone knows them. DH key exchange is "saved" by any form of authentication. Without it, MitM always works. And DH never sends the private key (the exponent) in the plain - that is the very definition of it. – tylo Jun 14 '17 at 13:49
0

Without digital signatures a MitM Eve could replace all messages between Alice and Bob. There is a way to do that in which Eve learns the shared secret. Maybe you want to figure the details out yourself?

Simon F
  • 91
  • 6