0

This week in class we were taught about authentication and key exchange protocols. From what I understood, I could broadly classify them into two different types:
1. Using trusted third party: Where the two parties depend on another third party to authenticate them (e.g. Needham Schroeder protocol, Kerberos etc)
2. Using shared/established keys to encrypt messages and then authenticate: This kind of protocols communicate via an encypted channel using a shared/established key.

Is it possible to securely authenticate via any other way or am I right in assuming that these are the only two classifications possible?

I feel that any other type of protocol would either be vulnerable to Man in the middle or Replay attacks.

EDIT: By encryption I mean keeping the nonce and other challenge responses secret

Limit
  • 3,236
  • 1
  • 16
  • 35
  • "encryption" is often used where "cryptography" is meant. Could you indicate if you do indeed mean encryption as in: protecting the confidentiality of messages, nonces or keys? – Maarten Bodewes Sep 17 '16 at 15:04
  • Hi Marteen, I mean using either an encrypted channel to send messages till you establish a shares key (encryption using public private keys or encryption using a key shared with trusted third party) – Limit Sep 17 '16 at 15:20

2 Answers2

1

"Is it possible to have a secure authentication protocol which
doesn't involve trusted third party and encryption of data?"

Yes.

  1. ​ "Using shared/established" signature key-pairs to skip the "to encrypt messages" part,
    where the verifier chooses an unpredictable nonce and the
    other party signs the ordered pair ​ ​ ​ nonce , actual_message ​ .

(Note: ​ Some sources inaccurately describe RSA signatures as "encryption".)

Community
  • 1
  • I think you should add more than just a link to your comment, i.e. describe what you've linked too, why it does not involve encryption in your opinion and how it can be used for authentication. And describe also why it cannot be classified as any of the two types mentioned in the question. – Steffen Ullrich Sep 17 '16 at 07:01
1

TLS may use pre-shared keys (PSK ciphersuites). Although keys are pre-shared, they are not used for encryption, only for authentication. Same goes for Secure Remote Password (SRP ciphersuites) which does not even using a block or stream cipher. The messages within TLS 1.2 will be authenticated using HMAC which uses a hash instead of a cipher.

So yes, authentication is certainly possible without third party or encryption.

Maarten Bodewes
  • 4,602
  • 15
  • 29
  • Hi Marteen, doesn't TLS fall under the second category, where we have pre shared keys and then we talk over an encrypted channel? – Limit Sep 17 '16 at 15:31
  • No, not with regard to authentication. Session keys are of course used for confidentiality of the data *after* authentication. – Maarten Bodewes Sep 17 '16 at 15:40
  • Thanks Marteeen! I will read about TLS and Secure Remote Password – Limit Sep 17 '16 at 17:24