0
$\begingroup$

There is a protocol that aims to transfer a password securely between the user and the server. The protocol is based on the Diffie-Hellman method. In the protocol, p is a prime number, g is a primitive root of p (forming {1,2,....p-1}). The main points of the protocol:

  1. The user chooses x and sends E(Kpw)[g^x(mod p)] where E is a symmetric encryption function and Kpw is a key derived from the user's password.
  2. The server chooses y and sends E(Kpw)[g^y(mod p)] where E is a symmetric encryption function and Kpw is a key derived from the user's password.
  3. The user and the server calculate the shared key K=g^(x*y)(mod p).
  4. The user and the server exchange several encrypted messages under the key K to perform challenge-response based authentication.

Does this way expose the user's password to an offline attack by an attacker listening to the communication?
How or why not?
*An offline attack on a password is different from a brute-force attack on an encryption key.

$\endgroup$
1
  • $\begingroup$ What are your thoughts? What progress have you made on this, and where did you get stuck? What's the context where you encountered this task? Should we be thinking about this from an exercise-like motivation, or in terms of a practical system? You might find this page helpful in improving your question. I also recommend reading about en.wikipedia.org/wiki/Password-authenticated_key_agreement. This is a subtle subject where the answer in practice depends on a number of details not listed in your post. $\endgroup$
    – D.W.
    Aug 2 at 18:37

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.