Man in Middle attack - Can such an attack occur if symmetric keys are used?

Question

If we consider Man In the Middle Attack; Can such an attack occur if symmetric keys are used?

Hippocampus

Answer 1

Sure. All you need to do is intercept the key exchange. Then you can pass on your own (fake) key to the other end. You intercept the messages using the key you obtained fraudulently and re-encrypt with your fake key and pass on to the other end.

Downtrodden

Answer 2

The trick is to agree on the symmetric key in the first place. Man-in-the-middle attacks usually occur during the key exchange phase (making you agree on the key with the middle-man instead of your real partner).

So what usually happens (in web browsers' SSL sessions) is that you use asymmetric cryptography to exchange the symmetric key. However, that depends on your partner's public key really belonging to who you think it does. Usually, you take Verisign's or (some other CA's) word for that.

At some point, a secure and authenticated key exchange has to have taken place.

Trefor

Answer 3

Since the MIM attack can happen during the key exhange, you could do what SSL/TLS does.

SSL/TLS uses RSA in the key exchange, so that the exchange of the symmetric key is [heavily] protected with RSA.

Baloney

But that of course depends on the validity or the RSA keys, in particular that your partner's public key really belongs to who you think it does. At some point you have to trust in a prior key exchange. – Trefor

Answer 4

Above answers correct of course, but you should note that there are several efficient, cryptographically secure methods for securely exchanging keys. I think the one wow uses is SRP6.

Trimester

Diff-Hellman allows you to securely create a shared key over an untrusted network, but you still do not know who you are talking too... – Trefor

@Thilo: To me the question implies the parties know each other or at least have an agreement to securely exchange information. Your answer indicates prior agreement on a key between the two parties communicating. That is unnecessary. – Trimester

@JP: How do you know that you are doing SRP6 with the wow server, instead of the man-in-the-middle? – Trefor

@Thilo: I get your point now. Makes sense, if you don't know who the part at the other end is, securely exchanging information with them does not matter. Well taken. – Trimester

Answer 5

Yup. Even if you use symmetric key you have to use authentication/integrity checks. Using symmetric key encryption without authentication/integrity checks makes you susceptible to various forms of replay attacks or substitution attacks. An attacker can modify your ciphertexts and may even know what the effect of his changes are.

Klemperer