Attack the Toy

The Man in the Middle

Diffie-Hellman public values must be authenticated. This toy transcript shows Eve replacing both public values and getting two different half-secrets.

highlighted = computed this step

Why unauthenticated DH is attackable

Plain DH only proves arithmetic agreement with whoever supplied the public value. If Eve can replace public values, Alice and Bob do not share with each other.

authentication is missing\text{authentication is missing}
Man in the middleUnauthenticated DH attack values recomputed from Eve's injected exponent.Man in the middle - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Eve injects her public value

Eve chooses e=10 and sends E=9 in place of both public values.

E=510 mod 23=9E=5^{10}\bmod{}23=9
Man in the middleUnauthenticated DH attack values recomputed from Eve's injected exponent.Man in the middle - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Alice shares with Eve

Alice computes E to her a power and lands on 3. Eve computes the same value from A.

96 mod 23=39^{6}\bmod{}23=3
Man in the middleUnauthenticated DH attack values recomputed from Eve's injected exponent.Man in the middle - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Bob shares with Eve

Bob computes E to his b power and lands on 6. Eve also computes that half-secret from B.

915 mod 23=69^{15}\bmod{}23=6
Man in the middleUnauthenticated DH attack values recomputed from Eve's injected exponent.Man in the middle - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

The real shared secret never forms

Without Eve, Alice and Bob would have shared 2. In this transcript, Alice has 3 and Bob has 6 instead.

real shared=2but3≠6\text{real shared}=2\quad\text{but}\quad3\ne6
Man in the middleUnauthenticated DH attack values recomputed from Eve's injected exponent.Man in the middle - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2

Summary

Unauthenticated DH lets Eve form two different shared values: 3 with Alice and 6 with Bob. NOTE: toy-modulus; no-side-channel; no-production; never-roll-your-own. Exact arithmetic on a deliberately tiny toy modulus; real DH uses 2048+ bit groups inside authenticated reviewed protocols.

MitM succeeds without authentication\text{MitM succeeds without authentication}
Man in the middleUnauthenticated DH attack values recomputed from Eve's injected exponent.Man in the middle - E=9quantityvaluee (Eve secret)10E=g^e mod p9Eve-Alice secret3Alice computes E^a3Eve-Bob secret6Bob computes E^b6real A-B shared never forms2