🚀 go-pugleaf

In article <1993Jan4.215027.17258@netcom.com> rcain@netcom.com (Robert Cain) writes:
>This all assumes that you have a secure means of getting your public key
>to the other or an authenticated one.  Both seem equivalent in the end
>to swapping a secret key to me.  This makes me question the fundamentals
>of PK actually.

PK doesn't allow absolute determination of identity.  There is no such thing.

What PK does (eg., via RSA) is put me in a private room which can not be
eavesdropped with some one person.  That one person is free to carry a wire
and to lie about his name, age, even gender.  That person is free to just
mouth words supplied by someone else.  That person is free to be a spoofer.
Of course, this dishonest person is free to do all these things in the
flesh.  He doesn't need PK to do any of this.

However, if that person is honest, then I'm having a private conversation.
Through that conversation, I can get to know this person.

What a shared secret can do (iff the person is honest) is establish a
relationship between two events -- in this case, the opening of a private
channel and the passing of a shared secret -- so that, if the person is
honest, I'm assured that I'm speaking to the same person I spoke to in the
earlier incident.

The same can be done with PK -- under one RSA key, I contact someone, build
a friendship and give him a secret to hold for future identification.

Under a new RSA key, I encounter someone who claims to be my old friend.
Within a private channel established to this possibly new person, I ask for
evidence of the shared secret -- and when I get it, I know that these
channels are probably to the same person.

		------------------------------

An anti-spoofing protocol may be impossible to invent.

It would have to tell the difference between:

Case I:

	Alice calls Bob, sets up a secure channel by exchanging public keys
	over the line.  Unknown to Alice, Eve is spoofing this.

	Alice <-> Eve <-> Bob

Case II:

	Alice calls Bob, sets up a secure channel.  Unknown to Alice, Bob
	has his assistant Carl handle all his channels to women with names
	A-M, so Bob reencrypts in Carl's key...

	Alice <-> Bob <-> Carl

The first is spoofing by an eavesdropper.  The second isn't.

The block diagrams are the same.

Can any protocol detect the difference, assuming that Alice and Bob have no
shared secret (no knowledge of each other beforehand)?

-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488