Solved

cant understand this cryptographic scenario

Posted on 2006-10-30
5
208 Views
Last Modified: 2010-04-11
Assume that two parties already have access to a shared secret andthat they have each other’s public key. Why is it still good practice toregularly re-negotiate new session keys for continued negotiation under such circumstances? What are the several potential attacks and conditions that are mitigated by this approach.
0
Comment
Question by:shairan
5 Comments
 
LVL 32

Accepted Solution

by:
rsivanandan earned 43 total points
ID: 17835333
Any cryptographic algorithm is a sequence of mathematical relationships which is known to everybody. So theoritically speaking you can still break them, only time matter. Now if a long conversation uses a same key, there is a chance that the intruder might be *lucky* to break 'em while the data's importance is still valid.

On the other hand if the actual keys are not used but they are used only to *create* session keys which renegotiates at a fixed interval, then cracking this becomes difficult.

For example, if I speak for 4 hours using 1 key, all I need to crack is the full traffic and find out this one key.

If I speak for 4 hours using 4 keys renegotiated at 1 hour interval, then it becomes full traffic and find out 4 keys.

Hope this helps.

Cheers,
Rajesh
0
 
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 41 total points
ID: 17836957
That pretty much sums it up. There is also the possibility for man-in-the-middle attack and key replay, it defiantly helps with key replay, but not so much with MTM.
  http://en.wikipedia.org/wiki/Anti-replay http://en.wikipedia.org/wiki/Replay_attack (man in the middle isn't always a key replay)
http://en.wikipedia.org/wiki/Anti-replay
-rich
0
 
LVL 3

Assisted Solution

by:mahe2000
mahe2000 earned 41 total points
ID: 17842941
because you use your session key (shared secret is just for authentication) to encrypt traffic. if it is compromissed in some way your encryption is useless. having the same key for a long time let people sniffing you have a lot of packets encrypted with the same key which gives him a lot of information to statistically try to get the key. if you change the key in short periods of time, he has to start again and again...
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
There's a lot of hype surrounding blockchain technology. Here's how it works and some of the novel ways it' s now being used - including for data protection.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question