Question

(7) (2 pts) The simplified version of the handshaking procedure between a client and a bank server for establishing a secure connection is described below (just consider it identical to the SSL/TLS described in class): 1. A client connects to the TLS-enabled bank server requesting a secure connection, and presents a list of supported ciphers (RC4, DES, AES, etc) and hash functions (MD5, SHA-1, etc). 2. The server picks the strongest cipher and hash. It then server sends back its public key (Pb) in the form of a digital certificate. 3. The client generates a random number (RN) (nonce), encrypted it with the bank server's public key (Pb), and sends it back to the server. 4. The bank server decrypts the received message (by using its private key (PxK)) and recovers RN. Both the client and the server now share a common secret: RN. From which, they will derive a symmetric key for encrypting real data messages. The server concludes the handshaking by sending back an "Finish", encrypted with the derived symmetric key. Once the SSL connection is established, the bank server will ask the client to send in user name and password for client authentication. Suppose Trudy has set up a fake bank server and tries to lure clients to login to her fake server so that she can steal a client's user name and password. The fake bank server tries to follow the procedures given above. Note that anyone can get the certificate of the real server as it is distributed daily to all of its clients. Can Trudy's attack be successful? Explains.

Answer 1

Yes, Trudy's attack will be successful.

As it is stated in the question that all the members get the certificates of the real servers on the daily basis. The person can easily set up a fake bank and can send it to the customers to login while that have to do any transaction.Although Encryption system is used at the starting but when they connect with each other the other person need to share its Username and Password which means that it will be easily available to him after it establishes SSL connection.