Question

Consider the following scheme to provide message authentication. B gets a message supposedly from A, and B wants to make sure that the message was sent by A and not modified by BG along the way. A generates a secret key K for DES, calculates C = E_K (M), and sends M, C, K to B. B checks it M = D_K (C) and if it is, accepts that M was sent by A. Is this is a good scheme? i. Give a YES/NO answer. ii. If you said NO explain what you think is the single biggest weakness of the scheme.

Answer 1

Since the answer is No, so the biggest weakness of this scheme is:

1)The biggest obstacle in deploying a public-key algorithm is the necessity for a proper exchange of private keys. This transaction must be completed in a secure manner. In the past, this would often have to be done through some type of face-to-face meeting, which proves quite impractical in many circumstances when taking distance and time into account. If one assumes that security is a risk to begin with due to the desire for a secret exchange of data in the first place, the exchange of keys becomes further complicated.

2)Another problem concerns the compromise of a private key. In symmetric-key cryptography, every participant has an identical private key. As the number of participants in a transaction increases, both the risk of compromise and the consequences of such a compromise increase dramatically. Each additional user adds another potential point of weakness that an attacker could take advantage of.