Question

30) The man or woman in the middle attack is a hole in authentication where

a With no CA, it's difficult to detect

b With no CA, the intruder Trudy can get the private key of Alice

c With no CA, the intruder Trudy can be found when she sends her public key to Bob

d With no CA, the intruder Trudy can get the private key of Bob

Answer 1

In cryptography CA is an acronym for Certificate Authority or Certifying Authority.

It is an authority that certifies that the public key belongs to a particular party. It allows the receiver check if the key actually belongs to the sender that he's/she's claiming to be (and it is not an impersonation) by verifying the certificate assigned to the sender (by the CA). If the certificate is valid, then, it is guaranteed that the public key belongs to the sender and he/she is not an impostor. The receiver can therefore proceed by encrypting the message using the public key provided and sending it to the intended party.

Option (a) is correct because:

Without any CA, it would be difficult to detect if any one is impersonating some other person in the network or not since there won't be any proof of ownership which is provided through digital certificate issued by the certificate authority. It is important to note that this option is different from option (c) in the sense that this option is about detection of the man-in the-middle attack whereas option (c) advocates identification of the attacker, the two are different scenarios. The detection becomes difficult because there is no particular standard method of detection of the man in the middle attacks and various techniques like the tamper detection & latency analysis may come in handy according to the scenario in which the attack occurs.

Option (b) and (d) are incorrect because:

Intruder can never get the private key of the sender or the receiver in any case because "private key" is a term used in asymmetric key cryptography and private key (as the name suggests) is never shared and is kept private.

Option (c) is incorrect because:

In absence of certification authority, there is no way possible for the receiver/Bob to actually know that whether it is Alice or it is Trudy who is sending her public key. This is because the proof of ownership lies only with the certificate issued by the CA.