80.2K

Verified Solution

Link Copied!

(7) (2 pts) The simplified version of the handshaking procedure between a client and a bank server for establishing a secure connection is described below (just consider it identical to the SSL/TLS described in class): 1. A client connects to the TLS-enabled bank server requesting a secure connection, and presents a list of supported ciphers (RC4, DES, AES, etc) and hash functions (MD5, SHA-1, etc). 2. The server picks the strongest cipher and hash. It then server sends back its public key (Pb) in the form of a digital certificate. 3. The client generates a random number (RN) (nonce), encrypted it with the bank server's public key (Pb), and sends it back to the server. 4. The bank server decrypts the received message (by using its private key (PxK)) and recovers RN. Both the client and the server now share a common secret: RN. From which, they will derive a symmetric key for encrypting real data messages. The server concludes the handshaking by sending back an "Finish", encrypted with the derived symmetric key. Once the SSL connection is established, the bank server will ask the client to send in user name and password for client authentication. Suppose Trudy has set up a fake bank server and tries to lure clients to login to her fake server so that she can steal a client's user name and password. The fake bank server tries to follow the procedures given above. Note that anyone can get the certificate of the real server as it is distributed daily to all of its clients. Can Trudy's attack be successful? Explains

Answer & Explanation Solved by verified expert

See Answer