12 — Protocol
STS — Station-to-Station Protocol
Diffie-Hellman with signatures — the MITM killer. Mutual authentication + key confirmation in 3 messages.
How STS actually works — diagram
How STS actually works: unsigned DH value, signed+encrypted reply binding both values, signed+encrypted confirmation. Three messages, both sides verified.
Assumptions (say these first in the exam)
Each side already holds the other's authentic signature-verification key (pubA, pubB via certificates/PKI). Signature scheme unforgeable. Ephemerals a, b fresh per run and erased after.Algorithm — 3 messages with math
A → B : A = g^a. Plain ephemeral DH public, no auth yet.
A = g^a mod p
B → A : B = g^b, E_K(Sig_B(B ‖ A)). Bob derives
K, signs both values (order matters — responder signs B first), encrypts the signature under K.
B = g^b mod p
K = A^b = g^(ab) mod p # e.g. p=23,g=5: A=8,B=19 → K=2 both sides (p.10)
sB = Sig_privB(B ‖ A) # binds responder value first
B → A : B , E_K(sB)
A → B : E_K(Sig_A(A ‖ B)). Alice derives the same
K, verifies sB with pubB, then signs in mirror order.
K = B^a = g^(ab) mod p
check Verify_pubB(sB, B ‖ A) ?= ✓ # fails → abort
sA = Sig_privA(A ‖ B)
A → B : E_K(sA) → Bob checks Verify_pubA(sA, A ‖ B) ?= ✓
Why each piece exists
- Signatures over (own ‖ peer) prove who sent which value and block substitution — Mallory's
Marrives unsigned/forged → verification fails. - Encryption under K gives key confirmation: only someone holding
Kcould have produced the ciphertext. - Different signing orders stop reflection/replay of message ② as message ③.
Why MITM dies here (1-line kill)
# Mallory substitutes M=g^m, gets K1 with Alice, K2 with Bob — as on p.11.
# But message ② demands E_K1(Sig_B(...)) and Mallory has no privB:
forge Sig_privB(B ‖ M) → impossible (unforgeable sig)
forward old sB under wrong K → decryption/verification fails
Property table
| Property | Provided By |
|---|---|
| Mutual authentication | Signatures verified against pre-authenticated pubA/pubB |
| Key confirmation | Sigs transported encrypted under the fresh K |
| Forward secrecy | Ephemeral a,b erased; later sig-key leak won't recover past K |
| MITM resistance | Substituted values break signature verification |
| Replay/reflection resistance | Fresh ephemerals + asymmetric signing order (B‖A vs A‖B) |
Limits (examiners love these)
No identity hiding — A, B and certificates travel in clear in basic STS (SIGMA/IKEv2 fix this with extra encryption). Needs PKI: with unauthenticated keys, STS collapses back to MITM-able DH. Timestamps aren't used — freshness comes from random ephemerals.Exam one-liner: STS = DH + mutual signatures over (own‖peer) carried encrypted under the fresh K — 3 messages, mutual auth, key confirmation, forward secrecy.