Five versions of one protocol, each defeated by a specific attack. The last adds the one thing none of the others could prove — that Alice is at the other end right now.
Words you will meet
-
End-point authentication — proving to another party, over a network, that you are who you claim.
-
ap1.0 … ap4.0 — the book’s numbered attempts, in the style of chapter 3’s rdt protocols.
-
IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 spoofing — putting somebody else’s source address into a datagram you built yourself.
-
Playback attack playback attack Simple Recording somebody's login and replaying it later. Precise An attack in which Trudy eavesdrops on an authentication exchange, records the messages, and replays them later to impersonate Alice. It is what defeats protocols ap3.0 and ap3.1, and what the nonce in ap4.0 exists to prevent. introduced in ch. 8 — open in glossary — recording a valid exchange and replaying it later.
-
Nonce nonce Simple A number used exactly once, to prove a reply is fresh rather than a recording. Precise A number that a protocol will use only once in a lifetime. Bob sends a nonce R to Alice, who returns it encrypted with their shared key, which proves the response was created after the nonce was chosen and so is not a playback. introduced in ch. 8 — open in glossary — a number a protocol uses only once in a lifetime.
-
Live — actually present at the other end now, rather than recorded earlier.
Why this matters
This section is built exactly like chapter 3’s rdt protocols: propose the simplest thing, find the attack that breaks it, fix that attack, repeat.
Read it that way and the final protocol is not something to memorise. It is the only thing left standing after four specific failures, and you can reconstruct it from the failures alone.
The distinction the whole ladder turns on appears only at the end. Proving who somebody is and proving they are there are different problems, and four versions in a row solve the first while leaving the second untouched.
The shape of the problem
Authentication happens before the real work. Two parties run an authentication protocol first and establish each other’s identities to their satisfaction. Only then do they start the reliable transfer, the routing exchange, or the e-mail session they actually came for.
Alice needs to authenticate herself to Bob. That is the whole setting.
The simplest protocol imaginable, and the flaw is obvious.
Click any arrow to see what that message says and why it is sent.
Switch versions in order. Each run shows the protocol working, then the attack that defeats it. Only the last one has no second half.
Read this diagram as text
- Alice sends "I am Alice" to Bob. Alice sends a message saying she is Alice. That is the entire protocol.
- Trudy sends "I am Alice" to Bob — undefined. Trudy sends exactly the same message. There is no way for Bob to know which of them is the real Alice — nothing in the message distinguishes them.
Lifelines, left to right: Alice (host), Trudy (middlebox), Bob (server).
Step through the five versions in the widget above before reading on. Each one runs, then shows the attack.
ap1.0 — say who you are
Alice sends “I am Alice”.
The flaw is immediate: Trudy can send exactly the same message. Nothing in it distinguishes them.
ap2.0 — check where it came from
If Alice always communicates from a well-known address, Bob can check that the source address on the datagram matches it.
This stops a very network-naive intruder. It does not stop anyone who has read chapter 4. Building a datagram with any source address you like is not hard. The book notes you need only the ability to build your own operating system kernel, as with Linux. The first-hop router will then forward it dutifully.
The fix that exists and cannot be relied on
IP spoofing can be prevented, if every first-hop router is configured to forward only datagrams carrying its own network’s source addresses. That is RFC (Request For Comments) Request For Comments The name of an IETF standards document. There are currently nearly 9000 of them. introduced in ch. 1 2827.
But this capability is not universally deployed or enforced. And as the book puts it, Bob would be foolish to assume that Trudy’s network manager has configured her router to forward only appropriately addressed datagrams. That network manager might be Trudy herself.
A defence that depends on the attacker’s own equipment being configured against them is not a defence.
ap3.0 — send a secret password
The classic approach, and the one in daily use: Gmail, Facebook, telnet, FTP (File Transfer Protocol) File Transfer Protocol An application-layer protocol for transferring files between two hosts. introduced in ch. 1 . The password is a secret shared between the authenticator and the person being authenticated.
Because passwords are so widely used, you might suspect ap3.0 is fairly secure. It is not. If Trudy eavesdrops, she learns the password.
This is not hypothetical. When you telnet to a machine and log in, the login password is sent unencrypted to the server. Anyone connected to the client’s or the server’s LAN (Local Area Network) Local Area Network A network covering one building, campus or home. introduced in ch. 1 can sniff every packet and store it — a well-known approach for stealing passwords.
ap3.1 — encrypt the password
The natural next idea. Alice and Bob share a symmetric secret key, so Alice encrypts the password before sending it.
And Bob has good reason to be satisfied: whoever sent that message knew both the password and the shared key.
It fixes the wrong problem
Encryption does stop Trudy learning the password. It does not solve the authentication problem.
Trudy eavesdrops, records the encrypted password, and later plays it back to Bob. She never decrypts anything. She never needs to.
The book’s verdict is worth quoting exactly: the use of an encrypted password “doesn’t make the situation manifestly different” from ap3.0.
Why every version so far fails the same way
Here is the observation the whole section is built toward.
Bob cannot distinguish the original authentication of Alice from a later playback of that authentication. He cannot tell whether Alice is live — currently, really, on the other end of the connection — or whether he is hearing a recording.
Everything ap3.1 proves is about the past.
In plain words
A password proves that whoever produced this message once knew a secret.
It does not prove that they are the one talking to you now, because a message is just bytes, and bytes can be copied.
Everyday picture — a recorded voice
Someone telephones and says a phrase only your bank manager knows. That proves the phrase came from the bank manager at some point.
It does not prove the bank manager is on the line. A recording says the same words in the same voice.
Where the picture breaks. A human might hear a recording as flat or clipped. A computer receiving bytes has no such instinct — a replayed message is bit-for-bit identical to the original, so there is nothing at all to notice.
ap4.0 — a nonce
A nonce nonce Simple A number used exactly once, to prove a reply is fresh rather than a recording. Precise A number that a protocol will use only once in a lifetime. Bob sends a nonce R to Alice, who returns it encrypted with their shared key, which proves the response was created after the nonce was chosen and so is not a playback. introduced in ch. 8 — open in glossary is a number that a protocol will use only once in a lifetime. Once used, it is never used again.
- Alice sends “I am Alice” to Bob.
- Bob chooses a nonce R and sends it to Alice.
- Alice encrypts R with the shared key and sends
K_A−B(R)back. - Bob decrypts it. If the result equals the R he sent, Alice is authenticated.
The two properties now come from two different places. Knowing the key proves who Alice is. Encrypting this nonce proves she is live, because Bob invented R moments ago and no recording of any earlier exchange could contain it.
You have seen this before, in chapter 3
The book points at TCP (Transmission Control Protocol) Transmission Control Protocol The Internet transport protocol that delivers data reliably and in order, with flow control and congestion control. introduced in ch. 1 ‘s three-way handshake. The server did not want to accept a connection if the SYN (synchronize) synchronize The TCP flag bit that marks a connection-establishment segment. Set in the first two segments of the three-way handshake (§3.5.6). introduced in ch. 3 it received was an old copy from an earlier connection. That is exactly the same problem, in a setting with no attacker at all.
Its answer was the same shape. Choose an initial sequence number that has not been used in a very long time. Send it, and require the other side to echo it back in an acknowledgement.
A nonce is that idea with an adversary added.
| ap1.0say who you are | ap2.0source address | ap3.0password | ap3.1encrypted password | ap4.0nonce | |
|---|---|---|---|---|---|
| What defeats it | |||||
| What Trudy needs | |||||
| Proves who Alice is? | |||||
| Proves Alice is live? |
Cells marked ⓘ have a reason behind them — click to read it.
Read the bottom two rows together. Every version before ap4.0 proves at most identity; none proves that the sender is there right now. Click any cell.
Figure 8.18’s caption is wrong in the printed book
The figure is captioned “Protocol ap4.0 and a failure scenario”, but it has no failure scenario. It is a single panel showing the successful exchange, and the prose immediately before it says ap4.0 works.
Figures 8.15, 8.16 and 8.17 each genuinely carry two panels, the second showing Trudy winning. Figure 8.18 kept their caption. Verified against the page image.
Where the ladder stops
This edition ends at ap4.0, which uses a nonce and symmetric key cryptography.
The obvious follow-up question — can a nonce plus public key cryptography do the same job? — the book raises and then deliberately does not answer here. It is set as an end-of-chapter problem, so the exercises page is where it belongs.
The mental model
Authentication over a network has to answer two questions, and they are not the same question.
Who are you? is answered by knowing a secret — a password, or a key. Are you there? cannot be answered by any secret at all, because a secret, once sent, becomes a recording.
The nonce answers the second one by making the challenge unrepeatable. Bob picks a number that has never existed before, and only something happening now can respond to it.
Check yourself
Check yourself
0 of 7 answered1.What defeats ap2.0, where Bob checks the source address on the datagram?
2.RFC 2827 can prevent IP spoofing. Why does the book not treat that as a solution?
3.ap3.1 encrypts the password. What does that fix, and what does it leave broken?
4.predictTrudy replays a recorded K(password) to Bob. What does Bob observe that differs from a genuine login?
5.In ap4.0, why must Bob be the one who chooses the nonce?
6.The book says ap4.0's idea already appeared in chapter 3. Where?
7.Where does the ladder stop in this edition, and what is left open?
What to remember
-
Proving identity and proving liveness are different problems. Four versions in a row solve the first and leave the second untouched, which is why a recording defeats all of them.
-
Encrypting the password fixes eavesdropping, not authentication. Trudy replays the encrypted value without ever decrypting it, and Bob cannot tell the replay from the original.
-
The nonce works because Bob chooses it and has never used it before. A response encrypting this number could not have been recorded earlier — the same trick as TCP’s initial sequence number, with an adversary added.