Updated April 15, 2023
Introduction to Mutual Authentication
Mutual authentication is a security mechanism used for user authentication, where both entities in communication link authenticate each other to proceed with secure communications. Mutual authentication is also known for two way authentication as both entities involved in communication authenticate each other. For example, If user X and User Y want to communicate using mutual authentication, User X authenticates User Y and User Y to authenticate User X and then start the communication.
In this article, we are going to discuss the concept of mutual authentication and its implementation in a detailed manner.
Implementation of Mutual Authentication
Mutual authentication can be implemented in various ways, namely Shared Secret, public keys, and timestamp-based.
1. Mutual Authentication using Shared Key
Suppose User X and User Y wants to authenticate using a shared key, the protocol works as follows:
- Assume that User X and User Y both have shared key KAB.
- User X sends his user name to user Y.
- After receiving the user name from X, user Y sends random challenge R1 to X.
- Once X received random challenge R1, he encrypts R1 using the shared key KAB.
- X sends an encrypted random challenge to Y.
- Again User X sends random challenge R2 to user Y.
- Once Y received random challenge R2, he encrypts R2 using shared key KAB.
- Y sends an encrypted random challenge to X.
Explanation: From the above-mentioned steps, we can conclude that both users X and Y authenticate each other. but as we can see that, as many messages are exchanged, this makes the protocol inefficient and increase the number of steps. We can reduce these steps by adding more information in steps.
The modification works as follows:
- User X sends the user name and random challenge R2 to user A.
- User Y encrypts the R2 using symmetric key KAB. Y generates its own random challenge R1 and sends both R1 and encrypted R2 to X.
- User X verify encrypted R2. and encrypt the R1 with symmetric key KAB and send it to Y. user Y verifies encrypted R1.
This version of protocol reduces the number of steps, but it suffers from a reflection attack, assume that attacker Z wants to acts as X to Y. First Attacker Z sends a message to Y which contains user id and random challenge R2. Then Y will encrypt it using shared symmetric key KAB, and generate new random challenge R1 and send these two to Z. User Y thinks that he is sending to user X. Y is unaware of the attacker Z.
Attacker Z cannot encrypt R1 with KAB, but he has the encrypted R2. Now attacker Z creates a new session with user Y. and sends the user id of X and random challenge R1. Y encrypt the R1 with KAB and generate New random challenge R3 and send it to Z.
An attacker can not proceed with the second session as he cannot encrypt R3. So he gets back to the first session he was created with Y earlier. Note that attacker Z could not encrypt R1 with KAB in the first session and was waiting. But now, the attacker has R1 encrypted because of the second session. and then it sends encrypted R1 to Y and completes the authentication.
To avoid a reflection attack, it is a surge that uses two different keys, i.e. KAB or KBA. KAB can be used when X want to encrypt something and send it to, KBA can be used when Y wants to encrypt something and send it to X so that attacker Z cannot. encrypt R1 with KAB.
2. Mutual Authentication using Public Keys
Mutual authentication can also be implemented using public keys. To proceed with this method, both user X and user Y must know each other’s public keys. The protocol works as follows:
- User X encrypts random challenge R2 using the public key of Y and sends it to User Y with his user name.
- User Y decrypts the random challenge R2 with his private key. User Y creates its own random challenge R1 and encrypt it using public key X and send both (encrypted R1 and decrypted R2) to X.
- User X decrypt random challenge R1 with his private key and send it to Y. User Y verifies R1.
The above-mentioned steps can vary.
- User X send his user name and random challenge R1 to Y
- User Y encrypt R2 using his private key and send it to X along with R1
- User X encrypts R1 using his private key and send it back to Y.
3. Mutual Authentication using the Timestamp
Mutual authentication steps can be reduced into two steps using time stamps. This protocol works as follows:
- User X sends his user name and current timestamp, which is encrypted with shared symmetric key KAB, to user Y.
- User Y decrypts the time stamp using KAB and obtain the original timestamp. Then Y add 1 to the timestamp and encrypt the additional timestamp with KBA, not KAB and send it to User X with his user name.
Recommended Article
This is a guide to Mutual Authentication. Here we discuss the top 3 Methods of Mutual Authentication like Shared Secret, Public Keys, and Timestamp Based etc. You can also go through our other suggested articles to learn more –
