Man-in-the-middle Attack - Defenses Against The Attack

Defenses Against The Attack

Various defenses against MITM attacks use authentication techniques that are based on:

• Public key infrastructures
  • PKI mutual authentication The main defence in a PKI scenario is mutual authentication. In this case as well as the application validating the user (not much use if the application is rogue) - the users devices validates the application - hence distinguishing rogue applications from genuine applications
• Stronger mutual authentication, such as:
  • Secret keys (which are usually high information entropy secrets, and thus more secure), or
  • Passwords (which are usually low information entropy secrets, and thus less secure)
• Latency examination, such as with long cryptographic hash function calculations that lead into tens of seconds; if both parties take 20 seconds normally, and the calculation takes 60 seconds to reach each party, this can indicate a third party
• Second (secure) channel verification
• One-time pads are immune to MITM attacks, assuming the security and trust of the one-time pad.
• Carry-forward verification
• Testing is being carried out on deleting compromised certificates from issuing authorities on the actual computers and compromised certificates are being exported to sandbox area before removal for analysis

The integrity of public keys must generally be assured in some manner, but need not be secret. Passwords and shared secret keys have the additional secrecy requirement. Public keys can be verified by a certificate authority, whose public key is distributed through a secure channel (for example, with a web browser or OS installation). Public keys can also be verified by a web of trust that distributes public keys through a secure channel (for example by face-to-face meetings).

See key-agreement protocol for a classification of protocols that use various forms of keys and passwords to prevent man-in-the-middle attacks.