38C3: Blinkencity, radio controlling street lamps and power plants [video]

Post by [deleted] » Mon, Dec 30, 2024, 5:48 PM UTC

baobun wrote: post #45

H8crilA wrote: post #22

Earlier quoted context omitted.

Authentication, not necessarily encryption. It's a common misconception to think that you need the latter while you actually need the former. And no, encryption does not mean authentication, not at all, usually you can meaningfully modify the ciphertext if a given protocol has no authentication. Also, here's a fun thought experiment: consider two channels, one authentic but not encrypted, another non authentic but en…

You are confusing authentication (even less relevant in context than encryption actually) with authorization. Doing proper authorization without cryptography is difficult. Mixing it up with authentication is unnecessary but popular. The authn/authz distinction is more impactful than encryption/cryptography nitting. Signatures are just encryption with a public key, yknow?

Post by [deleted] » Mon, Dec 30, 2024, 5:50 PM UTC

tialaramex wrote: post #47

H8crilA wrote: post #43

Earlier quoted context omitted.

I'm sorry, are you trolling? You pretend to be Bob to Alice, and Alice to Bob, at the same time. Real Alice and Bob never compute the same transcript digests, but it doesn't matter. As post handshake data is flowing you decrypt it and reencrypt, modifying what you want. Or, imagine that there isn't even one legitimate Bob in the world. But Alice is still talking to someone who follows the protocol, and is indistingui…

I'm not trolling, I just don't think you've really thought about what "authentic" could mean if you don't have identity, which is a distinct problem. For Alice there's no difference between a Bob whose identity you don't know and an Eric whose identity you don't know, they're each just another anonymous party. Eric can't fool Alice and Bob into believing they're talking to each other, because they're using separate c…