SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Reflection attack</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Reflection attack</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div role="note" class="hatnote navigation-not-searchable">This article is about the attack on authentication systems. For the denial of service attack, see <a href="Distributed_Reflection_Denial_of_Service" class="mw-redirect" title="Distributed Reflection Denial of Service">Distributed Reflection Denial of Service</a>.</div>

<p>In <a href="Computer_security" title="Computer security">computer security</a>, a <b>reflection attack</b> is a method of attacking a <a href="Challenge%E2%80%93response_authentication" title="Challenge–response authentication">challenge–response authentication</a> system that uses the same <a href="Protocol_(computing)" class="mw-redirect" title="Protocol (computing)">protocol</a> in both directions. That is, the same challenge–response protocol is used by each side to <a href="Authentication" title="Authentication">authenticate</a> the other side. The essential idea of the attack is to trick the target into providing the answer to its own challenge.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Attack">Attack</h2></div>

<p>The general attack outline is as follows:

</p>

<ol><li>The attacker initiates a connection to a target.</li>

<li>The target attempts to authenticate the attacker by sending it a challenge.</li>

<li>The attacker opens another connection to the target, and sends the target this challenge as its own.</li>

<li>The target responds to the challenge.</li>

<li>The attacker sends that response back to the target on the original connection.</li></ol>

<p>If the authentication protocol is not carefully designed, the target will accept that response as valid, thereby leaving the attacker with one fully authenticated channel connection (the other one is simply abandoned).

</p>

<div class="mw-heading mw-heading2"><h2 id="Solution">Solution</h2></div>

<p>Some of the most common solutions to this attack are described below:

</p>

<ul><li>The responder sends its identifier within the response so, if it receives a response that has its identifier in it, it can reject it.<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup></li></ul>

<ol><li>Alice initiates a connection to Bob.</li>

<li>Bob challenges Alice by sending a <a href="Cryptographic_nonce" title="Cryptographic nonce">nonce</a> <i>N</i>. <span class="nowrap">B → A: <i>N</i></span></li>

<li>Alice responds by sending back the MAC calculated on her identifier and the nonce using the shared key <i>K</i><sub>ab</sub>. <span class="nowrap">A → B: MAC<sub><i>K</i><sub>ab</sub></sub>{A, <i>N</i>}</span></li>

<li>Bob checks the message and verifies the MAC, making sure it is from Alice and not a message he had sent in the past by making sure that it verifies with A and not B, and on the nonce which is the same as the one he sent in his challenge, then he accepts the message.</li></ol>

<ul><li>Require the initiating party to first respond to challenges before the target party responds to its challenges.</li>

<li>Require the key or protocol to be different between the two directions.</li></ul>

<ul><li><a href="Replay_attack" title="Replay attack">Replay attack</a></li>

<li><a href="Man-in-the-middle_attack" title="Man-in-the-middle attack">Man-in-the-middle attack</a></li>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

<li id="cite_note-1"><span class="mw-cite-backlink"><b><a href="#cite_ref-1">^</a></b></span> <span class="reference-text"><i>Computer Networks</i> by <a href="Andrew_S._Tanenbaum" title="Andrew S. Tanenbaum">Andrew S. Tanenbaum</a>, 4th edition, <style data-mw-deduplicate="TemplateStyles:r1238218222">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>0-13-038488-7</bdi>, pages 787-790.</span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><a href="Ross_J._Anderson" title="Ross J. Anderson">Ross J. Anderson</a>: <cite><a rel="nofollow" class="external text" href="http://www.cl.cam.ac.uk/~rja14/book.html">Security Engineering: A Guide to Building Dependable Distributed Systems</a></cite>, 1st edition, page 21, <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>0-471-38922-6</bdi></span>

</li>

</ol></div></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2024-09-08" href="https://en.wikipedia.org/wiki/?title=Reflection_attack&oldid=1244640986">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>