Does public key cryptography alone prevent a “man-in-the-middle” attack? Explain your answer, using a diagram.
Try an answer before revealing the guidance below.
Key Concepts
- Man-in-the-middle
- Public key distribution
- Key substitution
- Certificate authority
- Binding identity to key
Answer Approach
- Draw Alice, Trudy, and Bob, with Trudy between them.
- Ask how Alice obtains Bob’s public key.
- Show what Trudy can do if she substitutes her own key.
- Identify what is needed to bind a public key to an identity.
Full Answer
Answer status: Verified against study notes. Revision notes, not an official marking scheme.
No. Public key cryptography assumes Alice has Bob’s genuine public key. In a man-in-the-middle attack Trudy intercepts the key exchange: when Alice asks for Bob’s key, Trudy returns her own public key, and does the same to Bob. Diagram: Alice ⇄ Trudy ⇄ Bob — Alice encrypts to Trudy’s key, Trudy decrypts, reads or modifies the message, re-encrypts with Bob’s real key, and forwards it; neither side notices. Preventing this requires authenticating the public key, e.g. a certificate from a trusted certification authority that binds Bob’s identity to his public key.
Shortcuts: K concepts · A approach · F answer · R reviewed · B bookmark · ← / → previous / next