The authors show how to get two neural networks. A and B, jointly to converge to the same weight states, which can be used as a secret key, before an attacker E can compute the same weight states. Alas, they authors write:
> Why does this work at all? What is the difference between the partner B and the attacker E, who both have the same information? The reason is that B can influence the network A whereas E can only listen.
In other words, the scheme works only as long as there's no MITM ("man in the middle") attack.
I ~think "influence" is packing more punch than you give it credit. B is interacting with A. How can E maliciously enter into this conversation other than as a DoS attacker (as E's interaction with A either replaces or interferes with B-A interaction)? In fact, there may be a path for auto-discovery of MITM attack precisely because of this perturbation by E.
If E gets in the middle, it can pretend to be B with A, and pretend to be A with B, to converge on a different security key with each one. Doing so would allow E to stay in the middle of the conversation without either side noticing.
I think that would require E being in the middle in all phases of interaction between A and B, from connection initiation. That seems sufficient to set up two distinct synchronization regimes (A|B') and (A'|B) with E playing the fake roles. (It's a fascinating topic this auto-synchronizing chaotic system & I really need to read up on it: https://aip.scitation.org/doi/10.1063/1.4917383)
> I think that would require E being in the middle in all phases of interaction between A and B, from connection initiation.
Yes, that's right :-) Keep in mind, though, that in practice it may be possible to force re-initiation -- e.g., by feigning timeout, by feigning loss/corruption on the received data, etc.
Is there a scheme using these principles that isn't known to be insecure? Or one that has a proof of security by reduction to a known (or supposed) hard problem?
A brief look online makes it sound like all provided schemes have extremely adhoc arguments of security or are known to be broken.
8 comments
[ 5.0 ms ] story [ 42.3 ms ] thread> Why does this work at all? What is the difference between the partner B and the attacker E, who both have the same information? The reason is that B can influence the network A whereas E can only listen.
In other words, the scheme works only as long as there's no MITM ("man in the middle") attack.
Yes, that's right :-) Keep in mind, though, that in practice it may be possible to force re-initiation -- e.g., by feigning timeout, by feigning loss/corruption on the received data, etc.
A brief look online makes it sound like all provided schemes have extremely adhoc arguments of security or are known to be broken.
Unfortunately, a reasonable source I found is paywalled: https://link.springer.com/chapter/10.1007/978-981-16-6332-1_...
https://news.ycombinator.com/item?id=1743037