Question

1.a) To make Diffie-Hellman more robust, one uses cookies. Can you do some research and find out more about the use of cookies in the Diffie-Hellman algorithm?

b) When a person uses an automatic teller machine (ATM) to get cash, is this message authentication, an entity authentication, or both?

Answer 1

1.a) The use of cookies in the Diffie-Hellman algorithm:

The cookie exchange in IPsec is a key management protocol. It requires each side to send a pseudorandom number, which is the cookie, in the very first message, and the other side acknowledging the same. This acknowledgment is repeated in the first message of the Diffie–Hellman key exchange. Hence, if the source address was forged, the receiver does not get an answer. Thus, the receiver can only force a user to generate acknowledgments but without letting it perform the Diffie–Hellman calculation.

The cookie is created using the method performing a fast hash such as MD5 over the IP source and destination addresses, the UDP source and destination ports, and a locally generated secret value.

b) When a person uses an automatic teller machine (ATM) to get cash, it follows both, the message authentication and the entity authentication. It uses SMS center entity to prevent some attacks and biometric to increase the security for fingerprint authenticated ATM applications. Hence, it uses two-level authentication processes in ATM:
* First step authentication based on PKI and
* Second step authentication based on biometrics such as fingerprint or iris scan and matching.

In a banking system, the ATM machine and the user are considered as ATM USER entity. This entity is responsible for entering a PIN and sending the ID to the BCC entity, which is another entity through which all the communication between ATMs and Banks go through. Also, the SERVER entity controls key distribution among other entities. The level of confidentiality, integrity, and authentication is increased using session keys, a key distribution server issues among entities. A user authenticates his/her identity using the ATM authentication system and his/her authentication information and procedures known to him/her to interact with the ATM, such as the user's ATM card and PIN number. Users even get message authentication codes, such as MFA (Multi-Factor Authentication) codes, and OTP (One Time Passcode).