Who Are You Talking To?

Throughline

Confidentiality protects a channel only after the endpoints know whose keys they are using.

1. The man in the middle

• Start with raw Diffie–Hellman from Part 2.
• Let Mallory run one valid exchange with Alice and another with Bob, then relay every message.
• Emphasize that both exchanges are cryptographically correct; authentication is the missing property.
• End with the question: how does Alice know a verification key belongs to Bob?

Reference: Boneh–Shoup ch. 21

2. Signatures

• Contrast MACs and signatures:

• Define existential unforgeability under chosen-message attack.
• Show the multiplicative forgery against textbook RSA:

$$\sigma_0\sigma_1 =m_0^dm_1^d =(m_0m_1)^d\pmod N$$

• Introduce full-domain hash / proper encoding and RSA-PSS; avoid implying that bare “sign $H(m)$” is sufficient for every hash and encoding.
• Note that signatures provide public verifiability, not legal non-repudiation by themselves.

Reference: Katz–Lindell §13.1–13.4

3. Authenticating the handshake

• Sign the ephemeral Diffie–Hellman transcript, not just an isolated public value.
• Bind identities, roles, protocol version, and both ephemeral keys into the transcript.
• Explain how this stops key substitution.
• Surface the remaining bootstrap problem: who authenticated the long-term verification key?
• Connect to secure messaging: identity keys and prekeys complete the setup omitted from Part 2.

4. Public key infrastructure

• Build the certificate chain:
  • root CA in the trust store
  • online intermediate CA
  • leaf certificate for the service
• Explain why roots remain offline and intermediates limit blast radius.
• Cover hostname validation, validity periods, name constraints, revocation, CRLs, and OCSP.
• Ground the section by inspecting a real browser certificate chain.
• State the trust tradeoff: any trusted CA capable of issuing for a name can become the weak link.

Reference: Katz–Lindell §13.6; RFC 5280

5. Authenticating people

• Walk password storage as attack and countermeasure:
  1. plaintext
  2. unsalted fast hash
  3. unique salt
  4. optional server-side pepper
  5. slow, memory-hard KDF such as Argon2id or scrypt
• Separate online rate-limited guessing from offline database cracking.
• Introduce TOTP:

$$\text{code}=F_{\text{seed}}(\lfloor t/30\rfloor)$$

• Explain why TOTP stops a stolen password but not a real-time phishing proxy.
• End with origin-bound hardware credentials / passkeys.

Reference: RFC 6238; RFC 9106

6. Case studies

• SSH + GitHub: key generation, public-key upload, passphrase protection, host-key fingerprints, and trust on first use.
• TLS: one-sided server authentication followed by user authentication inside the protected channel.
• SSO: signed tokens, delegated trust, audience restrictions, expiry, and identity-provider compromise.

Assumptions introduced

• RSA/factoring or discrete-log assumptions, depending on signature scheme.
• Collision resistance and secure signature encoding.
• Operational trust in certificate authorities and identity providers.

Go deeper

• Katz–Lindell ch. 13
• Boneh–Shoup ch. 13 and ch. 18
• RFC 8446 — TLS 1.3
• Scribed applied cryptography notes, §4.1–4.2 and §8–9