Skip to content

Commit

Permalink
Fixed typos
Browse files Browse the repository at this point in the history
  • Loading branch information
BjoernMHaase committed Sep 19, 2024
1 parent d6876c3 commit 01e220d
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions draft-irtf-cfrg-cpace.md
Original file line number Diff line number Diff line change
Expand Up @@ -684,9 +684,9 @@ for applications that do not have a session identifier input available.
If unique strings identifying the protocol partners are included either as part of the channel identifier CI, the session id sid or the associated data fields ADa, ADb, the ISK will provide implicit authentication also regarding the party identities.

Incorporating party identifier strings is important for fending off relay attacks.
Such attacks become relevant in a setting where several parties, say, A, B and C, share the same password PRS.
An adversary might relay messages from a honest user A, who aims at interacting with user B, to a party C instead.
If no party identifier strings are used and B and C share the same PRS value then A might be using CPace for
Such attacks become relevant in a setting where several parties, say, A, B and C, share the same password PRS.
An adversary might relay messages from a honest user A, who aims at interacting with user B, to a party C instead.
If no party identifier strings are used and B and C share the same PRS value then A might be using CPace for
establishing a common ISK key with C while assuming to interact with party B.
Including and checking party identifiers can fend off such relay attacks.

Expand Down

0 comments on commit 01e220d

Please sign in to comment.