BlackBerry Enterprise Solution
81
Impersonating a BlackBerry Enterprise Server
An impersonation of the BlackBerry Enterprise Server occurs when the attacker sends messages to the
BlackBerry device so that the BlackBerry device believes it is communicating with the BlackBerry Enterprise
Server. The attacker must send
s
to the BlackBerry device, which requires effectively solving the discrete log
problem to determine
s
or the hash of
s
.
Process flow: Using the BlackBerry Router protocol to open an authenticated connection
1.
The BlackBerry device and the BlackBerry Enterprise Server both hash the current BlackBerry device master
encryption key using SHA-512.
2.
The BlackBerry device picks a random value
r
D,
where 1 <
r
D
<
p
– 1 and calculates
R
D
=
r
D
P
.
3.
The BlackBerry device sends
R
D
and
KeyID
, a master encryption key identifier, to the BlackBerry Enterprise
Server.
4.
The BlackBerry Router observes the data that the BlackBerry device sends and confirms that the value
R
D
is
not the point at infinity. If
R
D
is the point at infinity, the BlackBerry Router sets
R
D
to a random value.
5.
The BlackBerry Router forwards
R
D
and
KeyID
to the BlackBerry Enterprise Server.
6.
The BlackBerry Enterprise Server calculates that as
R
D
approaches the point at infinity,
R
D
is random.
7.
The BlackBerry Enterprise Server picks a random value
r
B
, where 1 <
r
B
<
p
– 1 and calculates
R
B
=
r
B
P
.
If
R
D
equals
R
B
, the BlackBerry Enterprise Server calculates another value of
R
B
.
8.
The BlackBerry Enterprise Server picks a random value
e
D
, where 1 <
e
D
<
p
– 1.
9.
The BlackBerry Enterprise Server sends
R
B
,
e
D
, and
KeyID
to the BlackBerry device.
10.
The BlackBerry Router observes the data that the BlackBerry Enterprise Server sends and confirms the
following calculations:
•
checks that when the value
R
B
approaches the point at infinity or
R
D
equals
R
B
, the value
R
B
is random
•
checks that when the value
e
D
equals 0, the value
e
D
is random
11.
The BlackBerry Router forwards
R
B
,
e
D
, and
KeyID
to the BlackBerry device.
12.
The BlackBerry device performs the following calculations:
•
checks that when the value
R
B
approaches the point at infinity or
R
D
equals
R
B
, the value
R
B
is random
•
checks that when the value
e
D
equals 0, the value
e
D
is random
•
computes
y
D
=
h
–
e
D
r
D
mod
p
13.
The BlackBerry device picks a random value
e
B
, where 1 <
e
B
<
p
– 1.
14.
The BlackBerry device sends
y
D
and
e
B
to the BlackBerry Enterprise Server.
15.
The BlackBerry Router observes the data that the BlackBerry device sends and confirms that if e
B
equals 0 or
e
B
equals
e
D
, the value
e
B
is random.
16.
The BlackBerry Router forwards
y
D
and
e
B
to the BlackBerry Enterprise Server.
17.
The BlackBerry Enterprise Server performs the following calculations:
•
checks that when the value
e
D
equals
e
B
, the value
e
B
is random
•
checks that when the value
e
D
equals 0, the value
e
D
is random
•
computes
y
B
=
h
–
e
B
r
B
(mod
p
)
18.
The BlackBerry Enterprise Server sends
y
B
to the BlackBerry device.
19.
The BlackBerry device receives
y
B
.
If the BlackBerry device accepts
y
B
, the BlackBerry Enterprise Server and the BlackBerry device open an
authenticated connection between them.
©
2009 Research In Motion Limited. All rights reserved.
www.blackberry.com