The Weakest Link: Security in Human Interactive Security Protocols.

Ad hoc networks of mobile devices have posed challenges never seen before in conven-tional wired networks. In conventional wired networks, the use of trusted third parties or Public Key Infrastructure (PKI) has worked quite well. However, in ad hoc networks of mobile devices, there is no PKI that can cover all devices and scenarios at a reasonable cost[6]. In addition, these networks are usually created among devices that share no secrets nor know each other’s identity. The lack of a PKI that is both sufficiently universal and sufficiently available to cover all scenarios or presence of trusted third parties holding pre-shared secrets in ad hoc networks has forced researchers to look for alternative ways in which secure device association can be achieved in such environments. A common denominator among the proposed alternatives is the use of an out-of-band (OOB) or empirical channel [5]. The use of two channels has been proposed: one is a high bandwidth channel which is subject to the Dolev-Yao attacker model1 [1] where messages that are public are exchanged between associating devices. The second channel is a low bandwidth out-of-band or empirical channel, which is not subject to the Dolev-Yao attacker model, through which messages tha