Understanding cybersecurity through a riddle. And a cat
Imagine you have a cat, named Sniffles. You love that cat very much. Unfortunately, you have to give it away, because you developed an allergy to cats. It’s a very sad day for you.
But you don’t want Sniffles to be sad as well. So you decide to send it to the person you trust the most — her name is Alice, and she lives across the country. You decide to send your cat to Alice using an expedited post service called “cat-in-a-box”.
(Note: please do not send cats in boxes in real life, it hurts their feelings…)
The problem is you don’t want Matilda, the malicious cat-in-a-box employee, stealing your cat, or even knowing what’s inside. Assuming you’ve trained your cat not to meow while in the box, what’s left to do is lock the box. Fortunately, you own an unbreakable lock.
But here comes the second problem. You need to send the key to Alice somehow. If you just send the key in an open box, Matilda would intercept it, duplicate the key, and deliver it to Alice. Then, once the locked box arrives — she will open it and escape with Sniffles.
So, how can you safely transfer Sniffles to Alice without compromising its safety?
(For the sake of the riddle, imagine your only way to communicate with Alice is via Matilda’s postal service)
.
.
.
.
.
.
.
.
.
.
(One) solution
You lock the box using your own key, and send the box without the key to Alice. Now comes the twist — Alice adds a second lock to the box, using her own unbreakable key, and sends it back to you. Now the box is locked with 2 keys. You open the lock using your key, which leaves the box locked only using Alice’s key. You send it back to Alice, who opens the box and welcomes the poor Sniffles, who had to travel a very long journey, and is probably extremely hungry.
Awesome!!!
.
.
Well, not entirely. Did you uncover any problems in this method?
.
.
.
.
.
.
In fact, I was asked this riddle during computer science classes in the university a long time ago. The solution sounded really cool back then, when I was young and naive, but thinking about it now — it’s far from being bullet-proof.
If Matilda, the malicious employee from cat-in-a-box knows about your little system, she can still fool you by simply adding a lock of her own and sending it back to you, pretending to be Alice. Once you unlock your side and send it back, Matilda unlocks hers and takes Sniffles.
If you think you can solve this by waiting for a letter from Alice telling you she sent the package — think again. Matilda is a fraud artist. She can fake Alice’s hand-writing, or produce a box and a lock that looks exactly like yours, and send it to Alice, making her think it’s your box she’s locking.
.
So, how can we solve this more complex situation?
Well, if you could, you would probably meet Alice in person once, exchange keys, and from now on be able to freely send each stuff.
Another solution is to have a trusted authority that manufactures the locks, that can identify the proper owner of the locks. Imagine that before you and Alice unlock the boxes, you go to this authority and verify that the owner of the box is the proper one. This solution might sound a bit weird in the context of this riddle, but in reality, this is a common solution.
I’d love to hear your thoughts, and I guess there are even better solutions to the riddle than what I know.
(Note: no cats were hurt during the writing of this article)
