A method for authenticating a user of a client device at a server, while protecting against a man-in-the-middle third party attack, the method comprising:
- immediately testing a network transmission pathway one or more times to determine a transmission latency delay;
- determining that an unauthorized man-in-the-middle third party attack is possibly occurring due to a test yielding an unexpected result;
- confirming, based on a determination that the transmission time is greater than an allowed latency threshold, that either:
- a corrupt, dysfunctional, or inadequate transmission path is present;
- or
- an unauthorized man-in-the-middle third party attack is definitely occurring;
- causing the client device, the server, and the man-in-the-middle third party, to perform time-consuming calculations that require each CPU to work for a minimum amount of time that is at least greater and longer than an expected average time, or a standard deviation or a maximum latency round-trip time, to produce expected products from the time-consuming calculations;
- using the Merkle tree directly as operands or to modify the operands, the operands being used to produce keys during the session, the keys being used to encrypt and decrypt data sent between the client device and the server;
- when the client device or the server performs the time-consuming calculations and replies, without a man-in-the-middle third party present, the transmission latency is within the allowed latency threshold, and
- when the client device or the server performs the calculations and replies, and a man-in-the-middle third party passively intercepts the reply and makes no attempt to modify the data, a Diffie-Hellman key exchange becomes immune to the attack, and, when appropriately large operands are used, the Diffie-Hellman key exchange consistently produces a key known only to the client device and the server, and
- when the client device or the server performs the time-consuming calculations and replies, and a man-in-the-middle third party actively intercepts the transmission and attempts to modify the transmission by performing an attack by recalculating a product of the transmission, then, due to the complexity of the time-consuming calculations, a latency time caused by the complexity of the time-consuming calculations by the man-in-the-middle third party that are added to the latency time created by the client device or the server, plus the latency time of the transmission, causes a total latency time delay to be outside of the allowed latency threshold to indicate that a man-in-the-middle third party is present;
- encrypting data, using a processor associated with the client device and collected client device or user information;
- transmitting the encrypted data from the client device to the server via a network link therebetween;
- decrypting the data, at the server, using a server-side copy of two or more of:
- a username, a password, a challenge question, and the collected information.