What Makes a Secure Protocol

Authentication is the goal of establishing the identity of communication partners. Without authentication, a protocol is vulnerable to impersonation: an attacker can pretend to be a trusted server and intercept communications. Authentication in protocols is typically achieved using digital certificates, pre-shared keys, or challenge-response mechanisms that prove knowledge of a secret without revealing it.

Confidentiality ensures that message content is accessible only to intended recipients. It is achieved through encryption using keys known only to the parties involved. A confidentiality failure means an eavesdropper can read messages in transit. Confidentiality alone does not prevent an attacker from tampering with messages or replay attacks; it must be combined with integrity protection.