Needham Schroeder

We now introduce a simplified version of the original symmetric key Needham-Schroeder protocol, which uses nonces and explicit identities for the sender and the recipient.

Knowledge: A:[s, KAS, A, B, NA], B:[KBS, A, B], S:[A, B, E, KAS, KBS, KES, K] E:[A, B, NE, KES, fake]
Steps:

1. A -> S: A, B, #NA
2. S -> A: {#NA, #K, B, {K, A}KBS}KAS
3. A -> B: {K, A}KBS, {#s}K

This protocol should resist against confidentiality attacks (i.e., E should not be able to learn the current session secret). However, this protocol is still vulnerable against integrity attacks (i.e., E is still able to send a fake message spoofing A).

Attacks

1. Can you find a sequence of commands such that E knows the session secret?
2. Tip 1
   You can try all the attacks covered so far.

• Solution
  It should not be possible for E to know the session secret.

1. Can you find a sequence of commands such that B knows fake?

• Tip
  Are the conditions for the previous attack still there?
• Solution
  new_session(); transmit(0); transmit(1); intercept(2); new_session(); compromise(K_0); encrypt(fake, K_0); inject(A->B:{K_0, A}KBS, {fake}K_0); transmit(4);