Consider the following protocol (from the book "Cryptography: An introduction", by Nigel Smart):
A → B: A, Na
B → S: B, {A, Na, Tb}Kbs, Nb
S → A: {B, Na, Kab, Tb}Kas, {A, Kab, Tb}Kbs, Nb
A → B: {A, Kab, Tb}Kbs, {Nb}Kab
where the smaller letters are the suffix so example Kab
means the Key shared by A and B. Tb
represents the timestamp for the message and Nb
represents a nonce.
My question is: If an external attacker is impersonating A and S at the same time, how the attacker can manage to trick B into believing A is authenticated? I'm told I should be able to describe how to do this in exactly 3 messages (omitting one of the messages in the protocol).
My attempted solution is: If A and S are impersonated then when B is sending a message to S, the external attacker will know what is being sent and therefore the attacker can forward the message as normal to A but can corrupt the message. I'm not able to write a protocol as it's a bit confusing.
See also What does this Authentication protocol achieve and what information is shared? for a related question about the same protocol.