# How to attack this authentication protocol from “Cryptography: An introduction”

Consider the following protocol (from the book "Cryptography: An introduction", by Nigel Smart):

A → B: A, Na
B → S: B, {A, Na, Tb}Kbs, Nb
S → A: {B, Na, Kab, Tb}Kas, {A, Kab, Tb}Kbs, Nb
A → B: {A, Kab, Tb}Kbs, {Nb}Kab


where the smaller letters are the suffix so example Kab means the Key shared by A and B. Tb represents the timestamp for the message and Nb represents a nonce.

My question is: If an external attacker is impersonating A and S at the same time, how the attacker can manage to trick B into believing A is authenticated? I'm told I should be able to describe how to do this in exactly 3 messages (omitting one of the messages in the protocol).

My attempted solution is: If A and S are impersonated then when B is sending a message to S, the external attacker will know what is being sent and therefore the attacker can forward the message as normal to A but can corrupt the message. I'm not able to write a protocol as it's a bit confusing.

See also What does this Authentication protocol achieve and what information is shared? for a related question about the same protocol.

-
Ps. Where is this exercise from, anyway? –  Ilmari Karonen Dec 27 '13 at 19:00
Yes, I believe this is the same question but this question has 5 parts to it and i'm stuck on the 3rd part. Its from an exercise book named "Cryptography: An introduction" by Nigel Smart. Any additional help towards my question would be great! thanks :) –  ZWT Dec 27 '13 at 19:20

If the attacker M is impersonating both A and S, then he obviously doesn't have to bother sending the third message in the protocol to himself. Thus, the protocol reduces to:

M(A) → B: A, Na
B → M(S): B, {A, Na, Tb}Kbs, Nb
M(A) → B: {A, Kab, Tb}Kbs, {Nb}Kab


where M(A) and M(S) denote M impersonating A and S respectively.

By itself, this is not a successful attack: while M can pick any valid Kab he wants, he generally cannot obtain the corresponding ciphertext {A, Kab, Tb}Kbs to send to B. However, if the formats for Kab and Na are compatible, such that M can choose Kab equal to Na, and if B does not check for this possibility, then M can simply replay the ciphertext {A, Na, Tb}Kbs he received from B in the second step, leading to the attack:

M(A) → B: A, Na=Kab
B → M(S): B, {A, Na=Kab, Tb}Kbs, Nb
M(A) → B: {A, Na=Kab, Tb}Kbs, {Nb}Na=Kab


Other attack methods may exist if the encryption scheme denoted by the curly braces is malleable, but the attack described above will work even if it's not.

-