If we want to establish secret symmetric key between two entities, why use Needham-Schroeder if we have Diffie-Hellman? With DH we don't need to have any trusted party, so what's the point of NS?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Both Needham-Schroeder (N-S) and Diffie-Hellman (D-H) are one of the earliest proposed key exchange protocols and thus they are usually used as classical textbook examples. However, the originally proposed protocols have some flaws. The N-S Symmetric Key Protocol is vulnerable to a replay attack, the N-S Public-Key Protocol is vulnerable to a man-in-the-middle attack and the D-H is also vulnerable to a man-in-the-middle attack.
Therefore, improved schemes such as Kerberos (for N-S) and the Station-to-Station (STS) protocol (for D-H) were proposed. The N-S makes use of a trusted server for authentication while the improved D-H or STS protocol uses public key certificates for authentication. With STS, we are still making use of a trusted party which is the Certificate Authority for authentication. Even though the web of trust concept (in PGP) may be used, it may not be scalable.
So the main differences between the two protocols would be: