# Insecurity in Needham and Schroeder protocol?

I've been studying specifically the authentication algorithm Needham and Shroeder, and understand the idea in general of the message exchange. But, researching on the subject, I found a question that I do not know the correct answer to, and I would like to get some feedback from someone with more experience on the subject.

At one point in the algorithm agent A asks B to send an N encrypted with the session key in the form of challenge.

Example :

A - > B [ Nb ] Kab

Kab : session key,
Nb : a number sent by B,


Says the question that this step is not safe , and asks to explain why. The only problem I see is the message of this session key, Kab, be violated . Anyone can access the session key, or there is some flaw in this step?

Because only if A and B have the key, Kab, this message can only be decrypted by these two agents.

Another problem may be the message playback, somebody third agent captures the [ Nb ] Kab and sends later getting the opinion that knows Kab, this can also be a problem? The latter case can be solved with a timestamp .

-

Maybe this question relate to public-key version of protocol. In this case, adversary could start two synchronous exchanges with Alice and Bob, and use Alice responses to convince Bob, that he communicating with Alice. More information

-
ok, I think I realized the idea. However arose me another question about this protocol, Imagining that the first message from Alice to the KDC nounce is repeated for some reason, the nounce is not unique. This can generate some kind of problem? – user2989745 Feb 3 '14 at 18:48
The only one probable problem is message playback. But as you said in your question, this can be solved with timestamps. – neverwalkaloner Feb 4 '14 at 8:06
But if it is returned with the same nounce, Na, think no danger, only if the key was already violated so there is some danger. Because the KDC does not return the same key, even nounce that it is not unique. Or danger to resend the mesnsagem nounce the same? – user2989745 Feb 4 '14 at 11:34
I suppose, use the same nounce in the first message to KDC is not secure. Because if previous key Kab was compromised, adversary can pretend he is KDC, and send old response to Alice. So Alice and Bob will use old key Kab without knowing about it. – neverwalkaloner Feb 5 '14 at 6:53
Yes I agree. But to have a problem key must already be insecure. Thanks for the help – user2989745 Feb 5 '14 at 11:37