Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm having difficulties understanding exactly what this protocol means:

$S \to D : \{N_S , S\}K_D$

$D \to S : \{N_S , N_D \}K_S$

$S \to D : \{N_D \}K_D$

"where $S$ represents the supervisor’s console and $D$ represents the door controller and the other symbols have their usual security protocol meanings."

I understand $N$ to be a nonce, a randomly generated number/hash that will only be used once.

I'm assuming $K$ is the public key?

Could someone explain this protocol for me, I’ve looked everywhere and cannot find anything like this.

share|improve this question
add comment

3 Answers

Under the assumption that $K_X$ represents $X$'s public key, this is the three-message version of the Needham-Schroeder public-key protocol. Many mutual authentication protocols derive from this design.

Wikipedia has the seven-message version of the protocol. The essential difference between that version and the three-message version is that the seven-message version explicitly includes the certificate exchanges for the public keys. The three-message version simply assumes that the correct public keys are known.

The protocol was proven secure using a formalism called BAN logic, which is hardly used nowadays. Almost 20 years after the protocol was proposed it was shown that it is vulnerable to a man-in-the-middle attack if the adversary has his own public/private key pair, see this paper by Gavin Lowe.

share|improve this answer
add comment

It seems like an authentication protocol. In the first message, $S$ identifies herself. In the 2nd message $D$ proves knowledge of her private key (otherwise she could not return $N_s$. In the third message, $S$ proves knowledge of her private key.

You asked in a comment about replay attacks. There are two possibilities, the attacker is impersonating $S$ or $D$.

For $S$, the attacker might replay a captured 1st message. $D$ would see it, decrypt, return $N_S$ with a randomly generated $N_D$. The attacker could not possibly know what $N_D$ is and could not send the last message.

For impersonating $D$, $S$ would send the first message, but the attacker couldn't decrypt it and therefore could not send the 2nd message.

So, it seems the protocol is secure against replay attacks.

share|improve this answer
    
But if there are two different doors $D_1$, $D_2$, then one of the doors is able to impersonate the supervisor to the other door. –  CodesInChaos Dec 14 '12 at 13:30
add comment

This looks like a symmetric-key protocol: $S$ first sends a nonce $N_S$ along with its name encrypted under the key $K_D$. Then $D$ responds with an encryption of $N_S$ along with another nonce $N_D$, this time encrypted under $K_S$. Finally $S$ sends $N_D$ to $D$, this time encrypted under $K_D$.

share|improve this answer
    
Is it possible for a message to be retransmitted from an attacker? –  George Orwell Dec 14 '12 at 1:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.