Some days ago I asked for a help to find and correct the problems of an authentication protocol. I closed the post because I was convinced I can correct it but, unfortunately I'm having some troubles. The "old" post is the following:
I'm dealing with this problem: establish if the following protocol is 'secure' and, if it isn't, modify it to make it secure.
I will use the subsequent notation to describe the protocol:
- $N$ is a nonce
- $X \longrightarrow Y: \space M$
to indicate that $X$ sends $M$ to $Y$ - $K_{XY}$ to indicate the symmetric key shared by $X$ and $Y$
- and $K_{XY}(M)$ to indicate that the message $M$ has been encrypted with the symmetric key $K_{XY}$.
The protocol allows a client $C$ to authenticate itself to a server $S$ using an authentication service $A$.
$C \longrightarrow S:\space C$
$S \longrightarrow C:\space N$
$C \longrightarrow S:\space K_{CA}(N)$
$S \longrightarrow A:\space K_{SA}(C, K_{CA}(N))$
$A \longrightarrow S:\space K_{SA}(N)$
$S$ authenticates $C$ if and only if the nonce received $N$, got by the authentication service ($A$), is equal to the nonce sent to $C$.
Assuming the communication channel is not secure, an attacker (called Eve) can impersonate $C$ simply sending the message "C" and $K_{CA}(N)$ whenever $C$ tries to authenticate himself.
How to avoid impersonation and offline nonce-guessing in this case? I tried to provide a satisfactory answer but without result. Any suggestion? I don't want the answer to the problem, just a few tips to continue on my own. At the end, I want to say that I know how to make the protocol secure but my answer consists in completely change the protocol described above, and so I think my answer is not the most appropriate.
Recently I thought to modify the protocol as follows:
$C \longrightarrow S:\space C$
$S \longrightarrow C:\space K_{SA}(N)$
$C \longrightarrow S:\space K_{CA}(K_{SA}(N))$
$S \longrightarrow A:\space K_{SA}(C, K_{CA}(K_{SA}(N)))$
$A \longrightarrow S:\space K_{SA}(N)$
Can it work now?
