1
$\begingroup$

We are doing symmetric Needham-Schroeder protocol in university. We were provided a modified protocol and needed to answer the following questions.

Original protocol: enter image description here

Modified protocol: enter image description here

Task

a) An attacker is an active MitM and knows an old key $k_{cs_{old}}$ and all transmitted messages from the past. Can the attacker impersonate $C$ or $S$? If so, which protocol changes are required to fix it?

b) An attacker is no MitM and does not know any previous messages or any $k_{cs}$. He is allowed to act as a client $C'$ or server $S'$ both known by the TTP. Can the attacker impersonate $C$ or $S$? If so, which protocol changes are required to fix it?

The only difference I see is that the identity of $C$ is not part of the $c_2$.

My guess is the following:

a) The MitM replaces $c_2$ with $c_{2'} = Enc(k_S, k_{cs_{old}})|C$ and replays it to $C$. $C$ has no way to check if this key is old or new and accepts it. Putting $C$ into $c_2$ would not help cause Needham-Schroeder does not autenticate the client (in this protocol). You need timestamps like in Kerberos.

b) The attacker is $C'$ and wants to connect to $S$. He decrypts $c_1$ and changes $c_2 = Enc(k_s, k_{cs})|C'$ to $c_2 = Enc(k_s, k_{cs})|C$. He then sends it to $S$. $S$ thinks it communicates with $C$. To fix it we need to also encrypt the identify in $c_2$. I can't think of a way how to impersonate the server $S$.. Is there a way?

What is your opinion?

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.