We are doing symmetric Needham-Schroeder protocol in university. We were provided a modified protocol and needed to answer the following questions.
Original protocol:
Modified protocol:
Task
a) An attacker is an active MitM and knows an old key $k_{cs_{old}}$ and all transmitted messages from the past. Can the attacker impersonate $C$ or $S$? If so, which protocol changes are required to fix it?
b) An attacker is no MitM and does not know any previous messages or any $k_{cs}$. He is allowed to act as a client $C'$ or server $S'$ both known by the TTP. Can the attacker impersonate $C$ or $S$? If so, which protocol changes are required to fix it?
The only difference I see is that the identity of $C$ is not part of the $c_2$.
My guess is the following:
a) The MitM replaces $c_2$ with $c_{2'} = Enc(k_S, k_{cs_{old}})|C$ and replays it to $C$. $C$ has no way to check if this key is old or new and accepts it. Putting $C$ into $c_2$ would not help cause Needham-Schroeder does not autenticate the client (in this protocol). You need timestamps like in Kerberos.
b) The attacker is $C'$ and wants to connect to $S$. He decrypts $c_1$ and changes $c_2 = Enc(k_s, k_{cs})|C'$ to $c_2 = Enc(k_s, k_{cs})|C$. He then sends it to $S$. $S$ thinks it communicates with $C$. To fix it we need to also encrypt the identify in $c_2$. I can't think of a way how to impersonate the server $S$.. Is there a way?
What is your opinion?
