Consider the following protocol (from the book "Cryptography: An introduction", by Nigel Smart):

A → B: A, Na
B → S: B, {A, Na, Tb}Kbs, Nb
S → A: {B, Na, Kab, Tb}Kas, {A, Kab, Tb}Kbs, Nb
A → B: {A, Kab, Tb}Kbs, {Nb}Kab

where the smaller letters are the suffix so example Kab means the Key shared by A and B. Tb represents the timestamp for the message and Nb represents a nonce.

My question is: If an external attacker is impersonating A and S at the same time, how the attacker can manage to trick B into believing A is authenticated? I'm told I should be able to describe how to do this in exactly 3 messages (omitting one of the messages in the protocol).

My attempted solution is: If A and S are impersonated then when B is sending a message to S, the external attacker will know what is being sent and therefore the attacker can forward the message as normal to A but can corrupt the message. I'm not able to write a protocol as it's a bit confusing.

See also What does this Authentication protocol achieve and what information is shared? for a related question about the same protocol.

  • $\begingroup$ possible duplicate of What does this Authentication protocol achieve and what information is shared? $\endgroup$ Commented Dec 27, 2013 at 18:58
  • 1
    $\begingroup$ Ps. Where is this exercise from, anyway? $\endgroup$ Commented Dec 27, 2013 at 19:00
  • 2
    $\begingroup$ Yes, I believe this is the same question but this question has 5 parts to it and i'm stuck on the 3rd part. Its from an exercise book named "Cryptography: An introduction" by Nigel Smart. Any additional help towards my question would be great! thanks :) $\endgroup$
    – ZWT
    Commented Dec 27, 2013 at 19:20

1 Answer 1


If the attacker M is impersonating both A and S, then he obviously doesn't have to bother sending the third message in the protocol to himself. Thus, the protocol reduces to:

M(A) → B: A, Na
B → M(S): B, {A, Na, Tb}Kbs, Nb
M(A) → B: {A, Kab, Tb}Kbs, {Nb}Kab

where M(A) and M(S) denote M impersonating A and S respectively.

By itself, this is not a successful attack: while M can pick any valid Kab he wants, he generally cannot obtain the corresponding ciphertext {A, Kab, Tb}Kbs to send to B. However, if the formats for Kab and Na are compatible, such that M can choose Kab equal to Na, and if B does not check for this possibility, then M can simply replay the ciphertext {A, Na, Tb}Kbs he received from B in the second step, leading to the attack:

M(A) → B: A, Na=Kab
B → M(S): B, {A, Na=Kab, Tb}Kbs, Nb
M(A) → B: {A, Na=Kab, Tb}Kbs, {Nb}Na=Kab

Other attack methods may exist if the encryption scheme denoted by the curly braces is malleable, but the attack described above will work even if it's not.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.