Here is the protocol outline I am looking at (source: Foundations of Computer Security, Lecture 60: The Needham-Schroeder Protocol)
$$ \begin{array}{ccl} 1.& A \to S \colon& A,B,N_a \\ 2.& S \to A \colon& \left\{ N_a,B,K_{ab},\{K_{ab},A\}_{K_{bs}} \right\}_{K_{as}} \\ 3.& A \to B \colon& \{K_{ab},A\}_{K_{bs}} \\ 4.& B \to A \colon& \{N_{b}\}_{K_{ab}} \\ 5.& A \to B \colon& \{N_{b}-1\}_{K_{ab}} \end{array} $$ Where $N_a,N_b$ are nonces.
My questions are:
- Why do we need nonce $N_a$ in step 1?
- Why do we encrypt everything in step 2? Surely $S$ could instead send message to $A$ like $K_{as}\{K_{ab}\} || K_{bs}\{K_{ab}\}$?
- Why $S$ can't send $K_{ab}$ to $B$?