If we want to establish secret symmetric key between two entities, why use Needham-Schroeder if we have Diffie-Hellman? With DH we don't need to have any trusted party, so what's the point of NS?
Both Needham-Schroeder (N-S) and Diffie-Hellman (D-H) are one of the earliest proposed key exchange protocols and thus they are usually used as classical textbook examples. However, the originally proposed protocols have some flaws. The N-S Symmetric Key Protocol is vulnerable to a replay attack, the N-S Public-Key Protocol is vulnerable to a man-in-the-middle attack and the D-H is also vulnerable to a man-in-the-middle attack.
Therefore, improved schemes such as Kerberos (for N-S) and the Station-to-Station (STS) protocol (for D-H) were proposed. The N-S makes use of a trusted server for authentication while the improved D-H or STS protocol uses public key certificates for authentication. With STS, we are still making use of a trusted party which is the Certificate Authority for authentication. Even though the web of trust concept (in PGP) may be used, it may not be scalable.
So the main differences between the two protocols would be:
- To trust a single trusted party which you can maintain yourself or to trust the public Certificate Authorities.
- To depend on the security of the underlying encryption schemes (such as AES for Kerberos) or to depend on the assumption of the discrete logarithm problem (for D-H).