I've been studying specifically the authentication algorithm Needham and Shroeder, and understand the idea in general of the message exchange. But, researching on the subject, I found a question that I do not know the correct answer to, and I would like to get some feedback from someone with more experience on the subject.
At one point in the algorithm agent
B to send an
N encrypted with the session key in the form of challenge.
A - > B [ Nb ] Kab Kab : session key, Nb : a number sent by B,
Says the question that this step is not safe , and asks to explain why.
The only problem I see is the message of this session key,
Kab, be violated . Anyone can access the session key, or there is some flaw in this step?
Because only if
B have the key,
Kab, this message can only be decrypted by these two agents.
Another problem may be the message playback, somebody third agent captures the
[ Nb ] Kab and sends later getting the opinion that knows
Kab, this can also be a problem? The latter case can be solved with a timestamp .