Attacker in a key exchange

I'm having trouble with the following question:

1. $X(A) \rightarrow B:(A,N_X)$
2. $B \rightarrow X(S):(B,((A,N_X,T_B),K_{BS}),N_B)$
3. $X(A) \rightarrow B:(((A,N_X,T_B),K_{BS}),(N_B,N_X))$

Give two very good reasons why this attack works, in terms of the properties of the messages being exchanged and their content.

$X$ is the attacker in this case.

$A$ and $B$ are the names of two agents, $S$ is the name of a trusted server, $N_X$ denotes a nonce created by entity $X$, $T_X$ denotes a timestamp created by entity $X$, $K_{XY}$ denotes a key shared between entities $X$ and $Y$

If anyone can help at all, I would greatly appreciate someone going through this question with me step by step.

From this I have understood that $B$ relays the encrypted message back and thinks everything is okay. The attacker doesn’t care about verifying the message. It gets the key and communicates with $B$ where $B$ thinks it is $A$ who has got the key through the server.

I just want to make sure that i have understood it correctly.

• I think it would help if you explained the notation used in the question. As is it does not make much sense to me at least, and I am afraid others might have the same problem. – Guut Boy Dec 18 '14 at 19:16
• @GuutBoy Updated it explaining the values, sorry about that. – Bimal Dec 18 '14 at 19:22
• I suppose it helps a little but it still does not make a lot of sense to me. What does the arrows mean? What does X(A) mean? What is the protocol (assuming we are talking about a protocol) supposed to do? Try to imagine someone who did not take the course you are taking/read the book you are reading, and explain your question so that person would understand it. – Guut Boy Dec 18 '14 at 20:07
• Well its a security protocol, i dont know any better way to explain it. Its quite similar to this crypto.stackexchange.com/questions/11609/… – Bimal Dec 18 '14 at 20:16
• @GuutBoy : $\;\;\;$ The arrows mean sends to. $\:$ X(A) means the adversary while pretending to be A. $\hspace{.58 in}$ – user991 Dec 18 '14 at 20:31

I think that this notation "$(A,N_X,T_B),K_{BS}$" isn't correct and must be transcripted as "$(A,N_X,T_B).K_{BS}$", which could be interpreted as the resulting cipherText of "$(A,N_X,T_B)$ under the Key $K_{BS}$". Under these conditions, we could try to understand that the attacker X begin by impersonating A, by sending to B the plainText $(A,N_X)$
• X: Impersonating A: X(A) -> $(A,N_X)$
• B: Ask the Server to generate a shared key for A and B, But the message is intecepted by the Attacker who doesn't know the Master Key $K_{BS}$
• The attacker then return back the initial cipherText to B, who can easilly decrypt as he knows its shared Key $K_{BS}$ with the trusted third part.