# What is the original SKID3 protocol?

While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it.

The basic structure is the following:

(1) $A \rightarrow B: r_A$

(2) $B \rightarrow A: r_B || \operatorname{MAC}(r_B||r_A||A)$

(3) $A \rightarrow B: \operatorname{MAC}(r_B||r_A||B)$

where $A$ and $B$ are the identifiers of the senders and recipients, '$||$' means concatenation and $r_A$, $r_B$ are challenges(e.g. random numbers).

Sometimes the concatenation order of $r_A$ and $r_B$ is inverted between step 2 and 3 (page. 19) . Some other time $r_A$ is omitted in step 3 (slide 23) . But the authors never explain why those parts are designed that way.

1. To me it looks like those variations don't introduce any problems. So do you think those variations offer the same level of security?
2. Something that all variations have in common is that in step 2 in the MAC function $r_B$ (the "own" challenge) always comes first (maybe a coincidence?). Doesn't look to me like it makes a difference whether $r_B$ or $r_A$ comes first. What do you think?
3. Is SKID3 actually a standardized protocol or is it just a scheme that can be used or built upon? I couldn't find it in any document defined as a standard.

I know that the identifiers in step 2 and 3 are used in order to thwart a reflection attack and the concatenation of $r_B$ and $r_A$ in step 2 is necessary to prevent a parallel session attack. But the above questions are still unclear to me.

SKID (Secret-Key IDentification protocol), by Walter Fumy and Markus Dichtl, originates from a research effort in Europe in 1992 (Research and Development in Advanced Communication Technologies in Europe, RIPE Integrity Primitives: Final Report of RACE Integrity Primitives Evaluation (R1040), RACE, June 1992), also available in the Springer's LNCS-series, vol. 1007.

Unfortunately, the original text seems to be unavailable in the web. The part I of the book can be found here: http://oai.cwi.nl/oai/asset/5295/5295D.pdf. However, SKID was sent for standardization in ISO/IEC, and is essentially the same as ISO/IEC 9798-4:1999(E)-standard's three-pass authentication mechanism for mutual authentication. This standard seems to be plentifully available via simple googling despite the apparent IPR issues.

SKID-2 means a unilateral (two-pass) auth.protocol, while SKID3 means the (three-pass) mutual authentication (ISO 9798-4, Chapter 5.2.2).

There are indeed some variations on the protocol. Most notably there is confusion on whether $B$ (resp. $A$) should include $B$'s (resp. $A$'s) identity in Step 2 (resp. Step 3) or vice versa. Notably Schneier's Applied Cryptography orders the identities differently (2nd ed. Chapter 3.2 about SKID).

The "original" version of SKID3 (where $B$ will include $A$'s identity inside the MAC in Step 2 and $A$ will include $B$'s identity in Step 3) is correct, at least from the point of view of protecting against reflection attack: adding the identity inside the MAC means that the sending party (here: $B$) is able to distinguish between messages sent by $B$, $A$ and other possible parties $A'$. If the message includes merely $B$'s own identity, such a distinction cannot be made.

The actual questions:

1. Order of $r_A$ and $r_B$. Within one message it is indeed the same, in which order the nonces appear. However, they need to be in a different order from Step 2 to Step 3, or (as one variation goes) leave out $r_A$ in Step 3. There is a type of attack against a public-key authentication protocol featured in ISO 9798-3 authentication mechanisms called Canadian attack (e.g. p.112 of Boyd and Mathuria's Protocols for Authentication and Key Establishment), which is applicable here as well, if the MACs are too similar. In essence, the attacker may try to fool B to accept a token from Step 2 as a token from Step 3, unless they are dissimilar.
2. The omitting of $r_A$ does not expose the protocol to typical attacks including reflection, parallel sessions and MitM. This is basically due to the reason that it is difficult for an attacker to get through to Step 3, since Step 2 already includes both nonces and the token is unique in construction and format in the protocol. Other attacks may apply, though.
3. Even though SKID3 can be considered as a standard mechanism, one will still have to be careful to consider the circumstances where to use the protocol. The protocol does assume a pre-shared secret between $A$ and $B$ and is used for entity authentication only. The notion of universal composability for protocols only came around in 2000 by Canetti, so SKID has been designed on a per-attack basis rather than general security.