Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works.

  1. A chooses $N$ (nonce) and sends to C (trusted server): $A, B, N$

  2. C chooses $K$ and sends to A: $Kac(N, K, B, Kbc(K,A))$

  3. Now Trudy acts in place of Alice

  4. A decodes, checks $N$ and $B$, and sends to B: $Kbc(K,A)$

  5. T (as A) replays to B: $Kbc(K',A)$, where $K'$ is an older session key

  6. B decodes, chooses nonce $N'$ and sends to A: $K'(this is B, N')$

  7. B sends to T (not to A): $K'$ (this is $B, N'$)

  8. A sends to B, $K$ (this is $A, N'-1$)

If $Kbc$ is the shared secret key between Bob and the trusted server C, how is it possible for Trudy compute $Kbc(K',A)$? Trudy does not have $Kbc$…


1 Answer 1


The trick here is that Trudy does not need to know $K_{bc}$ (as you mentioned, it's not public).

However, what Trudy really needs to do is observe (by just monitoring the network) and store a previous "$K_{bc}(K,A)$" value that A has sent to B (publicly) beforehand (step 4).

So now in any future protocol sessions. Given that $K_{bc}$ is going to be the same, Trudy has the previous value it needs to preform the replay attack.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.