Understanding a faulty Needam-Schroeder protocol

Question

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works.

1. A chooses $N$ (nonce) and sends to C (trusted server): $A, B, N$

2. C chooses $K$ and sends to A: $Kac(N, K, B, Kbc(K,A))$

3. Now Trudy acts in place of Alice

4. A decodes, checks $N$ and $B$, and sends to B: $Kbc(K,A)$

5. T (as A) replays to B: $Kbc(K',A)$, where $K'$ is an older session key

6. B decodes, chooses nonce $N'$ and sends to A: $K'(this is B, N')$

7. B sends to T (not to A): $K'$ (this is $B, N'$)

8. A sends to B, $K$ (this is $A, N'-1$)

If $Kbc$ is the shared secret key between Bob and the trusted server C, how is it possible for Trudy compute $Kbc(K',A)$? Trudy does not have $Kbc$…

Answer 1

The trick here is that Trudy does not need to know $K_{bc}$ (as you mentioned, it's not public).

However, what Trudy really needs to do is observe (by just monitoring the network) and store a previous "$K_{bc}(K,A)$" value that A has sent to B (publicly) beforehand (step 4).

So now in any future protocol sessions. Given that $K_{bc}$ is going to be the same, Trudy has the previous value it needs to preform the replay attack.