# A simple client/server authentication protocol

Some days ago I asked for a help to find and correct the problems of an authentication protocol. I closed the post because I was convinced I can correct it but, unfortunately I'm having some troubles. The "old" post is the following:

I'm dealing with this problem: establish if the following protocol is 'secure' and, if it isn't, modify it to make it secure.

I will use the subsequent notation to describe the protocol:

• $N$ is a nonce
• $X \longrightarrow Y: \space M$
to indicate that $X$ sends $M$ to $Y$
• $K_{XY}$ to indicate the symmetric key shared by $X$ and $Y$
• and $K_{XY}(M)$ to indicate that the message $M$ has been encrypted with the symmetric key $K_{XY}$.

The protocol allows a client $C$ to authenticate itself to a server $S$ using an authentication service $A$.

$C \longrightarrow S:\space C$
$S \longrightarrow C:\space N$
$C \longrightarrow S:\space K_{CA}(N)$
$S \longrightarrow A:\space K_{SA}(C, K_{CA}(N))$
$A \longrightarrow S:\space K_{SA}(N)$

$S$ authenticates $C$ if and only if the nonce received $N$, got by the authentication service ($A$), is equal to the nonce sent to $C$.

Assuming the communication channel is not secure, an attacker (called Eve) can impersonate $C$ simply sending the message "C" and $K_{CA}(N)$ whenever $C$ tries to authenticate himself.

How to avoid impersonation and offline nonce-guessing in this case? Any suggestion? I don't want the answer to the problem, just a few tips to continue on my own. At the end, I want to say that I know how to make the protocol secure but my answer consists in completely change the protocol described above, and so I think my answer is not the most appropriate.

Recently I thought to modify the protocol as follows:

$C \longrightarrow S:\space C$
$S \longrightarrow C:\space K_{SA}(N)$
$C \longrightarrow S:\space K_{CA}(K_{SA}(N))$
$S \longrightarrow A:\space K_{SA}(C, K_{CA}(K_{SA}(N)))$
$A \longrightarrow S:\space K_{SA}(N)$

Can it work now?

If Eve knows $C, \space N, \space K_{CA}(N)$ then she is able to impersonate $C$ just by following the protocol you described above.
If she just knows $K_{CA}(N)$ for a single $N$ then the effectiveness of the attack depends on the set wherein $N$ is picked.
But as you are supposing that the communication channel is not secure, an attacker could spy several authentication session to get a sufficient number of pairs $(N, K_{CA}(N))$ to successfully attack with high probability.
• @Process0 No, you said you admit that Eve knows $K_{CA}(N)$. So Eve sends $C$ then receives $N$ and then send back $K_{CA}(N)$. She exactly follows the protocol you gave. – Raoul722 Apr 12 '16 at 11:27
• @Process0 I don't understand your question. How is it related to the scenario in which Eve tries to impersonate $C$? Anyway, it seems a good practice to not send $K_{CA}(N)$ if authentication wasn't requested. But in the case I described above, Eve could spy the authentication protocol when $C$ initiates it (so he would send the encrypted nonce). – Raoul722 Apr 12 '16 at 17:42
• @Process0 The problem here is that the signature of the challenge only depends of the nonce $N$. So as soon as the same $N$ is used it is easy to impersonate $C$. To make this protocol more robust, we could introduce another contextual parameter $x$ in $K_{CA}(N,x)$ which does not appear as plaintext, known by $S$ and which would be different in an other session (date and hour for example ?). – Raoul722 Apr 20 '16 at 12:24