# Designing a secure protocol to avoid MITM?

Imagine that you are designing an online game, the framework consists of a player A, a game host H and a trusted central server S.

The player A has a symmetric key KAS and id A that is known to the trusted central server (these would be set up using a registration key printed on the CD box).

The host and server have well known public keys.

The player will connect to the host H and set up a symmetric session key with which to play the game. You want to ensure that only people who have bought the game can play online. Therefore the host H will have to check with the server S that the player A really does have a key.

Design a protocol that will let A connect to the host H and let H check with the server S to see if A is a legitimate player (i.e., really does have a shared key with S).

There is only one server but there may be a number of hosts and players. In particular, your protocol should make it impossible for an attacker to wrongly authenticate with a host by intercepting and replaying messages or by acting as a man-in-the-middle.

What I have tried: \begin{align} A \rightarrow H&: E_{K_{AS}}[A, n_1], A\\ H \rightarrow S&: E_{S_{pub}}[E_{K_{AS}}[A, n_1], K_{AH}, n_2]\\ S \rightarrow H&: E_{H_{pub}}[\{A, n_2, K_{AH}\}, E_{K_{AS}}[K_{AH}, n_1]]\\ H \rightarrow A&: E_{K_{AS}}[K_{AH}, n_1]\\ A \leftrightarrow H&: E_{K_{AH}}[game play] \end{align}

Am I somewhat on the right path here, or did I miss anything important?

• What are $n_1$ and $n_2$? – puzzlepalace May 23 '16 at 23:46
• @puzzlepalace nounces, random numbers that are sent in order to prevent replay attack. A nounce should never be allowed to be used twice for this reason. – Biv May 24 '16 at 14:16