I have started to study cryptography and I have come across Denning-Sacco protocol. I understand multiplicity vulnerability.

My question is why Denning-Sacco protocol choose to generate key on trusted third party and send it to Alice who then sends it to Bob.

Would it not be faster and easier if A could generate key from some randomized variable such as last few key strokes by user or date, time and current temperature or any other such parameters.


The Denning-Sacco protocol is a key transport protocol designed for use over an insecure network. It adds timestamps to the Needham–Schroeder protocol to prevent replay attacks. Rishav Bhowmick, "Denning Sacco Protocol", summarizes the protocol as:

  1. $A \rightarrow S: A,B$
  2. $S \rightarrow A: E(K_{as}: B, K_{ab}, T, E(K_{bs}: A, K_{ab}, T))$
  3. $A \rightarrow B: E(K_{bs}: A, K_{ab}, T)$

The entire point of the protocol is that $A$ and $B$ both need to know a shared secret key ( $K_{ab}$ ), but they don't already have a shared secret key at the beginning of the process – typically because key management is more convenient for Bob to remember and keep secret a single secret key shared between Bob and the central server ( $K_{bs}$ ) rather than a hundred secret keys shared between Bob and the hundred people Bob needs to communicate with.

It certainly would be faster and easier to A to generate a key and send it directly to Bob (skipping steps 1 and 2), but that would be insecure. After Alice generates a key, there seems to be only 2 ways Alice can send that key directly to Bob:

  • Send the key Kab encrypted with some other key $Kold$ – perhaps something like $A \rightarrow B: E(Kold_{ab}: K_{ab}, T, etc.)$ – but why? If Alice and Bob already had a shared secret key $Kold_{ab}$, then there's little point to using DS to send another key, and if they don't, then Bob has no way of decrypting that message.
  • Send the key Kab in $plaintext: A \rightarrow B: K_{ab}$. This allows everyone listening to hear the key $K_{ab}$ and decrypt all the messages between $A$ and $B$ encrypted with that key, and it allows active attackers to inject messages of their choice encrypted with that key that might trick Alice or Bob into thinking the message came from the other.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.