1
$\begingroup$

I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is not much literature existing.

So I did a little bit of research and have some basic knowledge regarding OR-protocol. I thing I somehow couldn't find were applications / use cases of Utway-Rees.

In literature they are talking about that its used for parties to agree on a secret key using TTP in unsafe networks and that its a common thing for VPNs. But one thing I am still missing is: where is implemented? Does it have some applications in TLS/SSL, or IPSec?

$\endgroup$
4
  • 1
    $\begingroup$ No, because the protocol is not secure against replay attacks.. In general, this is much closer to Kerberos (secure and state-of-the-art) or Needham-Schroeder (not secure either) than DH key exchange, which does not rely on a trusted server. (Note DH alone is also not secure, you need an authenticated variant). $\endgroup$
    – tylo
    Nov 29, 2016 at 16:44
  • $\begingroup$ @tylo Brilliant comment, you could almost say it's an answer; actually, I'd go one step further and make it one. $\endgroup$
    – Maarten Bodewes
    Nov 30, 2016 at 14:34
  • $\begingroup$ @MaartenBodewes Done. Although it doesn't adress the stated questions directly. $\endgroup$
    – tylo
    Nov 30, 2016 at 15:12
  • $\begingroup$ @tylo Well, it is better than no answer, it explains why there may be few - if any - protocols using it and at least it won't get out of date any time soon. Seems fine to me :) $\endgroup$
    – Maarten Bodewes
    Nov 30, 2016 at 15:22

2 Answers 2

1
$\begingroup$

No, because the protocol is not secure against replay attacks.

In general, this is much closer to Kerberos (secure and state-of-the-art) or Needham-Schroeder (not secure either) than Diffie-Hellman key exchange, which does not rely on a trusted server. (Note DH alone is also not secure, you need an authenticated variant).

That is probably the reason why you didn't find that much information on the protocol, why there are no common standard references and why it isn't used in cryptographic standards. In any case, Kerberos provides the same functionality with better security properties and it is already widely used.

$\endgroup$
0
$\begingroup$

The Otway-Rees protocol has been widely used as an example in the study of the formal analysis of authentication protocols, but has not been used in practice. Such implementations as exist have been in the form of input to protocol analysis tools or academic exercises.

One example is a thesis Implementation of Otway-Rees Protocol. Note that this does not address the known fatal flaws although it does mention the less important disruptive replay attack.

The wide use as an example is probably due it it being used in Authentication: a practical study in belief and action the paper in which Burrows, Abadi and Needham introduced an early version of what became known as BAN-logic.

Note that that analysis did not discover the fatal flaws that are now known.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.