1
$\begingroup$

I am working on an seminar paper regarding key exchange protocols. Of course my first choice of protocol was DH. Second, I choose Otway Rees protocol since I found it very interesting that there is not much literature existing.

So I did a little bit of research and have some basic knowledge regarding OR-protocol. I thing I somehow couldn't find were applications / use cases of Utway-Rees.

In literature they are talking about that its used for parties to agree on a secret key using TTP in unsafe networks and that its a common thing for VPNs. But one thing I am still missing is: where is implemented? Does it have some applications in TLS/SSL, or IPSec?

$\endgroup$
  • 1
    $\begingroup$ No, because the protocol is not secure against replay attacks.. In general, this is much closer to Kerberos (secure and state-of-the-art) or Needham-Schroeder (not secure either) than DH key exchange, which does not rely on a trusted server. (Note DH alone is also not secure, you need an authenticated variant). $\endgroup$ – tylo Nov 29 '16 at 16:44
  • $\begingroup$ @tylo Brilliant comment, you could almost say it's an answer; actually, I'd go one step further and make it one. $\endgroup$ – Maarten Bodewes Nov 30 '16 at 14:34
  • $\begingroup$ @MaartenBodewes Done. Although it doesn't adress the stated questions directly. $\endgroup$ – tylo Nov 30 '16 at 15:12
  • $\begingroup$ @tylo Well, it is better than no answer, it explains why there may be few - if any - protocols using it and at least it won't get out of date any time soon. Seems fine to me :) $\endgroup$ – Maarten Bodewes Nov 30 '16 at 15:22
1
$\begingroup$

No, because the protocol is not secure against replay attacks.

In general, this is much closer to Kerberos (secure and state-of-the-art) or Needham-Schroeder (not secure either) than Diffie-Hellman key exchange, which does not rely on a trusted server. (Note DH alone is also not secure, you need an authenticated variant).

That is probably the reason why you didn't find that much information on the protocol, why there are no common standard references and why it isn't used in cryptographic standards. In any case, Kerberos provides the same functionality with better security properties and it is already widely used.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.