1) A->B  A||B||{Na}Kab
2) B->A  {Na+1,Nb}Kab
3) A->B  {Nb+1}Kab
4) B->A  {K'ab,N'b}Kab

This protocol is used to refresh a symmetric session key.


A and B are the IDs of users A and B. Na, Nb, N'b are nonces (pseudorandom values). Kab is the old session key. K'ab is the new session key. || means concatenation.

An attacker is only able to do man-in-the-middle. Every message is encrypted with Kab


closed as off-topic by fkraiem, tylo, Biv, yyyyyyy, Maarten Bodewes Jan 17 '17 at 0:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ First, you might want to explain your notation, because it's not clear. And then explain the initial settings (e.g. who knows what) and what kind of attacker model you have in mind. $\endgroup$ – tylo Jan 16 '17 at 10:38
  • $\begingroup$ Are messages 2 and 3 encrypted somehow? $\endgroup$ – mikeazo Jan 16 '17 at 12:08
  • 1
    $\begingroup$ The protocol is effectively the same as this one-step protocol: $1) B\rightarrow A : \{K'_{ab}\}_{K_{ab}}$. The exchange of nonces doesn't do anything. $\endgroup$ – tylo Jan 16 '17 at 12:56
  • $\begingroup$ @mikeazo I forgot the encryption on messages 2 and 3. Sorry. $\endgroup$ – Manu Jan 16 '17 at 13:43

One weakness with this protocol is that the compromise of a past symmetric key, which can often be assumed over some sufficiently large period of time, compromises all keys and messages sent after the time that key was first used.


If any $K_{ab}$ is compromised, a man in the middle attacker can resend message 4 corresponding to the compromised $K_{ab}$ and it will be accepted by $A$. The attacker can then impersonate $B$ communicating using the compromised key.


Not the answer you're looking for? Browse other questions tagged or ask your own question.