1) A->B  A||B||{Na}Kab
2) B->A  {Na+1,Nb}Kab
3) A->B  {Nb+1}Kab
4) B->A  {K'ab,N'b}Kab

This protocol is used to refresh a symmetric session key.


A and B are the IDs of users A and B. Na, Nb, N'b are nonces (pseudorandom values). Kab is the old session key. K'ab is the new session key. || means concatenation.

An attacker is only able to do man-in-the-middle. Every message is encrypted with Kab

  • $\begingroup$ First, you might want to explain your notation, because it's not clear. And then explain the initial settings (e.g. who knows what) and what kind of attacker model you have in mind. $\endgroup$ – tylo Jan 16 '17 at 10:38
  • $\begingroup$ Are messages 2 and 3 encrypted somehow? $\endgroup$ – mikeazo Jan 16 '17 at 12:08
  • 1
    $\begingroup$ The protocol is effectively the same as this one-step protocol: $1) B\rightarrow A : \{K'_{ab}\}_{K_{ab}}$. The exchange of nonces doesn't do anything. $\endgroup$ – tylo Jan 16 '17 at 12:56
  • $\begingroup$ @mikeazo I forgot the encryption on messages 2 and 3. Sorry. $\endgroup$ – Manu Jan 16 '17 at 13:43

One weakness with this protocol is that the compromise of a past symmetric key, which can often be assumed over some sufficiently large period of time, compromises all keys and messages sent after the time that key was first used.


If any $K_{ab}$ is compromised, a man in the middle attacker can resend message 4 corresponding to the compromised $K_{ab}$ and it will be accepted by $A$. The attacker can then impersonate $B$ communicating using the compromised key.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.