1) a = b ⊕ s1
2) b = a ⊕ s1
3) b ⊕ s2 = c
Is there a way to find s1 and s2 if we know many different values of a and c?
4) a1 = b1 ⊕ s1
5) a1 ⊕ s1 ⊕ s2 = c1
I think it is possible if we analysis the result, but I am not sure how. Or is it impossible?
Edit: Sorry , a and c should be known but not b.
Alice sends 'a' to Bob. 2) Bob computes a xor s1 = b then 3) b xor s2 = c. Bob then sends c to Alice and verify if b =c .
The way your question is written, it's hard to tell what you're asking.
The trivial answer to your original question is that, if you only know $a$ and $c$, then you can calculate $s_1 \oplus s_2 = a \oplus b$, but not the individual values $s_1$ and $s_2$; for every $s_1$, there's a corresponding $s_2$ that satisfies the equations, and vice versa. The same holds true even if you know multiple $(a,c)$ pairs calculated using the same $s_1$ and $s_2$, since each such pair will just yield the same value of $s_1 \oplus s_2$, and no other relevant information.
As for the protocol description you edited in, I have no idea what your protocol is supposed to accomplish, and I suspect you've garbled the description somehow. In particular, if Bob indeed computes both $b = a \oplus s_1$ and $c = b \oplus s_2$, and only sends $c$ back to Alice, then the value $b$ plays absolutely no role in the protocol: Bob could equivalently just compute $c = a \oplus s_1 \oplus s_2$ directly. Also, without knowing $b$, Alice cannot possibly verify that $b = c$. Bob could do that, but that's equivalent to just verifying that $s_2 = 0$, which he could just as well check without running the protocol at all. So your protocol, as written, makes no sense.
Anyway, even if the protocol was fixed to actually work, I don't see any way to build a secure authentication protocol out of just linear operations like XOR. You'd need something else, like a block cipher, to do that.
