2
$\begingroup$

The original Station-To-Station (STS) protocol is as following:

  1. Alice : Generate $x$
  2. Alice → Bob : $g^x$
  3. Bob : Generate $y$, compute $g^y$
  4. Bob : Compute $K = (g^x)^y$
  5. Bob : Sign-then-Encrypt $(g^y, g^x)$ to obtain $E_K(S_B(g^y, g^x))$
  6. Bob → Alice : $g^y$, $E_K(S_B(g^y, g^x))$
  7. Alice : Compute $K = (g^y)^x$
  8. Alice : Decrypt $E_K(S_B(g^y, g^x))$ using $K$ to obtain $S_B(g^y, g^x))$
  9. Alice : Verify $(g^y, g^x)$, $S_B(g^y, g^x))$ using Bob's public key for signature.
  10. Alice : Sign-then-Encrypt $(g^x, g^y)$ to obtain $E_K(S_A(g^x, g^y))$
  11. Alice → Bob : $E_K(S_A(g^x, g^y))$
  12. Bob : Decrypt $E_K(S_A(g^x, g^y))$ using $K$ to obtain $S_A(g^x, g^y))$
  13. Bob : Verify $(g^x, g^y)$, $S_A(g^x, g^y))$ using Alice's public key for signature.

In this paper Authentication and Authenticated Key Exchanges, it mentioned that

enter image description here

Here is my thought about a symmetric version:

  1. Alice : Generate $x$
  2. Bob : Generate $y$
  3. Alice → Bob : $g^x$
  4. Bob → Alice : $g^y$
  5. Alice : Compute $K = (g^y)^x$ and $E_K(S_B(g^y, g^x))$
  6. Bob : Compute $K = (g^x)^y$ and $E_K(S_B(g^y, g^x))$
  7. Alice → Bob : $E_K(S_A(g^x, g^y))$
  8. Bob → Alice : $E_K(S_B(g^y, g^x))$
  9. Alice : Decrypt-then-verify
  10. Bob : Decrypt-then-verify

In fact, I got this thought first, but I am not sure if it is secure as the original STS protocol. So I try to find a reference online. However, I didn't obtain a confirmation.

Does this symmetric (in the execution of the protocol by the two parties) version have problems?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.