The original Station-To-Station (STS) protocol is as following:

  1. Alice : Generate $x$
  2. Alice → Bob : $g^x$
  3. Bob : Generate $y$, compute $g^y$
  4. Bob : Compute $K = (g^x)^y$
  5. Bob : Sign-then-Encrypt $(g^y, g^x)$ to obtain $E_K(S_B(g^y, g^x))$
  6. Bob → Alice : $g^y$, $E_K(S_B(g^y, g^x))$
  7. Alice : Compute $K = (g^y)^x$
  8. Alice : Decrypt $E_K(S_B(g^y, g^x))$ using $K$ to obtain $S_B(g^y, g^x))$
  9. Alice : Verify $(g^y, g^x)$, $S_B(g^y, g^x))$ using Bob's public key for signature.
  10. Alice : Sign-then-Encrypt $(g^x, g^y)$ to obtain $E_K(S_A(g^x, g^y))$
  11. Alice → Bob : $E_K(S_A(g^x, g^y))$
  12. Bob : Decrypt $E_K(S_A(g^x, g^y))$ using $K$ to obtain $S_A(g^x, g^y))$
  13. Bob : Verify $(g^x, g^y)$, $S_A(g^x, g^y))$ using Alice's public key for signature.

In this paper Authentication and Authenticated Key Exchanges, it mentioned that

enter image description here

Here is my thought about a symmetric version:

  1. Alice : Generate $x$
  2. Bob : Generate $y$
  3. Alice → Bob : $g^x$
  4. Bob → Alice : $g^y$
  5. Alice : Compute $K = (g^y)^x$ and $E_K(S_B(g^y, g^x))$
  6. Bob : Compute $K = (g^x)^y$ and $E_K(S_B(g^y, g^x))$
  7. Alice → Bob : $E_K(S_A(g^x, g^y))$
  8. Bob → Alice : $E_K(S_B(g^y, g^x))$
  9. Alice : Decrypt-then-verify
  10. Bob : Decrypt-then-verify

In fact, I got this thought first, but I am not sure if it is secure as the original STS protocol. So I try to find a reference online. However, I didn't obtain a confirmation.

Does this symmetric (in the execution of the protocol by the two parties) version have problems?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.