# mutual authentication using MAC

I have the following protocol for mutual authentication ($V=$ verifier, $P =$ prover, $r_V$ and $r_P$ random values, $h_k$ a keyed hash function)

• $V\rightarrow P:r_V$
• $P\rightarrow V:r_P,h_k(r_V,r_P)$
• $V\rightarrow P:h_k(r_P,r_V)$

My question is why does the prover send back to the verifier $h_k(r_V,r_P)$? Can't he just send back $h_k(r_V)$? Or is this less secure.

(EDIT: question before edit asked about case where $r_v$ is missing from hash, that's why the answer is mostly about it:)

This would totally break security of the scheme. Assume that protocol looks like this (only change is in step 2 - missing $r_v$):

• $V\rightarrow P:r_V$
• $P\rightarrow V:r_P,h_k(r_P)$
• $V\rightarrow P:h_k(r_P,r_V)$

Let's assume that Eve sees message from step 2. She can now start another authentication session and send to $V$ the same pair $r_P,h_k(r_P)$ again and get authenticated as $P$ (in as many separated sessions as she wants).

You can prevent this by requiring that each $r_P$ can be used only once but tracking used values is way more expensive and error-prone than simply including challenge from $V$ in hash.

Please note that if you drop $r_P$ from step 3 as well and Eve sees all messages then she can pretend to be $V$ in communication with $P$ as well.

If protocol looks like:

• $V\rightarrow P:r_V$
• $P\rightarrow V:r_P,h_k(r_V)$
• $V\rightarrow P:h_k(r_P)$

then you can force $P$ to sign whatever message you want (impersonating $V$ ) or force $V$ to sign whatever you want performing man-in-the-middle attack and changing $r_P$. This can potentially lead to some replay attack if you use strong MAC or to secret key recovery if MAC is not chosen plaintext secure.

• hum... And in the first scenario (with $r_V$ in the hash function), what stops Eve from doing exactly the same thing? i.e. she intercepts ($r_P, h_k(r_V,r_P))$ and sends it to $V$. $V$ will also think he is talking to $P$ since he receives the information he expects. – tomak Jan 22 '18 at 13:29
• This shows that I haven't really understood what's going on... – tomak Jan 22 '18 at 13:29
• Even in the simpler case of unilateral identification, if we have $V\rightarrow P:r_V$ and $P\rightarrow V:h_k(r_V)$ what stops Eve from intercepting $h_k(r_v)$ and sending it to $V$. Then Eve has identified herself as $P$ to $V$ – tomak Jan 22 '18 at 13:37
• I edited the question a bit. What happens if $P$ just sends back $r_P,h_k(r_V)$. – tomak Jan 22 '18 at 13:54
• Please don't change your question after there are answers because that makes them off-topic. I've updated my answer though to address new question – Przemko Robakowski Jan 22 '18 at 17:50