Role of session identifier in Otway-Rees protocol

Question

According to Wikipedia, Otway-Ress protocol is as follow:

The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$ is a session-identifier, $N_A$ and $N_B$ are nonces):

\begin{align} A & \rightarrow B : M,A,B, \{N_A,M,A,B\}_{K_{AS}}\\ B & \rightarrow S : M,A,B, \{N_A,M,A,B\}_{K_{AS}},\{N_B,M,A,B\}_{K_{BS}}\\ S & \rightarrow B : M, \{N_A,K_{AB}\}_{K_{AS}},\{N_B,K_{AB}\}_{K_{BS}}\\ B & \rightarrow A : M, \{N_A,K_{AB}\}_{K_{AS}} \end{align}

What is the role of $M$, the session identifier, in the security of protocol?

What will happen if we remove all $M$ in the protocol? (I think there will be no flow, I don't understand the role of $M$)

Answer 1

The $M$ in Otway-Ress protocol (It is $C$ as the Challenge in the article);

• In mutual authentication, both parties are suspicious of each other and of the freshness of the authentication messages; therefore each must generate independent challenges in order to assure themselves of the timeliness of the interaction.
• Its important property is that it has not previously been used to authenticate the two parties concerned.
• This property can be guaranteed either by storing all previously used challenges, by using numbers from a monotonically increasing sequence (e.g. time) or probabilistically by generating a sufficiently large number randomly.

$M$ is used to prevent replay attacks.

Answer 2

The role of M (session identifier or number) is to ensure message authentication and integrity. I think it helps ensure that messages during the distribution of the session key are not tampered with.

https://www.giac.org/paper/gcih/81/man-in-the-middle-attack-initiator-otway-rees-key-exchange-protocol/100561