Role of session identifier in Otway-Rees protocol

Question

According to Wikipedia, Otway-Ress protocol is as follow:

The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$ is a session-identifier, $N_A$ and $N_B$ are nonces):

\begin{align} A & \rightarrow B : M,A,B, \{N_A,M,A,B\}_{K_{AS}}\\ B & \rightarrow S : M,A,B, \{N_A,M,A,B\}_{K_{AS}},\{N_B,M,A,B\}_{K_{BS}}\\ S & \rightarrow B : M, \{N_A,K_{AB}\}_{K_{AS}},\{N_B,K_{AB}\}_{K_{BS}}\\ B & \rightarrow A : M, \{N_A,K_{AB}\}_{K_{AS}} \end{align}

What is the role of $M$, the session identifier, in the security of protocol?

What will happen if we remove all $M$ in the protocol? (I think there will be no flow, I don't understand the role of $M$)

Answer 1

The $M$ in Otway-Ress protocol (It is $C$ as the Challenge in the article);

• In mutual authentication, both parties are suspicious of each other and of the freshness of the authentication messages; therefore each must generate independent challenges in order to assure themselves of the timeliness of the interaction.
• Its important property is that it has not previously been used to authenticate the two parties concerned.
• This property can be guaranteed either by storing all previously used challenges, by using numbers from a monotonically increasing sequence (e.g. time) or probabilistically by generating a sufficiently large number randomly.

$M$ is used to prevent replay attacks.

Answer 2

M connects the two enciphered parts of the second message so that $S$ can detect a message constructed from parts of previous messages by an intruder. Other protocols of the time used double encipherment to do the equivalent. Double encipherment required either two enciphering engines or a path for arbitrary data that bypasses the enciphering engine. This protocol was, in part, a response to a challenge to find an authentication protocol that could be used in systems where there was strong separation between plaintext and ciphertext. I do not know whether or not any attempt was ever made to follow that up.

This protocol was analysed by Burrows, Abadi and Needham in Authentication: a practical study in belief and action where they concluded that $N_A$ is redundant as $M$ is sufficient to demonstrate freshness to $A$. Note that that analysis did not reveal the flaws now known to exist in the protocol.

Removing $M$ would mean that an intruder could cause the freshness requirement to fail so that $A$ and $B$ do not end up with an agreed session key but there is no obvious way for it to lead to an intruder knowing the session key, unlike some of the currently known flaws that do show that fatal weakness.

Answer 3

The role of M (session identifier or number) is to ensure message authentication and integrity. I think it helps ensure that messages during the distribution of the session key are not tampered with.

https://www.giac.org/paper/gcih/81/man-in-the-middle-attack-initiator-otway-rees-key-exchange-protocol/100561