4
$\begingroup$

According to Wikipedia, Otway-Ress protocol is as follow:

The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$ is a session-identifier, $N_A$ and $N_B$ are nonces):

\begin{align} A & \rightarrow B : M,A,B, \{N_A,M,A,B\}_{K_{AS}}\\ B & \rightarrow S : M,A,B, \{N_A,M,A,B\}_{K_{AS}},\{N_B,M,A,B\}_{K_{BS}}\\ S & \rightarrow B : M, \{N_A,K_{AB}\}_{K_{AS}},\{N_B,K_{AB}\}_{K_{BS}}\\ B & \rightarrow A : M, \{N_A,K_{AB}\}_{K_{AS}} \end{align}

What is the role of $M$, the session identifier, in the security of protocol?

What will happen if we remove all $M$ in the protocol? (I think there will be no flow, I don't understand the role of $M$)

Improve this question
$\endgroup$
1
  • $\begingroup$ In the article you quoted, you will find part of the answer: "In the absence of any check to prevent it, M (or perhaps M,A,B) becomes the session key between A and B and is known to the intruder." $\endgroup$ – Patriot Mar 10 '20 at 14:54
1
$\begingroup$

The $M$ in Otway-Ress protocol (It is $C$ as the Challenge in the article);

  • In mutual authentication, both parties are suspicious of each other and of the freshness of the authentication messages; therefore each must generate independent challenges in order to assure themselves of the timeliness of the interaction.
  • Its important property is that it has not previously been used to authenticate the two parties concerned.
  • This property can be guaranteed either by storing all previously used challenges, by using numbers from a monotonically increasing sequence (e.g. time) or probabilistically by generating a sufficiently large number randomly.

$M$ is used to prevent replay attacks.

Improve this answer
$\endgroup$
1
$\begingroup$

M connects the two enciphered parts of the second message so that $S$ can detect a message constructed from parts of previous messages by an intruder. Other protocols of the time used double encipherment to do the equivalent. Double encipherment required either two enciphering engines or a path for arbitrary data that bypasses the enciphering engine. This protocol was, in part, a response to a challenge to find an authentication protocol that could be used in systems where there was strong separation between plaintext and ciphertext. I do not know whether or not any attempt was ever made to follow that up.

This protocol was analysed by Burrows, Abadi and Needham in Authentication: a practical study in belief and action where they concluded that $N_A$ is redundant as $M$ is sufficient to demonstrate freshness to $A$. Note that that analysis did not reveal the flaws now known to exist in the protocol.

Removing $M$ would mean that an intruder could cause the freshness requirement to fail so that $A$ and $B$ do not end up with an agreed session key but there is no obvious way for it to lead to an intruder knowing the session key, unlike some of the currently known flaws that do show that fatal weakness.

Improve this answer
$\endgroup$
0
$\begingroup$

The role of M (session identifier or number) is to ensure message authentication and integrity. I think it helps ensure that messages during the distribution of the session key are not tampered with.

https://www.giac.org/paper/gcih/81/man-in-the-middle-attack-initiator-otway-rees-key-exchange-protocol/100561

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ How does a simple number ensure authenticity and integrity? This seems like it could be a case of replay attack protection, if it has cryptographic significance at all. $\endgroup$ – otus Apr 4 '18 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.