# Role of session identifier in Otway-Rees protocol

According to Wikipedia, Otway-Ress protocol is as follow:

The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $$S$$ ($$M$$ is a session-identifier, $$N_A$$ and $$N_B$$ are nonces):

\begin{align} A & \rightarrow B : M,A,B, \{N_A,M,A,B\}_{K_{AS}}\\ B & \rightarrow S : M,A,B, \{N_A,M,A,B\}_{K_{AS}},\{N_B,M,A,B\}_{K_{BS}}\\ S & \rightarrow B : M, \{N_A,K_{AB}\}_{K_{AS}},\{N_B,K_{AB}\}_{K_{BS}}\\ B & \rightarrow A : M, \{N_A,K_{AB}\}_{K_{AS}} \end{align}

What is the role of $$M$$, the session identifier, in the security of protocol?

What will happen if we remove all $$M$$ in the protocol? (I think there will be no flow, I don't understand the role of $$M$$)

The $$M$$ in Otway-Ress protocol (It is $$C$$ as the Challenge in the article);

• In mutual authentication, both parties are suspicious of each other and of the freshness of the authentication messages; therefore each must generate independent challenges in order to assure themselves of the timeliness of the interaction.
• Its important property is that it has not previously been used to authenticate the two parties concerned.
• This property can be guaranteed either by storing all previously used challenges, by using numbers from a monotonically increasing sequence (e.g. time) or probabilistically by generating a sufficiently large number randomly.

$$M$$ is used to prevent replay attacks.

The role of M (session identifier or number) is to ensure message authentication and integrity. I think it helps ensure that messages during the distribution of the session key are not tampered with.

https://www.giac.org/paper/gcih/81/man-in-the-middle-attack-initiator-otway-rees-key-exchange-protocol/100561

• How does a simple number ensure authenticity and integrity? This seems like it could be a case of replay attack protection, if it has cryptographic significance at all. – otus Apr 4 '18 at 4:39