I'm having difficulties understanding exactly what this protocol means:

$S \to D : \{N_S , S\}K_D$

$D \to S : \{N_S , N_D \}K_S$

$S \to D : \{N_D \}K_D$

"where $S$ represents the supervisor’s console and $D$ represents the door controller and the other symbols have their usual security protocol meanings."

I understand $N$ to be a nonce, a randomly generated number/hash that will only be used once.

I'm assuming $K$ is the public key?

Could someone explain this protocol for me, I’ve looked everywhere and cannot find anything like this.


3 Answers 3


It seems like an authentication protocol. In the first message, $S$ identifies herself. In the 2nd message $D$ proves knowledge of her private key (otherwise she could not return $N_s$. In the third message, $S$ proves knowledge of her private key.

You asked in a comment about replay attacks. There are two possibilities, the attacker is impersonating $S$ or $D$.

For $S$, the attacker might replay a captured 1st message. $D$ would see it, decrypt, return $N_S$ with a randomly generated $N_D$. The attacker could not possibly know what $N_D$ is and could not send the last message.

For impersonating $D$, $S$ would send the first message, but the attacker couldn't decrypt it and therefore could not send the 2nd message.

So, it seems the protocol is secure against replay attacks.

  • $\begingroup$ But if there are two different doors $D_1$, $D_2$, then one of the doors is able to impersonate the supervisor to the other door. $\endgroup$ Commented Dec 14, 2012 at 13:30

Under the assumption that $K_X$ represents $X$'s public key, this is the three-message version of the Needham-Schroeder public-key protocol. Many mutual authentication protocols derive from this design.

Wikipedia has the seven-message version of the protocol. The essential difference between that version and the three-message version is that the seven-message version explicitly includes the certificate exchanges for the public keys. The three-message version simply assumes that the correct public keys are known.

The protocol was proven secure using a formalism called BAN logic, which is hardly used nowadays. Almost 20 years after the protocol was proposed it was shown that it is vulnerable to a man-in-the-middle attack if the adversary has his own public/private key pair, see this paper by Gavin Lowe.


This looks like a symmetric-key protocol: $S$ first sends a nonce $N_S$ along with its name encrypted under the key $K_D$. Then $D$ responds with an encryption of $N_S$ along with another nonce $N_D$, this time encrypted under $K_S$. Finally $S$ sends $N_D$ to $D$, this time encrypted under $K_D$.

  • $\begingroup$ Is it possible for a message to be retransmitted from an attacker? $\endgroup$ Commented Dec 14, 2012 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.