Why is the following authentication service not secure?

C⟶S: $I_C$

S⟶C: $N$

C⟶S: $E(K_{C,A}, N)$

S⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$

A⟶S: $E(K_{S,A}, N)$


  • C = client
  • S = server
  • A = authentication service
  • $I_X$ = identification string of entity X
  • $N$ is nonce
  • $E(K, M)$ is the encryption operation using key $K$ and message $M$
  • $K_{X,Y}$ = symmetric key shared by X and Y
  • 1
    $\begingroup$ What is the operation denoted by Key(message)? Encryption? MAC? $\endgroup$ – Maeher Apr 25 '18 at 20:06
  • $\begingroup$ This protocol is vulnerable to replay attack. $\endgroup$ – Meysam Ghahramani Apr 25 '18 at 20:25
  • $\begingroup$ This is clearly an assignment, what have you tried? Where are you stuck? $\endgroup$ – Maarten Bodewes Apr 25 '18 at 20:38
  • 1
    $\begingroup$ @MeysamGhahramani That's an answer, not a comment. We expect answers to be substantiated. It's nice to see that you seem to know the answer, but like this it is not useful to anybody. There seems to be a nonce, so some reason why this doesn't protect the protocol from replay attack is needed here. $\endgroup$ – Maarten Bodewes Apr 25 '18 at 20:40
  • $\begingroup$ @Maeher it's an encryption operation. $\endgroup$ – rokmiefran Apr 25 '18 at 20:53

Suppose that the client and server were once connected by random number $N$, and adversary is eavesdropped these messages. So he has $I_C$, $N$, $E(K_{C,A}, N)$, $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$ and $E(K_{S,A}, N)$. Now in the new session, the adversary can easily impersonate the identity of the server. To do so, just follow the steps below:

C⟶Adversary: $I_C$

Adversary⟶C: $N$

C⟶Adversary: $E(K_{C,A}, N)$

Adversary⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$

A⟶Adversary: $E(K_{S,A}, N)$

Note that in this protocol, the server can use $E(K_{S,A}, N)$ to verify client identity, but the client does not have any information about the identity of the server.

Edit: Also, an adversary cannot impersonate the client using $E(K_{C,A},N)$ because $N$ is generated by a valid server and will change in each session. Therefore, an adversary cannot find the valid $E(K_{C,A},N)$ using previous eavesdropped messages. To prevent this attack, you can modify the protocol as follows:

C⟶S: $I_C$

S⟶C: $N$

C⟶S: $E(K_{C,A}, N, M)$

S⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N, M)\})$

A⟶S: $E(K_{S,A}, N, E(K_{C,A}, M))$

S⟶C: $E(K_{C,A}, M)$

However, this is just a change, and the resistance of this protocol to other attacks should be investigated. "Cryptographic Protocol: Security Analysis Based on Trusted Freshness" By Ling Dong and Kefei Chen, is a valuable book on protocols that you can refer to for more information.

  • $\begingroup$ what kind of change would you propose to solve the problem? $\endgroup$ – rokmiefran Apr 26 '18 at 9:01
  • $\begingroup$ an adversary could also impers the client using E(KC,A,N)? $\endgroup$ – rokmiefran Apr 26 '18 at 9:03
  • $\begingroup$ is there a possibility of an MITM attack? the adversary intercept E(KC,A,N) and send it to the server pretending to be the client $\endgroup$ – rokmiefran Apr 26 '18 at 10:44
  • $\begingroup$ @rokmiefran, This is possible for all protocols but not as an attack. Because the attacker acts as a communication channel that delivers only the sender's message to the recipient and does not receive any information. $\endgroup$ – Meysam Ghahramani Apr 26 '18 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.