# Why is this authentication protocol with a nonce and tree parties not secure?

Why is the following authentication service not secure?

C⟶S: $I_C$

S⟶C: $N$

C⟶S: $E(K_{C,A}, N)$

S⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$

A⟶S: $E(K_{S,A}, N)$

where:

• C = client
• S = server
• A = authentication service
• $I_X$ = identification string of entity X
• $N$ is nonce
• $E(K, M)$ is the encryption operation using key $K$ and message $M$
• $K_{X,Y}$ = symmetric key shared by X and Y
• What is the operation denoted by Key(message)? Encryption? MAC? – Maeher Apr 25 '18 at 20:06
• This protocol is vulnerable to replay attack. – Meysam Ghahramani Apr 25 '18 at 20:25
• This is clearly an assignment, what have you tried? Where are you stuck? – Maarten Bodewes Apr 25 '18 at 20:38
• @MeysamGhahramani That's an answer, not a comment. We expect answers to be substantiated. It's nice to see that you seem to know the answer, but like this it is not useful to anybody. There seems to be a nonce, so some reason why this doesn't protect the protocol from replay attack is needed here. – Maarten Bodewes Apr 25 '18 at 20:40
• @Maeher it's an encryption operation. – rokmiefran Apr 25 '18 at 20:53

## 1 Answer

Suppose that the client and server were once connected by random number $N$, and adversary is eavesdropped these messages. So he has $I_C$, $N$, $E(K_{C,A}, N)$, $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$ and $E(K_{S,A}, N)$. Now in the new session, the adversary can easily impersonate the identity of the server. To do so, just follow the steps below:

C⟶Adversary: $I_C$

Adversary⟶C: $N$

C⟶Adversary: $E(K_{C,A}, N)$

Adversary⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$

A⟶Adversary: $E(K_{S,A}, N)$

Note that in this protocol, the server can use $E(K_{S,A}, N)$ to verify client identity, but the client does not have any information about the identity of the server.

Edit: Also, an adversary cannot impersonate the client using $E(K_{C,A},N)$ because $N$ is generated by a valid server and will change in each session. Therefore, an adversary cannot find the valid $E(K_{C,A},N)$ using previous eavesdropped messages. To prevent this attack, you can modify the protocol as follows:

C⟶S: $I_C$

S⟶C: $N$

C⟶S: $E(K_{C,A}, N, M)$

S⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N, M)\})$

A⟶S: $E(K_{S,A}, N, E(K_{C,A}, M))$

S⟶C: $E(K_{C,A}, M)$

However, this is just a change, and the resistance of this protocol to other attacks should be investigated. "Cryptographic Protocol: Security Analysis Based on Trusted Freshness" By Ling Dong and Kefei Chen, is a valuable book on protocols that you can refer to for more information.

• what kind of change would you propose to solve the problem? – rokmiefran Apr 26 '18 at 9:01
• an adversary could also impers the client using E(KC,A,N)? – rokmiefran Apr 26 '18 at 9:03
• is there a possibility of an MITM attack? the adversary intercept E(KC,A,N) and send it to the server pretending to be the client – rokmiefran Apr 26 '18 at 10:44
• @rokmiefran, This is possible for all protocols but not as an attack. Because the attacker acts as a communication channel that delivers only the sender's message to the recipient and does not receive any information. – Meysam Ghahramani Apr 26 '18 at 11:20