# shared symmetric key

Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify your answers.
(i)  $R\oplus K$
(ii) $E(R,K)$

I believe that $R\oplus K$ is secure because it has one of the requirements of the perfect secrecy which is the key space has to have the same size as message space. As a result, $R\oplus K$ is provably secure.

On the other hand, $E(R,K)$ is a secure method to authenticate on side (sender) but it does not authenticate the other side (receiver). There is a problem which is no mutual authentication. Therefore, this is not secure.

However, I have been told that this answer is not correct. What am I missing?

• Hint: do both methods allow to securely run the protocol multiple times, under the assumption that the session key is revealed after each use? – fgrieu May 22 '18 at 8:32

The first method fails completely if one of the session keys gets to be known by an adversary. The idea of session keys is that a key can become known without affecting the security of other sessions. If $K_s = K \oplus R$ is known then the master key becomes known; $K = K_s \oplus R$ after all. So all sessions are now broken.
In the second method I presume that $K_s = \text{E}_K(R)$. In other words, $K$ acts as the key and $R$ as the message to be encrypted (usually we write this as $E(K, R)$ not $E(R, K)$ ...). In that case the session keys are secure, although an authentication step is indeed missing. I'm however assuming that verification of the session keys falls outside the question domain.
If $R$ is used as a key in the second method then the same issue as for scheme 1 arises: $K = D_R(K_s)$ and the master key is known.