Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify your answers.
(i)  $R\oplus K$
(ii) $E(R,K)$

I believe that $R\oplus K$ is secure because it has one of the requirements of the perfect secrecy which is the key space has to have the same size as message space. As a result, $R\oplus K$ is provably secure.

On the other hand, $E(R,K)$ is a secure method to authenticate on side (sender) but it does not authenticate the other side (receiver). There is a problem which is no mutual authentication. Therefore, this is not secure.

However, I have been told that this answer is not correct. What am I missing?

  • 1
    $\begingroup$ Hint: do both methods allow to securely run the protocol multiple times, under the assumption that the session key is revealed after each use? $\endgroup$
    – fgrieu
    May 22, 2018 at 8:32

1 Answer 1


The first method fails completely if one of the session keys gets to be known by an adversary. The idea of session keys is that a key can become known without affecting the security of other sessions. If $K_s = K \oplus R$ is known then the master key becomes known; $K = K_s \oplus R$ after all. So all sessions are now broken.

In the second method I presume that $K_s = \text{E}_K(R)$. In other words, $K$ acts as the key and $R$ as the message to be encrypted (usually we write this as $E(K, R)$ not $E(R, K)$ ...). In that case the session keys are secure, although an authentication step is indeed missing. I'm however assuming that verification of the session keys falls outside the question domain.

If $R$ is used as a key in the second method then the same issue as for scheme 1 arises: $K = D_R(K_s)$ and the master key is known.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.