Suppose $R$ is a random challenge sent in the clear from Alice to Bob and $K$ is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify your answers.
(i) $R\oplus K$
I believe that $R\oplus K$ is secure because it has one of the requirements of the perfect secrecy which is the key space has to have the same size as message space. As a result, $R\oplus K$ is provably secure.
On the other hand, $E(R,K)$ is a secure method to authenticate on side (sender) but it does not authenticate the other side (receiver). There is a problem which is no mutual authentication. Therefore, this is not secure.
However, I have been told that this answer is not correct. What am I missing?