I did read some articles about the protocol but couldn't figure out what would happen. Would the two parties be unable to verify each other? Or would it be something else?

based on the international standard ISO/IEC 9798-2.


The three-pass authentication protocol defined in ISO/IEC 9798-2 at 5.2.2. and it is defined as follows;

  1. $\text{B}$ generated random $R_B$ and sends to $\text{A}$; $$\text{B}\xrightarrow{R_B\|\text{Text1}}\text{A}$$
  2. $\text{A}$ generated random $R_A$ and sends to $\text{B}$; $$\text{B} \xleftarrow{\text{TokenAB}\;=\;\text{Text3}\|eK_{AB}(R_A\|R_B\|B\|\text{Text2})} \text{A}$$
  3. $\text{B}$ generated random $R_A$ and sends to $\text{A}$; $$\text{B}\xrightarrow{\text{TokenBA}\;=\; \text{Text5}\|eK_{AB}(R_B\|R_A\|\text{Text4})} \text{A}$$
    $eK_{AB}$ is the encryption with the $K_{AB}$;

What would happen if the last message in a three-pass authentication protocol was undelivered?

Whoever started the protocol, $\text{A}$ connects to $\text{B}$ by $\text{tokenAB}$.

  • If $\text{B}$ started then $\text{B}$ can send back the $\text{tokenBA}$ to $\text{A}$ for the agreement.
  • If $\text{B}$ doesn't send back the $\text{tokenBA}$, $\text{A}$ cannot decide it was actually $\text{B}$ or not. Since, anyone can send an $R_B\|\text{Text1}$ to $\text{A}$.

Old answer if the question was the Three-pass protocol of Shamir

It not verification of each other it is just message exchange.

From Wikipedia;

In order for the encryption function and decryption function to be suitable for the three-pass protocol they must have the property that for any message $m$, any encryption key $e$ with corresponding decryption key $d$ and any independent encryption key $k$, $$D(d,E(k,E(e,m))) = E(k,m)$$


$$D(d,E(k,E(e,m))) = D(d,E(e,E(k,m))) = E(k,m).$$

If the third, i.e. the last, is not delivered, the messaged won't be decrypted. He will have $E(k,E(e,m)))$ in his hand, but he cannot decrypt this because he doesn't know the key $d$ of the sender.

The receiver can use the Commutativity property to reach $E(e,E(k,m))$ but this won't help,too

| improve this answer | |
  • $\begingroup$ does it also apply on the international standard ISO/IEC 9798-2? $\endgroup$ – user658961 Nov 10 '18 at 23:41
  • $\begingroup$ Ok, I wish you added this info onto question already. In the first act from the document, actually, anybody can challenge A. However, whoever started the protocol, A connects to B by tokenAB. If B started then can send back TokenBA for the agreement, if B doesn't send back A cannot decide it was actually B or not. I'll write a bigger answer, tomorrow. $\endgroup$ – kelalaka Nov 11 '18 at 0:15
  • $\begingroup$ I thought the protocol would be the same in wikipedia and in the international standards. $\endgroup$ – user658961 Nov 11 '18 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.