# Security of the Needham-Schroeder public key protocol after a minor adjustment

I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer:

We have the Needham Schroeder Public Key Protocol:

$$1. A \rightarrow B: \{N_A, A\}_{pk(B)} \\ 2. B \rightarrow A: \{N_A, N_B\}_{pk(A)} \\ 3. A \rightarrow B: \{N_B\}_{pk(B)}$$

The question asks for an attack on this protocol. Like for the original NSPK I think the weakness is a man-in-the-middle attack (where $$I_A$$ stands for $$I$$ impostering as $$A$$ on the network:

$$1. A \rightarrow I: \{N_A, A\}_{pk(I)} \\ \hspace{225px} 1'. I_A \rightarrow B: \{N_A, A\}_{pk(B)} \\ \hspace{225px} 2'. B \rightarrow I_A: \{N_A, N_B\}_{pk(A)} \\ 2. I \rightarrow A: \{N_A, N_B\}_{pk(A)} \\ 3. A \rightarrow I: \{N_B\}_{pk(I)} \\ \hspace{225px} 3'. I_A \rightarrow B: \{N_B\}_{pk(B)} \\$$

Which uses $$A$$ as a decryption agent to authenticate $$I_A$$ with $$B$$ despite it not being $$A$$'s intention to do so.

Now the question then asks about the modification of line 3 in the given protocol, i.e. changing the line: $$3. A \rightarrow B: \{N_B\}_{pk(B)}$$ into $$3. A \rightarrow B: h(N_B, A, B)$$ for a cryptographic hash function $$h$$.

The original man-in-the-middle attack doesn't seem to work from what I can see under this modification.

It then goes on to ask me whether this new method is secure on not, i.e. does any attacks exist on this new protocol? I have thus far noticed reflection and man-in-the-middle attacks will fail on this new protocol.

I'm wondering if there exist any attacks or else what would be a way to show its security? (Gut feeling says there should exist an attack as it may be very difficult to show it is completely secure.)

• I don't see why changing to hash rectifies the problem. If in step 3 $A$ sends to $I$ the hash value, the in step 3' $I$ can pass it to $B$ without any problem and still $A,B$ cannot possibly detect there is a man in the middle. – Changyu Dong Jan 14 '19 at 11:18
• @ChangyuDong I think $A$ would send $I$ the string $h(N_B, A, I)$ then, and $B$ would then be able to tell as he would expect $h(N_B, A, B)$? – CowNorris Jan 14 '19 at 17:22
• Then in the third step of your attack, $A$ should send $\{N_B\}_{pk_I}$ instead of $\{N_B\}_{pk_B}$. – Changyu Dong Jan 15 '19 at 10:36
• @ChangyuDong Ah, sorry, my bad. I've corrected my attack now - though I'm still unsure about the security of the protocol after the modification the question suggests. – CowNorris Jan 15 '19 at 12:30