Recap: Needham–Schroeder is as follows:
- $A \rightarrow B : \{A, N_a\}_{pk_B}$
- $B \rightarrow A : \{N_a, N_b\}_{pk_A}$
- $A \rightarrow B : \{N_b\}_{pk_B}$
Then, there is a MITM attack by Lowe as follows:
- $A \rightarrow C(A) : \{A, N_a\}_{pk_C}$
- $C(A)\rightarrow B : \{A, N_a\}_{pk_B}$
- $B \rightarrow C(A) : \{N_a,N_b\}_{pk_A}$
- $C(A)\rightarrow A : \{N_a,N_b\}_{pk_A}$
- $A \rightarrow C(A) : \{N_b\}_{pk_C}$
- $C(A)\rightarrow B : \{N_b\}_{pk_B}$
Now $C(A)$ knows both $N_a$ and $N_b$, and he can compute the session key. The solution that Lowe suggests is to put $B$'s identity to the second message:
- $A \rightarrow B : \{A, N_a\}_{pk_B}$
- $B \rightarrow A : \{N_a, N_b, B\}_{pk_A}$
- $A \rightarrow B : \{N_b\}_{pk_B}$
But what happens if we put B's identity into the first message?
- $A \rightarrow B : \{A, B, N_a\}_{pk_B}$
- $B \rightarrow A : \{N_a, N_b\}_{pk_A}$
- $A \rightarrow B : \{N_b\}_{pk_B}$
Is it still vulnerable to MITM attack or is it secure too?