For the Needham-Schroder protocol, assuming Alice and Bob are both able to guarantee each other's public keys (e.g. through a Certificate authority), the protocol is

1) A sends to B: $E_{publicB} [N_1 \mathbin\| ID_A]$

2) B sends to A: $E_{publicA} [N_1 \mathbin\| N_2]$

3) A sends to B: $E_{publicB} [N_2 \mathbin\| K]$

Is it wrong to say step 1 is redundant because only B has the private keys $E_{privateB}$ anyways? For example, is this protocol any less safe?

1) A sends to B: $Plaintext: $ "I give keys pls"

2) B sends to A: $E_{publicA} [N_2]$

3) A sends to B: $E_{publicB} [N_2 \mathbin\| K]$

Step 2 is required for B to verify A is who he says he is (because only A can decrypt 2 and reply with the same nonce but A's authentication of B will also be conducted in step 3 because only B will be able to decrypt the message and get the keys.

Am I missing a potential attack here?

  • $\begingroup$ Not that I can see... $\endgroup$ – Legorooj Dec 14 '19 at 3:12
  • $\begingroup$ So I guess its one of those things where it is the way it is just out of convention / habit? $\endgroup$ – ackbar03 Dec 14 '19 at 4:03
  • $\begingroup$ maybe - there'll be a reason it's done that way, but it could just be convention/habit. Wait a bit and see if anyone else has info on this topic. $\endgroup$ – Legorooj Dec 14 '19 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.