# Is the first Nonce exchange between Alice and Bob in Needham-Schroder key exchange protocol redundant?

For the Needham-Schroder protocol, assuming Alice and Bob are both able to guarantee each other's public keys (e.g. through a Certificate authority), the protocol is

1) A sends to B: $$E_{publicB} [N_1 \mathbin\| ID_A]$$

2) B sends to A: $$E_{publicA} [N_1 \mathbin\| N_2]$$

3) A sends to B: $$E_{publicB} [N_2 \mathbin\| K]$$

Is it wrong to say step 1 is redundant because only B has the private keys $$E_{privateB}$$ anyways? For example, is this protocol any less safe?

1) A sends to B: $$Plaintext:$$ "I give keys pls"

2) B sends to A: $$E_{publicA} [N_2]$$

3) A sends to B: $$E_{publicB} [N_2 \mathbin\| K]$$

Step 2 is required for B to verify A is who he says he is (because only A can decrypt 2 and reply with the same nonce but A's authentication of B will also be conducted in step 3 because only B will be able to decrypt the message and get the keys.

Am I missing a potential attack here?

• Not that I can see... – Legorooj Dec 14 '19 at 3:12
• So I guess its one of those things where it is the way it is just out of convention / habit? – ackbar03 Dec 14 '19 at 4:03
• maybe - there'll be a reason it's done that way, but it could just be convention/habit. Wait a bit and see if anyone else has info on this topic. – Legorooj Dec 14 '19 at 4:11