0
$\begingroup$

The protocol works like this enter image description here

But I can't understand what's the utility of message 4 and 5, what do they protect from?
They do not protect from replay attack if Ks gets compromised because B won't be aware anyway of its freshness.
Wikipedia says that Bob sends Alice a nonce to show that he has the key, and Alice sends back a modification of it to show that she has the key too.
Isn't it obvious that she has the key if she sent it to Bob previously?
Or is it just a sort of acknowledge (which kind of surprise me because it would be the first time I see it in these protocols)

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ As far as I can tell, the graphic is wrong in message 2: $E(K_B,(K_s,ID_A))$ should also be inside the block encrypted with $K_A$. $\endgroup$
    – tylo
    Dec 31, 2019 at 11:53
  • $\begingroup$ @tylo how is that even relevant $\endgroup$
    – VariabileAleatoria
    Dec 31, 2019 at 13:50
  • $\begingroup$ You're looking at a wrong definition of the protocol. Why would that not be relevant? For cryptography it is extremely important to have precise definitions and that they are correct. Otherwise everything you build is entirely irrelevant, because any security property is void, if the requirements are not fulfilled. $\endgroup$
    – tylo
    Jan 1, 2020 at 15:05

1 Answer 1

Reset to default
0
$\begingroup$

Messages 4 and 5 are meant to protect the recipient B from a replay attack. It is a basic challenge response mechanism. Otherwise an attacker could just replay previous messages and have the very same interaction with B again. That is bad, if e.g. the message is just "increase some counter", or another message that has a lasting effect or changes a state.

This doesn't protect from a compromised Alice or if the trusted party is compromised. It only protects from an attacker controlling the network.

More explicitly: Eve has a copy of a past interaction between Alice and Bob. She has message 3, but it is encrypted and she can't extract the content. But she is able to send that same message to Bob. If Bob doesn't have a full record of every interaction in the past (and checks against all those records), he thinks it's a new one. If Eve just replays every message originally sent by Alice, Bob would have no way to detect it isn't really Alice sending those messages. Of course the interaction could be adaptive, and Bob then notices a difference, but the protocol should also work with non-adaptive messages.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thank you so much I didn't think to the scenario where an attacker wants to reuse a key without knowing it! $\endgroup$
    – VariabileAleatoria
    Dec 31, 2019 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.