My questions is general, but in my case regards the Kerberos protocol and the communication between the client first message and the KDC.

Is there some problem in encrypting using a: (secret key XOR public nonce), instead of the reply that only use the secret client key?

That is - the key is known only to the user, but the nonce was sent public and is known to all.

Now, the reply would be encrypted using the XOR of them both.

Is there a way to manipulate this situation, maybe to use a XOR of nonce^(-1) or to send a "bad" nonce (which is good for the attacker) in order to decrypt the reply from the KDC in order to get the ticket of another user? I have a feeling that there might be something wrong here but can't think on any attack.

Thank you,


  • $\begingroup$ @Binou Thank you for the answer, but how could you get the Skey if all you receive is something encrypted with the Skey XOR nonce? You don't really know what the key is, you just see something encrypted and you know that it was generated using the (Skey XOR known nonce). What am I missing? $\endgroup$ – Oron W Jan 31 at 12:13
  • $\begingroup$ My understanding of your question was wrong, I apologize. $\endgroup$ – Binou Jan 31 at 12:15
  • $\begingroup$ @Binou No worries. thanks anyway! I have edit my question in order to better explain what I'm looking for. $\endgroup$ – Oron W Jan 31 at 12:23
  • $\begingroup$ If we assume a block cipher then I guess that related key attacks could be an issue. Those are known for e.g. AES-256, but I'm not sure if 1. this is enough of an attack surface and 2. it makes any dent big enough in the security of AES. Still the security of AES could at least be negatively influenced, which theoretically speaking would be considered a break. $\endgroup$ – Maarten Bodewes Feb 1 at 11:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.