Security of a 3-party key exchange protocol

I am trying to find attacks on a theoretical protocol or prove its security. An initiator wants to establish a shared key with a responder with help of a trusted server.

We have the following roles: $I$: Initiator, $R$: Responder, $S$: Server.

There are long-term symmetric keys between all pairs of involved entities denoted by $k(X,Y)$.

The protocol involves some nonces:

• $\mathrm{sid}$ and $n_I$ are generated by $I$.
• $n_R$ is generated by $R$.
• A session key $\mathrm{sesskey}$ is generated by $S$ at every execution.

The message $m$ encrypted with the key $k(X,Y)$ is written as $\{m\}_{k(X,Y)}$.

Goal: The key $\mathrm{sesskey}$ should be secretly shared between $I$ and $R$. $S$ is trusted, and is also allowed to know $\mathrm{sesskey}$.

Protocol: $$\begin{array}{rcl} 1. & I \to S : & \mathrm{sid}, \: I, \: \{n_I, \mathrm{sid}, I, R, S\}_{k(I,S)} \\ 2. & I \to R : & \mathrm{sid}, \: I \vphantom{\{\}_{k()}} \\ 3. & R \to S : & \mathrm{sid}, \: R, \: \{n_R, \mathrm{sid}, S, I, R\}_{k(I,R)} \\ 4. & S \to R : & \mathrm{sid}, \: \{n_R, \mathrm{sesskey}\}_{k(R,S)} \\ 5. & S \to I : & \mathrm{sid}, \: \{n_I, \mathrm{sesskey}\}_{k(I,S)} \\ \end{array}$$

Now what I have found so far is that if we assume $\mathrm{len}(\mathrm{sid},I,R,S) = \mathrm{len}(\mathrm{sesskey})$ then we can easily break the protocol with a type-flaw attack as follows. Impersonate $S$ and send $\mathrm{sid}, \{n_R, \mathrm{sid}, S, I, R\}_{k(I,R)}$ to $R$ in step 4, and $\mathrm{sid}, \{n_I, \mathrm{sid}, I, R, S\}_{k(I,S)}$ to $I$ in step 5. We thereby construct two session keys $(\mathrm{sid}, S, I, R)$ and $(\mathrm{sid}, I, R, S)$ for $R$ and $I$. We can thereafter intercept and forward (encrypting with one and decrypting with the other key) all communication between $I$ and $R$.

However, I find this unsatisfactory because we impose assumptions on the length of $\mathrm{sid}$, the names and the session key. It is not leaving my mind, but I cannot find any other attack. Can you prove the security of this protocol or do you see a different possible attack?

migrated from security.stackexchange.comJul 28 '13 at 18:45

This question came from our site for information security professionals.

• Is this homework? – Lucas Kauffman Jul 25 '13 at 16:24
• @Lucas Kauffman: It is an exam question. I was not sure whether it is welcome here, but could not find an entry in the faq saying it wasn't. Since I think it is an interesting question I hope it is still appreciated. – Format.. Jul 25 '13 at 16:33
• do you really want k(I,R) in step 3? Or k(R, S)? – CodesInChaos Jul 28 '13 at 19:34
• What properties does your encryption provide? Is it authenticated encryption? Is it malleable? What about proper IVs? – CodesInChaos Jul 28 '13 at 19:38
• @CodesInChaos Normally in this kind of formal analysis of crypto protocol, the encryption is considered as a magic enveloppe. If you instantiate it with real-life crypto, you should use authenticated encryption. I agree with your $k(R,S)$ comment in step 3. I think that the expected problem with this protocol is that an attacker that intercepts and replays messages can dupe $S$ into believing that $R$ is the initiator and $I$ the responder. – minar Jul 28 '13 at 19:55