Can a nonce be completely random on (simplified) Needham–Schroeder Protocol?

Question

From what I've read so far, nonces are random one-time values, which are sent in plaintext in addition to the ciphertext to verify identity of sender/receiver. Theoretically, if the nonce is random, an attacker E can intercept Alice's message which was designated to Bob, and impersonate as Bob by generating a random nonce, without ever communicating with Bob.

So if the request-response protocol is:

A → B : n_A

B → A : {n_A, n_B}_K

A → B : n_B

with nA,nB being the nonces and K being a symmetric shared key between Alice and Bob.

1. Can the attacker do a reflect attack back at Alice by just changing the nonce? This way A is fooled by thinking B is initiating communication with A and then she would share both their nonces encrypted with the key,
   in this case(modifying the 2nd line of the protocol):

B → A : {n_A, n_E}_K

leading to a known-plaintext attack. The attacker has knowledge of both the plaintext and ciphertext in this scenario, so he can derive the secret key.

2. Can this flaw in the protocol be fixed by:

• applying k to the nonces?
• including identifier of B (receiver) in the second ciphertext?

Fix Proposal

A → B : {n_A}_k

B → A : {B, n_A}_k

A → B : {n_B}_k

Answer 1

leading to a known-plaintext attack. The attacker has knowledge of both the plaintext and ciphertext in this scenario, so he can derive the secret key.

This is not feasible for any modern cipher design. Ciphers are designed so that even if the attacker has access to vast amounts of matched plaintext and ciphertext then the key is still infeasible to recover.

There is a reflection attack on your protocol if Alice allows sessions with Bob where she is both sender and receiver to be interleaved and uses the same key for both. It goes as follows:

• Session 1: Alice generates and sends $n_A$ to Bob, but it is intercepted by Mallory
• Session 2: Mallory reflects $n_A$ back to Alice pretending to be Bob
• Session 2: Alice generates $n_B$ and sends $(n_A,n_B)_K$ to Bob, but it is intercepted by Mallory
• Session 1: Mallory reflects $(n_A,n_B)_K$ back to Alice
• Session 1: Alice decrypts $(n_A,n_B)_K$ and checks that the value of $n_A$ is the one she sent at the start of session 1. If so she sends $n_B$ to Bob, but it is intercepted by Mallory.
• Session 2: Mallory reflects $n_B$ back to Alice.

In session 2, Alice receives back the $n_B$ value that she anticipates and in both sessions the protocol leads her to believe that she is communicating with Bob. This attack is not blocked by encrypting the initial nonce.