Questions tagged [needham-schroeder]
Needham–Schroeder refers to both, a symmetric key or a public key authentication protocol.
13
questions
1
vote
0
answers
23
views
Can an attacker impersonate any party in a modified Needham-Schroeder protocol?
We are doing symmetric Needham-Schroeder protocol in university. We were provided a modified protocol and needed to answer the following questions.
Original protocol:
Modified protocol:
Task
a) An ...
- 63
1
vote
1
answer
103
views
Can a nonce be completely random on (simplified) Needham–Schroeder Protocol?
From what I've read so far, nonces are random one-time values, which are sent in plaintext in addition to the ciphertext to verify identity of sender/receiver. Theoretically, if the nonce is random, ...
- 13
0
votes
1
answer
420
views
What's the utility of the last two messages of Needham Schroeder Symmetric key protocol
The protocol works like this
But I can't understand what's the utility of message 4 and 5, what do they protect from?
They do not protect from replay attack if Ks gets compromised because B won't be ...
2
votes
0
answers
119
views
Is the first Nonce exchange between Alice and Bob in Needham-Schroder key exchange protocol redundant?
For the Needham-Schroder protocol, assuming Alice and Bob are both able to guarantee each other's public keys (e.g. through a Certificate authority), the protocol is
1) A sends to B:
$E_{publicB} [...
- 97
1
vote
0
answers
229
views
How to prevent reflection attack in Needham-Schroeder in ECB mode?
We know that Needham-Schroeder is vulnerable to a reflection attack as shown here.
How can I make it secure using ECB and without using timestamps? I need to modify the protocol. Otwan-Rees is a ...
- 111
0
votes
1
answer
328
views
Needham–Schroeder fix by adding opponent's identity to the first message
Recap: Needham–Schroeder is as follows:
$A \rightarrow B : \{A, N_a\}_{pk_B}$
$B \rightarrow A : \{N_a, N_b\}_{pk_A}$
$A \rightarrow B : \{N_b\}_{pk_B}$
Then, there is a MITM attack by Lowe ...
- 1
1
vote
0
answers
195
views
Security of the Needham-Schroeder public key protocol after a minor adjustment
I'm preparing for a computer security exam by going through some past paper questions. And I came across this particular one that I could not answer:
We have the Needham Schroeder Public Key Protocol:...
- 111
-1
votes
1
answer
160
views
Classical cryptographic key exchange
I am currently reviewing for my exam and a questions comes to my mind when I read an example about a simple key exchange protocol. In my textbook, the author comes up with an example about a simple ...
- 1
5
votes
2
answers
2k
views
When would you increment a nonce and when not?
K is the shared key for encryption known by _Alice and _Bob. $N_A$ is a nonce created by Alice. The function f is the increment by 1 function.
(1) Alice -> Bob: $E_K(N_A)$
So Alice encrypts a nonce ...
- 51
-1
votes
1
answer
222
views
In Needham Schroeder key distribution what happens if responder's part is not encrypted in step 2 with Kbs but encrypted instead by Kab in step 3
The Needham-Schroeder protocol is:
1 A→S:A,B,Na
2 S→A:{Na,B,Kab,{Kab,A}Kbs}Kas
3 A→B:{Kab,A}Kbs
4 B→A:{Nb}Kab
5 A→B:{Nb−1}Kab
Here Na and Nb are nonces.
Kab is the key between a and b
Kas is ...
1
vote
1
answer
809
views
Insecurity in Needham and Schroeder protocol?
I've been studying specifically the authentication algorithm Needham and Shroeder, and understand the idea in general of the message exchange. But, researching on the subject, I found a question that ...
- 121
6
votes
1
answer
2k
views
Why use Needham-Schroeder if we have Diffie-Hellman?
If we want to establish secret symmetric key between two entities, why use Needham-Schroeder if we have Diffie-Hellman? With DH we don't need to have any trusted party, so what's the point of NS?
- 1,373
6
votes
2
answers
1k
views
Why have Nonce and why encrypt everything in step 2 for Needham-Schroeder?
Here is the protocol outline I am looking at (source: Foundations of Computer Security, Lecture 60: The Needham-Schroeder Protocol)
$$
\begin{array}{ccl}
1.& A \to S \colon& A,B,N_a
\\ 2....
- 1,373