6 of 9
added 1134 characters in body

Security of a security protocol for key exchange, using symmetric-key cryptography

This is an exam question in Computer Security course:

Here is the start of a protocol, based on a long-term secret key $k_{AB}$ previously shared between Alice and Bob, designed to offer bilateral authentication and establishment of a session key $k_s$. The session, which begins at message 4, is supposed to be confidential and secure against reflection, replay, and re-ordering of the contents.

  1. $A \to B$: Alice, $nonce_A$
  2. $B \to A$: $nonce_B$, $E_{k_{AB}}(nonce_A \| k_1)$
  3. $A \to B$: $E_{k_{AB}}(nonce_B \| k_2)$

Alice and Bob both compute $k_s$ = $k_1$ xor $k_2$ 4. $A \to B$: $E_{k_s}(...)$ 5. $B \to A$: $E_{k_s}(...)$

a) Why would Alice and Bob want a session key $k_s$, rather than simply using the already shared secret key $k_{AB}$ for session encryption?
b) How should Alice and Bob format the contents of their session, messages 4 onwards, to meet the aims of the protocol?
c) If they additionally wish to ensure the integrity of the session, what should they add to the protocol?
d) Does this protocol provide key agreement or does it provide key transport? Explain your answer.
The following appears to be a man-in-the-middle attack on the protocol, under the usual Dolev- Yao model:

1.$A \to $$I_B$: Alice ,$nonce_A$
$\acute{1}$.$I_A \to B$: Alice, $nonce_A$
$\acute{2}$.$B \to I_A$: $nonce_B$,$E_{k_{AB}}$$(nonce_A \| K_1)$
2.$I_B \to A$: $nonce_B$,$E_{k_{AB}}$$(nonce_A \| K_1)$
3.$A \to I_B$: $E_{k_{AB}}$$(nonce_B \| K_2)$
$\acute{3}$.$I_A \to B$: $E_{k_{AB}}$$(nonce_B \| K_2)$
Alice and Bob continue their sessions with the intruder.
e) Why does the above sequence not constitute an attack on the protocol?
f) Although not subject to man-in-the-middle attacks, there does exist a flaw in the protocol. Find it, and explain carefully why it does constitute an attack on the protocol.

Part f) is where I'm currently stuck.
One attack I can think of is when $nonce_A$ = $nonce_B$ a Dolev-Yao attacker can pose as B and send A $E_{k_{AB}}$$(nonce_A \| k_1)$ in message 3 then $k_s$ = $k_1$ xor $k_1$ = 0 then the attacker know $k_s$ then he can send message and decrypt message. But the chance $nonce_A$ = $nonce_B$ is very small so I'm not sure if it constitutes an attack.