*K is the shared key for encryption known by _Alice and _Bob. $N_A$ is a nonce created by Alice. The function f is the increment by 1 function.*


(1) Alice -> Bob: $E_K(N_A)$

So Alice encrypts a nonce with the shared key and sends it to Bob.

(2) Bob -> Alice: $E_K(f(N_A))$

Bob receives it, I think first he needs to decrypt it, then increment it by 1, encrypts it again and then send it back to Alice.

**The question is now, when and why would you use this use-case?** What could be the scenario for these two steps?

I have seen these two steps for example in the [Needham–Schroeder protocol][1], but I did not understand why they need these two.


My only idea is that Bob authenticates himself to Alice, because if Alice later decrypts it, Alice will see whether Bob was able to decrypt it. But why would you need to increment the nonce?

**EDIT:** As my idea seems to be right according to otus, I have to ask for another use-case I've seen: 

 (1) Alice -> Bob: $N_A$

 (2) Bob -> Alice: $E_K(N_A)$

For this second use-case I was pretty sure that my idea for the first use-case would be right. Alice sends the nonce to Bob, Bob encrypts it and sends it back to Alice. So now Alice can decrypt it and see whether Bob has the shared key. 

So are these two use-case for the same purpose? Just to authenticate Bob to Alice? Or what is the difference between them? When would you apply which of these two and why?

  [1]: https://en.wikipedia.org/wiki/Needham%E2%80%93Schroeder_protocol