For my computer science study, I have to design a replay attack (if possible) for the following authentication protocols.

I use the standard security protocol notation. In these protocols, $A$ is Alice, $B$ is Bob and $E(A)$ is for example Eve impersonating Alice. $K_{AB}$ is a shared secret key only Alice and Bob know, $K_{AB}\{x\}$ is the data $x$ encrypted with this key, and $N_A$ and $N_B$ are fresh random nonces generated by $A$ and $B$. We assume that Eve cannot simply break the encryption.

$1. A \rightarrow B : A, K_{AB}${$N_A$}
$2. B \rightarrow A : B, N_A, K_{AB}${$N_B$}
$3. A \rightarrow B : A, B, N_A, N_B, K_{AB}${$N_A, N_B$}

For this, I designed the following replay attack:

$1. A \rightarrow E(B) : A, K_{AB}${$N_A$}
$2. E(A) \rightarrow B : A, K_{AB}${$N_A$}
$3. B \rightarrow E(A) : B, N_A, K_{AB}${$N_B$}
$4. E(B) \rightarrow A : B, N_A, K_{AB}${$N_B$}

Is this gonna work?

The next example is this:

$1. A \rightarrow B : A, N_A, K_{AB}${$A, N_A$}
$2. B \rightarrow A : B, N_B, K_{AB}${$B, N_A, N_B$}
$3. A \rightarrow B : K_{AB}${$A, B, N_A$}

I have no idea how to solve this one. Could you please help me with that?

  • $\begingroup$ Is $K_{AB}\{N_A\}$ the encryption of $N_A$ with key $K_{AB}$? $\endgroup$
    – Ran G.
    Oct 8 '15 at 14:54
  • $\begingroup$ @RanG. Yes, it's a standard notation. $\endgroup$ Oct 8 '15 at 15:25
  • $\begingroup$ @Gilles, "standard" where? $\endgroup$
    – Ran G.
    Oct 8 '15 at 16:10
  • $\begingroup$ @Gilles, OK I saw the link. It's actually quite surprising to see it has such a wide usage (in the security community). Different communities, different standards, I guess. $\endgroup$
    – Ran G.
    Oct 8 '15 at 16:25

well, you don't really explain what happens in each step, and how the authentication procedure works, but your first suggestion is at the right direction. However, the impersonator wishes to authenticate himself, so the attack should actually be

$1. A \rightarrow E(B) : A, K_{AB}${$N_A$}
$2. E(A) \rightarrow B : E(A), K_{AB}${$N_A$}
$3. B \rightarrow E(A) : B, N_A, K_{AB}${$N_B$}
$4. E(B) \rightarrow A : E(B), N_A, K_{AB}${$N_B$}

and you are missing the last reply, but it is easy to see that Eve can generate both $N_A$ and $N_B$ and thus succeed with authenticating itself. Try to write it more carefully: what exactly is begin sent at each step (i.e., what is the meaning of sending "A"?), and what verification each side performs at each step.

For the second example, such an attack cannot work. The identity $A$ is included inside the encryption, and Eve has no way to replace it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.