# Can Eve impersonate Alice or Bob by using a replay attack?

For my computer science study, I have to design a replay attack (if possible) for the following authentication protocols.

I use the standard security protocol notation. In these protocols, $A$ is Alice, $B$ is Bob and $E(A)$ is for example Eve impersonating Alice. $K_{AB}$ is a shared secret key only Alice and Bob know, $K_{AB}\{x\}$ is the data $x$ encrypted with this key, and $N_A$ and $N_B$ are fresh random nonces generated by $A$ and $B$. We assume that Eve cannot simply break the encryption.

a)
$1. A \rightarrow B : A, K_{AB}${$N_A$}
$2. B \rightarrow A : B, N_A, K_{AB}${$N_B$}
$3. A \rightarrow B : A, B, N_A, N_B, K_{AB}${$N_A, N_B$}

For this, I designed the following replay attack:

$1. A \rightarrow E(B) : A, K_{AB}${$N_A$}
$2. E(A) \rightarrow B : A, K_{AB}${$N_A$}
$3. B \rightarrow E(A) : B, N_A, K_{AB}${$N_B$}
$4. E(B) \rightarrow A : B, N_A, K_{AB}${$N_B$}

Is this gonna work?

The next example is this:

b)
$1. A \rightarrow B : A, N_A, K_{AB}${$A, N_A$}
$2. B \rightarrow A : B, N_B, K_{AB}${$B, N_A, N_B$}
$3. A \rightarrow B : K_{AB}${$A, B, N_A$}

• Is $K_{AB}\{N_A\}$ the encryption of $N_A$ with key $K_{AB}$? – Ran G. Oct 8 '15 at 14:54
• @RanG. Yes, it's a standard notation. – Gilles 'SO- stop being evil' Oct 8 '15 at 15:25
• @Gilles, "standard" where? – Ran G. Oct 8 '15 at 16:10
• @Gilles, OK I saw the link. It's actually quite surprising to see it has such a wide usage (in the security community). Different communities, different standards, I guess. – Ran G. Oct 8 '15 at 16:25

$1. A \rightarrow E(B) : A, K_{AB}${$N_A$}
$2. E(A) \rightarrow B : E(A), K_{AB}${$N_A$}
$3. B \rightarrow E(A) : B, N_A, K_{AB}${$N_B$}
$4. E(B) \rightarrow A : E(B), N_A, K_{AB}${$N_B$}
and you are missing the last reply, but it is easy to see that Eve can generate both $N_A$ and $N_B$ and thus succeed with authenticating itself. Try to write it more carefully: what exactly is begin sent at each step (i.e., what is the meaning of sending "A"?), and what verification each side performs at each step.
For the second example, such an attack cannot work. The identity $A$ is included inside the encryption, and Eve has no way to replace it.