Consider the following protocol, meant to authenticate $A$ (Alice) to $B$ (Bob) and vice versa.
$$ \begin{align*} A \to B: &\quad \text{“I'm Alice”}, R_A \\ B \to A: &\quad E(\langle 1, R_A\rangle, K) \\ A \to B: &\quad E(\langle 2, R_A+1, P_A\rangle, K) \\ \end{align*} $$
- $R$ is a random nonce.
- $K$ is a pre-shared symmetric key.
- $P$ is some payload.
- $E(m, K)$ means $m$ encrypted with $K$.
- $\langle m_1, \ldots, m_n\rangle$ means an assemblage of the $m_i$'s that can be decoded unambiguously ($n$ is encoded unambiguously as well).
- We assume that the cryptographic algorithms are secure and implemented correctly.
An attacker (Trudy) wants to convince Bob to accept her payload $P_T$ as coming from Alice (in lieu of $P_A$). Can Trudy thus impersonate Alice? How?
This is a follow-up to Break an authentication protocol based on a pre-shared symmetric key.