Skip to main content
2 of 2
show how this attack was possible because a protocol design guideline was violated

This protocol seems to be insecure due to the fact that Bob sends $E(R_A,K)$. This can be used by Trudy to "generate" encryptions of $E(\langle R_A+1,P_T\rangle , K)$ that will later be used to complete the authentication protocol.

Specifically, consider the following attack:

Trudy picks random $R_1$ and runs the protocol with Bob in the following manner: $$ \begin{align*} T \to B: &\quad \text{“I'm Alice”}, \langle R_1+1,P_T \rangle \\ B \to T: &\quad \color{blue}{E(\langle R_1+1,P_T \rangle, K)} \\ \end{align*} $$ and then Trudy cuts the protocol in the middle (since she doesn't know how to reply). We assume both Trudy and Bob abort.

Now Trudy starts another instance of the protocol: $$ \begin{align*} T \to B: &\quad \text{“I'm Alice”}, R_1 \\ B \to T: &\quad E(R_1, K) \\ T \to B: &\quad \color{blue}{E(\langle R_1+1,P_T \rangle, K) } \end{align*} $$ How did Trudy complete the protocol this time without knowing $K$? it's easy! Bob actually performed the encryption for her in the first instance.

Lesson learned: in a cryptographic protocol, it's good for each message or separable fragment to contain a unique tag that prevents its reuse as some other message in the protocol. If Bob's reply was $E(\langle 1, R_A\rangle)$ and the third message was $E(\langle 2, R_A+1, P\rangle)$, this attack would not work.

Ran G.
  • 20.8k
  • 3
  • 60
  • 116