% File              : denningSacco.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{Denning-Sacco shared key}%
% authors
{Dorothy E. Denning and Giovanni Maria Sacco}%
% date of the first publication
{1981}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{12/11/2002}

\begin{abstract}
Modified version of the \crossref{nssk} with
timestamps to fix the freshness flaw.
Distribution of a shared symmetric key by a trusted server
and mutual authentification.
Symmetric key cryptography with server and timestamps.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{A, B, S}{principal}
\dcl{Kas, Kbs, Kab}{key}
\dcl{T}{timestamp}
\end{declarations}

\begin{messages}
\msg{1}{A}{S}{A, B}
\msg{2}{S}{A}{\crypt{B, Kab, T, \crypt{Kab, A, T}{Kbs}}{Kas}}
\msg{3}{A}{B}{\crypt{Kab,A, T}{Kbs}}
\end{messages}
\end{core}

\begin{explanation}
The nonces of \crossref{nssk} (for mutual authentication of \code{A}
and \code{B}) have been replaced by a timestamp \code{T}.

The shared symmetric key established by the protocol is \code{Kab}.
\end{explanation}

\begin{property}
See \crossref{nssk}.
\end{property}

\begin{references}
\cite{DenningSacco81}
\end{references}

\begin{attacks}
This protocol is subject to a mutiplicity attack \cite{Lowe97}.
\begin{messages}
\msg{i.1}{A}{S}{A, B}
\msg{i.2}{S}{A}{\crypt{B, Kab, T, \crypt{Kab, A, T}{Kbs}}{Kas}}
\msg{i.3}{A}{B}{\crypt{Kab,A, T}{Kbs}}
\msg{ii.3}{I(A)}{B}{\crypt{Kab,A, T}{Kbs}}
\end{messages}
In session \code{ii}, \code{B} thinks that \code{A} wants
to establish a new shared key and accepts it.
\end{attacks}

\begin{see} %\crossref{}, see all.aux for labels names
\crossref{denningSaccoLowe},
\crossref{nssk}.
\end{see}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
