% File              : kaoChow1.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{Kao Chow Authentication v.1}%
% authors
{I Long Kao and Randy Chow}%
% date of the first publication
{1995}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{11/11/2002}

\begin{abstract}
Key distribution and authentication protocol.
Symmetric keys cryptography with server.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{A, B, S}{principal}
\dcl{Na, Nb}{number}
\dcl{Kab, Kbs, Kas}{key}
\end{declarations}

\begin{messages}
\msg{1}{A}{S}{A, B, Na}
\msg{2}{S}{B}{\crypt{A, B, Na, Kab}{Kas}, \crypt{A, B, Na, Kab}{Kbs}}
\msg{3}{B}{A}{\crypt{A, B, Na, Kab}{Kas}, \crypt{Na}{Kab}, Nb}
\msg{4}{A}{B}{\crypt{Nb}{Kab}}
\end{messages}
\end{core}

\begin{explanation}
\code{Kas} and \code{Kbs} are symmetric keys whose values
are initially known only by \code{A} and \code{S},
respectively \code{B} and \code{S}.

\code{Na} and \code{Nb} are nonces for mutual authentication and
to verify the authenticity of the fresh symmetric key \code{Kab}.

The messages \code{3} and \code{4} are \emph{repeated authentication}:
after that messages \code{1} and \code{2} have completed successfully,
\code{3} and \code{4} can be played several times by \code{B} before 
starting a secrete communication with \code{A} encrypted with the
session key \code{kab} 
(see also \crossref{neumannStubblebine} for repeated authentication).
\end{explanation}

\begin{remark}
This protocol has been designed to prevent 
%the Denning Sacco attack on the \crossref{nssk} protocol or 
the freshness attack on the repeated authentication
part of the \crossref{neumannStubblebine} protocol.
Indeed, the nonce \code{Na} in the ciphers of message \code{2}
prevent a shared key compromised after another run of the protocol
to be reused.

However, as shown below, an attack of this kind is still possible.
This flaw is fixed in \crossref{kaoChow2}.
\end{remark}

\begin{property}
The protocol must guaranty the secrecy of \code{Kab}: 
in every session, the value of \code{Kab} 
must be known only by the participants playing the roles 
of \code{A}, \code{B} and \code{S}.

When \code{A}, resp. \code{B}, receives the key \code{Kab} 
in message \code{3}, resp. \code{2},
this key must have been issued in the same session by the server \code{S} with
whom \code{A} has started to communicate in message \code{1}.

The protocol must also ensures 
mutual authentication of \code{A} and \code{B}. 
\end{property}

\begin{references}
\cite{KaoChow95}.
The protocol is presented as specified in \cite{ClarkJacob97}.
\end{references}

\begin{attacks}
As described in \cite{KaoChow95}, 
this protocol suffers the same kind of attack 
as the Denning Sacco freshness attack on \crossref{nssk},
when an older session symmetric key \code{Kab} has been compromised.
\begin{messages}
\msg{i.1}{A}{S}{A, B, Na}
\msg{i.2}{S}{B}{\crypt{A, B, Na, Kab}{Kas}, \crypt{A, B, Na, Kab}{Kbs}}
\msg{}{}{}{assume that Kab is compromised}
\msg{ii.1}{}{}{Omitted}
\msg{ii.2}{I(S)}{B}{\crypt{A, B, Na, Kab}{Kas}, \crypt{A, B, Na, Kab}{Kbs}}
\msg{ii.3}{B}{I(A)}{\crypt{A, B, Na, Kab}{Kas}, \crypt{Na}{Kab}, N'b}
\msg{ii.4}{I(A)}{B}{\crypt{N'b}{Kab}}
\end{messages}
\end{attacks}

\begin{see} %\crossref{}, see all.aux for labels names
\crossref{kaoChow2},
\crossref{kaoChow3},
\crossref{nssk},
\crossref{neumannStubblebine}.
\end{see}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
