% File              : ksl.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{KSL}%
% authors
{Axel Kehne and J{\"u}rgen Sch{\"o}nw{\"a}lder and Horst Langend{\"o}rfer}%
% date of the first publication
{1992}%
% editor name
{}
% submission date
{}
% date of last change, empty or = date of submission
{02/12/2002}

\begin{abstract}
Nonce based improvement of \crossref{kerberos} protocol
with generalized timestamps.
Distribution of a session key and a ticket and 
repeated mutual authentication.
Symmetric key cryptography with server.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{A, B, S}{principal}
\dcl{Na, Nb, Nc, Ma, Mb}{number}
\dcl{Kas, Kbs, Kab, Kbb}{key}
\dcl{Tb}{generalizedTimestamp}
\end{declarations}

\begin{messages}
\msg{1}{A}{B}{Na, A}
\msg{2}{B}{S}{Na, A, Nb, B}
\msg{3}{S}{B}{\crypt{Nb, A, Kab}{Kbs}, \crypt{Na, B, Kab}{Kas}}
\msg{4}{B}{A}{\crypt{Na, B, Kab}{Kas}, \crypt{Tb, A, Kab}{Kbb}, Nc, \crypt{Na}{Kab}}
\msg{5}{A}{B}{\crypt{Nc}{Kab}}
\msg{}{}{}{}
\msg{6}{A}{B}{Ma, \crypt{Tb, A, Kab}{Kbb}}
\msg{7}{B}{A}{Mb, \crypt{Ma}{Kab}}
\msg{8}{A}{B}{\crypt{Mb}{Kab}}
\end{messages}
\end{core}

\begin{explanation}
The messages \code{1-5} are the part concerning
the generation and exchange of the session key \code{Kab}.
The messages \code{6-8} are for mutual authentification.
This second part of the protocol is also called \emph{repeated authentication}
because it can be repeated alone several times, 
until the ticket \code{\crypt{Tb, A, Kab}{Kbb}} expires.

\paragraph{Key exchange.}
The keys \code{Kas} and \code{Kbs} are long term symmetric key
whose values are supposed to be known initially
only by \code{A} and \code{S}, respectively \code{B} and \code{S}.

The session key \code{Kab} is freshly generated by \code{S} 
and in sent in message \code{3} directly to \code{B},
and indirectly to \code{A}, in the cipher
\code{\crypt{Na, B, Kab}{Kas}},
transmitted blindly to \code{A} by \code{B} in message \code{4}.

\code{Kbb} is a secret key only known to \code{B}, used to encrypt the
ticket \code{\crypt{Tb, A, Kab}{Kbb}} in message \code{4}. This ticket
will be used in the repeated authentication.

\paragraph{Repeated authentication.}
In the ticket \code{\crypt{Tb, A, Kab}{Kbb}}, \code{Tb} is a
generalized timestamp, made of a timestamp from the local
clock of \code{B}, a lifetime limiting the validity of the ticket
(relatively to the local clock of \code{B}) and a clock identifier,
i.e. a nonce which is updated each time \code{B}'s local clock is
corrected.

When he receives a ticket in message \code{6}, \code{B} compares 
the time identifier in \code{Tb} to the current identifier of his local clock and
if they match, verifies the validity of the ticket, i.e. he checks
that the time of his local clock is within the time window defines by
the timestamp and the lifetime of \code{Tb}. If one of these tests
fails, then \code{B} rejects the ticket. Otherwise, 
he starts an exchange of nonces (messages \code{7} and \code{8})
the purpose of which is to convince mutually \code{A} and \code{B}
that they both possess the session key \code{Kab}.
\end{explanation}

\begin{property}
The protocol must guaranty the secrecy of \code{Kab}:
in every session, the value of \code{Kab} must be known only by
the participants playing the roles of \code{A}, \code{B} and \code{S}
in that session.

The protocol must also ensures mutual authentication of 
\code{A} and \code{B}.
\end{property}

\begin{references}
\cite{Kehne92}
\end{references}

\begin{proofs}
The authors of the protocol propose in 
\cite{Kehne92} an analysis in the framework of the BAN logic
\cite{BurrowsAbadiNeedham89}.
\end{proofs}

\begin{attacks}
\paragraph{1.}
\cite{Lowe96}: ``The repeated authentification part can be used as an
encrypting oracle''. If the intruder \code{I} wants to encrypt
some data \code{M} with the session key \code{Kab}, he can run:
\begin{messages}
\msg{6}{I(A)}{B}{M, \crypt{Tb, A, Kab}{Kbb}}
\msg{7}{B}{I(A)}{Mb, \crypt{M}{Kab}}
\end{messages}
The ticket \code{\crypt{Tb, A, Kab}{Kbb}} can have been learned by
\code{I} from the message \code{4} of a previous key distribution.
After running the two above message, \code{I} can send:
\begin{messages}
\msg{}{I(A)}{B}{\crypt{M}{Kab}}
\end{messages}
and \code{B} will accept this message as having been sent by \code{A}.

\paragraph{2.}
The attacks presented in~\cite{HwangLeeLiKoChen_NeumannStubblebine}
on the repeated authentication part of the \code{neumannStubblebine} protocol also works here.

This attack concerns the repeated authentication part, 
assuming \code{Kab} has been recorded in a previous legitimate
run of the protocol.
\begin{messages}
\msg{i.6}{I(A)}{B}{Mi, \crypt{ Tb, A, Kab}{Kbb}}
\msg{i.7}{B}{I(A)}{Mb, \crypt{Mi}{Kab}}
\msg{ii.6}{I(A)}{B}{Mb, \crypt{Tb, A, Kab}{Kbb}}
\msg{ii.7}{B}{I(A)}{Mb', \crypt{Mb}{Kab}}
\msg{i.8}{I(A)}{B}{\crypt{Mb}{Kab}}
\end{messages}

\paragraph{3.}
\cite{Lowe96}. In this scenario, two tickets
generated by two different agents contains
the same session key \code{Kab}, which, 
according to \cite{Lowe96}, was supposed not to happen in the
protocol of \cite{Kehne92}.
\begin{messages}
\msg{i.1}{I(A)}{B}{Ni, A}
\msg{i.2}{B}{I(S)}{Ni, A, Nb, B}
\msg{ii.1}{I(B)}{A}{Nb, B}
\msg{ii.2}{A}{S}{Nb, B, Na, A}
\msg{ii.3}{S}{A}{\crypt{Na, B, Kab}{Kas}, \crypt{Nb, A, Kab}{Kbs}}
\msg{ii.4}{A}{I(B)}{\crypt{Nb, A, Kab}{Kbs}, \crypt{Ta, B, Kab}{Kaa}, Nc, \crypt{Nb}{Kab}}
\msg{i.3}{I(S)}{B}{\crypt{Nb, A, Kab}{Kbs}, \crypt{Na, B, Kab}{Kas}}
\msg{i.4}{B}{I(A)}{\crypt{Na, B, Kab}{Kas}, \crypt{Tb, A, Kab}{Kbb}, Nc', \crypt{Ni}{Kab}}
\end{messages}
The intruder \code{I} can then use the two tickets 
to complete step \code{5} of both runs \code{i} and \code{ii}.
In this scenarion, the repeated authentication procedure is used as an
encrypting oracle.
\begin{messages}
\msg{i.6}{I(A)}{B}{Nc, \crypt{Tb, A, Kab}{Kbb}}
\msg{i.7}{B}{I(A)}{Mb, \crypt{Nc}{Kab}}
\msg{ii.5}{I(B)}{A}{\crypt{Nc}{Kab}}
\msg{ii.6}{I(B)}{A}{Nc', \crypt{Ta, B, Kab}{Kaa}}
\msg{ii.7}{A}{I(B)}{Ma, \crypt{Nc'}{Kab}}
\msg{i.5}{I(A)}{B}{\crypt{Nc'}{Kab}}
\end{messages}

\paragraph{4.}
\cite{Lowe96}. The ticket obtained in the first part of the above
scenario also permits \code{I} to impersonate \code{A} in the repeated authentification part
of the protocol.
\begin{messages}
\msg{i.6}{I(A)}{B}{Mi, \crypt{Tb, A, Kab}{Kbb}}
\msg{i.7}{B}{I(A)}{Mb, \crypt{Mi}{Kab}}
\msg{ii.6}{I(B)}{A}{Mb, \crypt{Ta, B, Kab}{Kaa}}
\msg{ii.7}{A}{I(B)}{Ma, \crypt{Mb}{Kab}}
\msg{i.8}{I(A)}{B}{\crypt{Mb}{Kab}}
\end{messages}

\end{attacks}

\begin{see}
\crossref{kerberos},
\crossref{neumannStubblebine},
\crossref{kslLowe}.
\end{see}
\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
