% File              : neumannStubblebine.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{Neumann Stubblebine}%
% authors
{B. Clifford Neumann and Stuart G. Stubblebine}%
% date of the first publication
{04/1993}%
% editor name
{}
% submission date
{}
% date of last change, empty or = date of submission
{08/11/2002}

\begin{abstract}
Session key exchange inspired by the \crossref{yahalom} protocol
with the addition of timestamps, and mutual authentication.
Symmetric key cryptography with server.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{A, B, S}{principal}
\dcl{Na, Ma, Nb, Mb}{number}
\dcl{Kas, Kbs, Kab}{key}
\dcl{Ta, Tb}{time}
\end{declarations}

\begin{messages}
\msg{1}{A}{B}{A, Na}
\msg{2}{B}{S}{B, \crypt{A, Na, Tb}{Kbs}, Nb}
\msg{3}{S}{A}{\crypt{B, Na, Kab, Tb}{Kas}, \crypt{A, Kab, Tb}{Kbs}, Nb}
\msg{4}{A}{B}{\crypt{A, Kab, Tb}{Kbs}, \crypt{Nb}{Kab}}
\msg{5}{A}{B}{Ma, \crypt{A, Kab, Tb}{Kbs}}
\msg{6}{B}{A}{Mb, \crypt{Ma}{Kab}}
\msg{7}{A}{B}{\crypt{Mb}{Kab}}
\end{messages}
\end{core}

\begin{explanation}
The messages \code{1-4} are the part concerning
the generation and exchange of the session key \code{Kab}.
The messages \code{5-7} are the mutual authentification, 
this second part of the protocol can be repeated alone 
several times, until the ticket \code{\crypt{A, Kab, Tb}{Kbs}}
expires (it is called \emph{repeated authentication}).
\end{explanation}

\begin{property}
The protocol must guaranty the secrecy of \code{Kab}:
in every session, the value of \code{Kab} must be known only by
the participants playing the roles of \code{A}, \code{B} and \code{S}
in that session.

The protocol must also ensures mutual authentication of 
\code{A} and \code{B}.
\end{property}

\begin{references}
\cite{NeumannStublebine}
\end{references}

\begin{attacks}
\paragraph{1.}
From~\cite{HwangLeeLiKoChen_NeumannStubblebine}, see also 
\crossref{yahalomBAN} for the first 4 messages,
where \code{B} accepts the nonce \code{Na} has the fresh shared key \code{Kab}.
\begin{messages}
\msg{1}{I(A)}{B}{A, Na}
\msg{2}{B}{I(S)}{B, \crypt{A, Na, Tb}{Kbs}, Nb}
\msg{3}{}{}{omitted}
\msg{4}{I(A)}{B}{\crypt{A, Na, Tb}{Kbs}, \crypt{Nb}{Na}}
\msg{5}{I(A)}{B}{Ma, \crypt{A, Na, Tb}{Kbs}}
\msg{6}{B}{I(A)}{Mb, \crypt{Ma}{Na}}
\msg{7}{I(A)}{B}{\crypt{Mb}{Na}}
\end{messages}
See \crossref{neumannStubblebineHwang} for a modified version preventing this attack.

\paragraph{2.}
From~\cite{HwangLeeLiKoChen_NeumannStubblebine}.
This attack concerns the repeated authentication part, 
assuming \code{Kab} has been recorded in a previous legitimate
run of the protocol.
\begin{messages}
\msg{i.5}{I(A)}{B}{Ma, \crypt{ A, Kab, Tb }{Kbs}}
\msg{i.6}{B}{I(A)}{Mb, \crypt{Ma}{Kab}}
\msg{ii.5}{I(A)}{B}{Mb, \crypt{A, Kab, Tb}{Kbs}}
\msg{ii.6}{B}{I(A)}{Mb', \crypt{Mb}{Kab}}
\msg{i.7}{I(A)}{B}{\crypt{Mb}{Kab}}
\end{messages}

\paragraph{3.}
From \cite{Weidenbach_cade99}.
In this attack, the intruder \code{I} 
can get as many ciphers \code{\crypt{A, Kiab, Tb}{Kbs}}
as needed to start a known plaintext attack in order to break \code{Kbs}.
\begin{messages}
\msg{a.2}{I(B)}{S}{B, \crypt{A, K0ab, Tb}{Kbs}, Nb}
\msg{a.3}{S}{I(A)}{\crypt{B, Na, K1ab, Tb}{Kas}, \crypt{A, K1ab, Tb}{Kbs}, Nb}
\msg{b.2}{I(B)}{S}{B, \crypt{A, K1ab, Tb}{Kbs}, Nb}
\msg{b.3}{S}{I(A)}{\crypt{B, Na, K2ab, Tb}{Kas}, \crypt{A, K2ab, Tb}{Kbs}, Nb}
\msg{}{}{}{etc}
\end{messages}

\end{attacks}

\begin{see}
\crossref{yahalom}
\end{see}
\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
