% File              : template.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{Needham Schroeder Symmetric Key}%
% authors
{Roger Needham and Michael Schroeder}%
% date of the first publication
{1978}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{08/11/2002}

\begin{abstract}
Distribution of a shared symmetric key by a trusted server
and mutual authentification.
Symmetric key cryptography with server.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{A, B, S}{principal}
\dcl{Na, Nb}{nonce}
\dcl{Kas, Kbs, Kab}{key}
\dcl{dec}{nonce -> nonce}
\end{declarations}

\begin{messages}
\msg{1}{A}{S}{A, B, Na}
\msg{2}{S}{A}{\crypt{Na, B, Kab, \crypt{Kab, A}{Kbs}}{Kas}}
\msg{3}{A}{B}{\crypt{Kab,A}{Kbs}}
\msg{4}{B}{A}{\crypt{Nb}{Kab}}
\msg{5}{A}{B}{\crypt{dec(Nb)}{Kab}}
\end{messages}
\end{core}

\begin{explanation}
This protocol establishes the fresh
shared symmetric key \code{Kab}.

Messages \code{1-3} perform the distribution 
of the fresh shared symmetric key  \code{Kab}
and messages \code{4-5} are for mutual authentification
of \code{A} and \code{B}.

The operator \code{dec} is decrementation.
\end{explanation}

\begin{property}
The protocol must guaranty the secrecy of \code{Kab}:
in every session, the value of \code{Kab} must be known only by
the participants playing the roles of \code{A}, \code{B} and \code{S}
in that session.

If the participant playing \code{B} accepts the last message \code{5},
then \code{Kab} has been sent in message \code{3}.
by \code{A} (whose identity is included in the cipher of message \code{3}).
\end{property}

\begin{references}
\cite{NeedhamSchroederSK78}.
\end{references}

\begin{attacks}
Authentication attack by Denning and Sacco \cite{DenningSacco81}.
Assume that \code{I} has recorded the session \code{i}
and that \code{Kab} is compromised.
After the session \code{ii}, \code{B} is convinced that
he shares the secret key \code{Kab} only with \code{A}.
\begin{messages}
\msg{i.1}{A}{S}{A, B, Na}
\msg{i.2}{S}{A}{\crypt{Na, B, Kab, \crypt{Kab, A}{Kbs} }{Kas}}
\msg{i.3}{A}{I(B)}{\crypt{Kab,A}{Kbs}}
\msg{}{}{}{assume that Kab is compromised}
\msg{ii.3}{I(A)}{B}{\crypt{Kab,A}{Kbs}}
\msg{ii.4}{B}{I(A)}{\crypt{Nb}{Kab}}
\msg{ii.5}{I(A)}{B}{\crypt{dec(Nb)}{Kab}}
\end{messages}
\end{attacks}

\begin{see} 
\crossref{nssk_amended},
\crossref{denningSacco},
\crossref{kerberos}.
\end{see}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
