% File              : template.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{Otway Rees}%
% authors
{D. Otway and O. Rees}%
% date of the first publication
{01/1997}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{12/11/2002}

\begin{abstract}
Distribution of a shared symmetric key by a trusted server.
Symmetric key cryptography with server.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{A, B, S}{principal}
\dcl{M, Na, Nb}{nonce}
\dcl{Kas, Kbs, Kab}{key}
\end{declarations}

\begin{messages}
\msg{1}{A}{B}{M, A, B, \crypt{Na, M, A, B}{Kas}}
\msg{2}{B}{S}{M, A, B, \crypt{Na, M, A, B}{Kas} , \crypt{Nb, M, A, B}{Kbs}}
\msg{3}{S}{B}{M, \crypt{Na, Kab}{Kas}, \crypt{Nb, Kab}{Kbs}}
\msg{4}{B}{A}{M, \crypt{Na, Kab}{Kas}}
\end{messages}
\end{core}

\begin{explanation}
The nonce \code{M} identifies the session number.

\code{Kas} and \code{Kbs} are symmetric keys whose values
are initially known only by \code{A} and \code{S},
respectively \code{B} and \code{S}.

\code{Kab} is a fresh symmetric key generated by \code{S} in message
\code{3} and distributed to \code{B}, directly in message \code{3},
and to \code{A}, indirectly, when \code{B} forwards blindly 
\code{\crypt{Na, Kab}{Kas}} to \code{A} in message \code{4}.
\end{explanation}

\begin{property}
The protocol must guaranty the secrecy of \code{Kab}: 
in every session, the value of \code{Kab} 
must be known only by the participants playing the roles 
of \code{A}, \code{B} and \code{S}.

When \code{A}, resp. \code{B}, receives the key \code{Kab} 
in message \code{3}, resp. \code{2},
this key must have been issued in the same session by the server \code{S} with
whom \code{B} has started to communicate in message \code{2}.
\end{property}

\begin{references}
\cite{OtwayRees87}
\end{references}

\begin{attacks}
Type flaw in \cite{ClarkJacob97}, 
where \code{A} will accept in last message \code{4}
the triple \code{(M, A, B)} as a fresh key \code{Kab}.
\begin{messages}
\msg{1}{A}{I(B)}{M, A, B, \crypt{Na, M, A, B}{Kas}}
\msg{2}{B}{S}{M, A, B, \crypt{Na, M, A, B}{Kas} , \crypt{Nb, M, A, B}{Kbs}}
\msg{3}{S}{B}{M, \crypt{Na, Kab}{Kas}, \crypt{Nb, Kab}{Kbs}}
\msg{4}{I(B)}{A}{M, \crypt{Na, M, A, B}{Kas}}
\end{messages}
\end{attacks}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
