% File              : spliceas.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{SPLICE/AS}%
% authors
{Suguru Yamaguchi, Kiyohiko Okayama, and Hideo Miyahara}%
% date of the first publication
{11/1991}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{26/11/2002}

\begin{abstract}
Mutual authentication protocol.
Public key cryptography 
with a certification authority
signing and distributing public keys.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{S, C, AS}{principal}
\dcl{N1, N2, N3}{nonce}
\dcl{T}{timestamp}
\dcl{L}{lifetime}
\dcl{pk, sk}{principal -> key (keypair)}
\end{declarations}

\begin{messages}
\msg{1}{C}{AS}{C, S, N1}
\msg{2}{AS}{C}{AS, \crypt{AS, C, N1, pk(S)}{sk(AS)}}
\msg{3}{C}{S}{C, S, \crypt{C, T, L, \crypt{N2}{pk(S)}}{sk(C)}}
\msg{4}{S}{AS}{S, C, N3}
\msg{5}{AS}{S}{AS, \crypt{AS, S, N3, pk(C)}{sk(AS)}}
\msg{6}{S}{C}{S, C, \crypt{S, inc(N2)}{pk(C)}}
\end{messages}
\end{core}

\begin{explanation}
\code{key} is the type of public/private keys.
The functions \code{pk} and \code{sk} associate 
to a \code{principal}'s name its public key, resp. private key.

We assume that initially, the client \code{C} and the server
\code{S} only know their own public and private key,
and that the authority \code{AS} known the function \code{pk},
i.e. he knows everyone's public key.

\code{\crypt{AS, C, N1, pk(S)}{sk(AS)}} (in message \code{2})
and \code{\crypt{AS, S, N3, pk(C)}{sk(AS)}} (in message \code{5})
are certificates signed and distributed by the authority \code{AS}, 
for the respective public keys \code{pk(S)} and \code{pk(C)}.

After a successfull run of the protocol, the value of \code{N2} 
can be used by \code{C} and \code{S} as a symmetric key
for secure communications.
\end{explanation}

\begin{property}
The protocol must guaranty the secrecy of \code{N2}:
in every session, the value of \code{N2} must be known only by
the participants playing the roles of \code{C}, \code{S}.

The protocol must also ensure \code{C} that \code{S} has received
\code{N2} and \code{S} that the \code{N2} he has received in message
\code{3} originated from \code{C}.
\end{property}

\begin{references}
\cite{SPLICEAS}
\end{references}

\begin{attacks}
\paragraph{1.}
In an attack described in \cite{HwangChen_SPLICEAS},
the intruder \code{I} can impersonate the client \code{C}
and obtain \code{N2}
in a single session (i.e. without even running a parallel session).
\begin{messages}
\msg{1}{I}{AS}{I, S, N1}
\msg{2}{AS}{I}{AS, \crypt{AS, I, N1, pk(S)}{sk(AS)}}
\msg{3}{I(C)}{S}{C, S, \crypt{C, T, L, \crypt{N2}{pk(S)}}{sk(I)}}
\msg{4}{S}{I(AS)}{S, C, N3}
\msg{4}{I(S)}{AS}{S, I, N3}
\msg{5}{AS}{S}{AS, \crypt{AS, S, N3, pk(I)}{sk(AS)}}
\msg{6}{S}{I(C)}{S, C, \crypt{S, inc(N2)}{pk(I)}}
\end{messages}
In message \code{5}, the server \code{S} accepts the certificate
\code{\crypt{AS, S, N3, pk(I)}{sk(AS)}} from \code{AS}
as a certificate of the public key of \code{C}
(note that the certificates  do not contain the name of the
owner of public keyx in this protocol)
and hence crypts the data in the last message \code{6} with the public
key of \code{I}.

\paragraph{2.}
In this second (symmetric) attack from \cite{HwangChen_SPLICEAS},
the intruder \code{I} can impersonate the server \code{S}
and obtain \code{N2}.
\begin{messages}
\msg{1}{C}{I(AS)}{C, S, N1}
\msg{1}{I(C)}{AS}{C, I, N1}
\msg{2}{AS}{C}{AS, \crypt{AS, C, N1, pk(I)}{sk(AS)}}
\msg{3}{C}{I(S)}{C, S, \crypt{C, T, L, \crypt{N2}{pk(I)}}{sk(C)}}
\msg{4}{I}{AS}{I, C, N3}
\msg{5}{AS}{I}{AS, \crypt{AS, S, N3, pk(C)}{sk(AS)}}
\msg{6}{S}{C}{S, C, \crypt{S, inc(N2)}{pk(C)}}
\end{messages}

\paragraph{3.}
Lowe outlined (see \cite{ClarkJacob97})
that a malicious \code{C} can replay 
the message \code{3} (the first message concerning \code{S})
several times, with new values of \code{T} and \code{L},
to restart authentication with an old value of \code{N2}.
\end{attacks}

\begin{see} %\crossref{}, see all.aux for labels names
\crossref{spliceas2},
\crossref{spliceas3}.
\end{see}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
