% File              : spliceas3.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{Clark and Jacob modified Hwang and Chen modified SPLICE/AS}%
% authors
{}%
% date of the first publication
{1995}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{11/11/2002}

\begin{abstract}
This modified version corrects a flaws in \crossref{spliceas2}.
Mutual authentication protocol with 
public key cryptography 
with a certification authority
signing and distributing public keys.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{S, C, AS}{principal}
\dcl{N1, N2, N3}{nonce}
\dcl{T}{timestamp}
\dcl{L}{lifetime}
\dcl{pk, sk}{principal -> key (keypair)}
\end{declarations}

\begin{messages}
\msg{1}{C}{AS}{C, S, N1}
\msg{2}{AS}{C}{AS, \crypt{AS, C, N1, S, pk(S)}{sk(AS)}}
\msg{3}{C}{S}{C, S, \crypt{T, L, \crypt{C, N2}{pk(S)}}{sk(C)}}
\msg{4}{S}{AS}{S, C, N3}
\msg{5}{AS}{S}{AS, \crypt{AS, S, N3, C, pk(C)}{sk(AS)}}
\msg{6}{S}{C}{S, C, \crypt{inc(N2)}{pk(C)}}
\end{messages}
\end{core}

\begin{remark}
This protocol is an optimised version
of the following modification of \crossref{spliceas2}:
\begin{messages}
\msg{1}{C}{AS}{C, S, N1}
\msg{2}{AS}{C}{AS, \crypt{AS, C, N1, S, pk(S)}{sk(AS)}}
\msg{3}{C}{S}{C, S, \crypt{C, T, L, \crypt{C, N2}{pk(S)}}{sk(C)}}
\msg{4}{S}{AS}{S, C, N3}
\msg{5}{AS}{S}{AS, \crypt{AS, S, N3, C, pk(C)}{sk(AS)}}
\msg{6}{S}{C}{S, C, \crypt{S, inc(N2)}{pk(C)}}
\end{messages}
The messages \code{3} and \code{6} are optimised by suppressing some
redundancies:
the redundant \code{C} is not included in the signed part of message
\code{3} and \code{S} in not included in the cipher of message \code{6}
\end{remark}

\begin{explanation}
See \crossref{spliceas}.
The difference with \crossref{spliceas2} is in 
messages
Note that the name of the owner of the public key is
included in certificate to overcomes the flaws of \crossref{spliceas}
presented in \cite{HwangChen_SPLICEAS}
(i.e. a certificate for the public key \code{pk(S)}
is here \code{\crypt{AS, C, N1, S, pk(S)}{sk(AS)}} rather
than \code{\crypt{AS, C, N1, pk(S)}{sk(AS)}} in \crossref{spliceas}).
\end{explanation}

\begin{property}
See \crossref{spliceas}.
\end{property}

\begin{references}
\cite{ClarkJacob95}.
\end{references}

\begin{attacks}
Lowe \cite{Lowe97} demonstrate a multiplicity attack on this protocol,
where \code{I} impersonates \code{C} in a new session \code{ii},
by replaying message \code{3} of session \code{i}.
\code{I} does however not learn \code{N2}.
\begin{messages}
\msg{i.1}{C}{AS}{C, S, N1}
\msg{i.2}{AS}{C}{AS, \crypt{AS, C, N1, S, pk(S)}{sk(AS)}}
\msg{i.3}{C}{S}{C, S, \crypt{T, L, \crypt{C, N2}{pk(S)}}{sk(C)}}
\msg{i.4}{S}{AS}{S, C, N3}
\msg{i.5}{AS}{S}{AS, \crypt{AS, S, N3, C, pk(C)}{sk(AS)}}
\msg{i.6}{S}{C}{S, C, \crypt{inc(N2)}{pk(C)}}
\msg{ii.3}{I(C)}{S}{C, S, \crypt{T, L, \crypt{C, N2}{pk(S)}}{sk(C)}}
\msg{ii.4}{S}{AS}{S, C, N'3}
\msg{ii.5}{AS}{S}{AS, \crypt{AS, S, N'3, C, pk(C)}{sk(AS)}}
\msg{ii.6}{S}{I(C)}{S, C, \crypt{inc(N2)}{pk(C)}}
\end{messages}
Lowe suggests in  \cite{Lowe97} to add a nonce challenge to prevent
this attack.
\end{attacks}

\begin{see} %\crossref{}, see all.aux for labels names
\crossref{spliceas},
\crossref{spliceas2}.
\end{see}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
