% File              : template.tex
% Version           : $Revision: 1.1 $
% Last-modified     : $Date: 2005/01/04 11:45:32 $
% Last-modifier     : FJ

\documentclass{splib}

\begin{document}
% main environment
\begin{protocol}%
% name
{Woo and Lam Mutual Authentication}%
% authors
{T.Y.C Woo and S.S. Lam}%
% date of the first publication
{1994}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{10/11/2002}

\begin{abstract}
Key distribution and mutual authentication with trusted server and symmetric keys.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{P, Q, S}{principal}
\dcl{Kps, Kqs, Kpq}{key}
\dcl{N1, N2}{number}
\end{declarations}

\begin{messages}
\msg{1}{P}{Q}{P, N1}
\msg{2}{Q}{P}{Q, N2}
\msg{3}{P}{Q}{\crypt{P, Q, N1, N2}{Kps}}
\msg{4}{Q}{S}{\crypt{P, Q, N1, N2}{Kps}, 
              \crypt{P, Q, N1, N2}{Kqs}}
\msg{5}{S}{Q}{\crypt{Q, N1, N2, Kpq}{Kps}, 
              \crypt{P, N1, N2,Kpq}{Kqs}}
\msg{6}{Q}{P}{\crypt{Q, N1, N2, Kpq}{Kps}, 
              \crypt{N1, N2}{Kpq}}
\msg{7}{P}{Q}{\crypt{N2}{Kpq}}
\end{messages}
\end{core}

\begin{explanation}
\code{Kpq} is a fresh symmetric key created at message 
\code{5} by the server \code{S}.

\code{N1} and \code{N2} are nonces.

\code{Kps} and \code{Kqs} are symmetric keys whose values
are initially known only by \code{P} and \code{S},
respectively \code{P} and \code{S}.
\end{explanation}

\begin{property}
The protocol must guaranty the secrecy of \code{Kpq}: 
in every session, the value of \code{Kpq} 
must be known only by the participants playing the roles 
of \code{P}, \code{Q} and \code{S}.

The protocol must also ensures 
mutual authentication of \code{P} and \code{Q}. 
\end{property}

\begin{references}
\cite{WooLam94}
\end{references}

\begin{attacks}
\paragraph{1.}
Parallel session replay attack, 
\cite{ClarkJacob_WooLam}, and \cite{ClarkJacob97}.
In this attack, the intruder 
\code{I} initiates a session  \code{ii} in order to make 
\code{P} accept a non-fresh key.

\begin{messages}
\msg{i.1}{P}{I}{P, N1}
\msg{ii.1}{I}{P}{I, N1}
\msg{ii.2}{P}{I}{P, N2}
\msg{i.2}{I}{P}{I, N2}
\msg{i.3}{P}{I}{\crypt{P, I, N1, N2}{Kps}}
\msg{i.4}{I}{S}{\crypt{P, I, N1, N2}{Kps}, \crypt{P, I, N1, N2}{Kis}}
\msg{i.5}{S}{I}{\crypt{I, N1, N2, Kpi}{Kps}, \crypt{P, N1, N2, Kpi}{Kis}}
\msg{i.6}{I}{P}{\crypt{I, N1, N2, Kpi}{Kps}, \crypt{N1, N2}{Kpi}}
\msg{i.7}{P}{I}{\crypt{N2}{Kpi}}
\msg{ii.3}{I}{P}{\crypt{I, P, N1, N2}{Kis}}
\msg{ii.4}{P}{I(S)}{\crypt{I, P, N1, N2}{Kis}, \crypt{I, P, N1, N2}{Kps}}
\msg{ii.5}{I(S)}{P}{\crypt{I, N1, N2, Kpi}{Kis}, \crypt{I, N1, N2, Kpi}{Kps}}
\msg{ii.6}{P}{I}{\crypt{P, N1, N2, Kpi}{Kis}, \crypt{N1, N2}{Kpi}}
\msg{ii.7}{I}{P}{\crypt{N2}{Kpi}}
\end{messages}

\paragraph{2.}
\cite{Lowe96}.
\code{bit-string} represent an arbitrary number.
\begin{messages}
\msg{i.1}{I(P)}{Q}{P, Q}
\msg{i.2}{Q}{I(P)}{Q, N2}
\msg{i.3}{I(P)}{Q}{bit-string}
\msg{i.4}{Q}{I(S)}{bit-string, \crypt{P, Q, Q, N2}{Kps}}
\msg{ii.1}{I(P)}{Q}{P, N2}
\msg{ii.2}{Q}{I(P)}{Q, N3}
\msg{ii.3}{I(P)}{Q}{bit-string'}
\msg{ii.4}{Q}{I(S)}{bit-string', \crypt{P, Q, N2, N3}{Kps}}
\msg{i.5}{I(S)}{Q}{bit-string'', \crypt{P, Q, N2, N3}{Kps}}
\msg{i.6}{Q}{I(P)}{bit-string'', \crypt{Q, N2}{N3}}
\msg{i.7}{I(P)}{Q}{\crypt{N2}{N3}}
\end{messages}
\end{attacks}

%\begin{see} %\crossref{}, see all.aux for labels names
%\end{see}

\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
