Due Sept. 26, 2004. Submit your solution on paper in class. No late assignments will be accepted.
To facilitate grading, format your solutions as follows.
Consider only Dolov-Yao attackers. You may assume that keys are unique, an assumption easily discharged by salting keys.
1. A --> KDC: A,B,r 2. KDC --> A: A,B, {A,r,K_AB}K_A, {B,r,K_AB}K_B 3. A --> B: A,B, {B,r,K_AB}K_B
PROTOCOL A 1. A --> KDC: A,B,M,r For some M chosen by A 2. KDC --> A: A,B,M, {A,r,M,K_AB}K_A, {B,r,M,K_AB}K_B 3. A --> B: A,B,M, {B,r,M,K_AB}K_B PROTOCOL B 1. A --> KDC: A,B,M,r For some M chosen by A 2. KDC --> A: A,B,M, {A,M,r,K_AB}K_A, {A,B,r,M,K_AB}K_B 3. A --> B: A,B,M, {A,B,r,M,K_AB}K_B PROTOCOL C 1. A --> KDC: A,B,r 2. KDC --> A: {B,r,K_AB}K_A, {A,r,K_AB}K_B 3. A --> B: A, {A,r,K_AB}K_B PROTOCOL D 1. A --> KDC: A, {A,B,r}K_A 2. KDC --> A: A,B, {A,r,K_AB}K_A, {B,r,K_AB}K_B 3. A --> B: A,B, {B,r,K_AB}K_B
1. A --> B: n,A,B, {n,A,B,r1}K_A (A chooses n, r1 at random) 2. B --> KDC: n,A,B, {n,A,B,r1}K_A, {n,A,B,r2}K_B (B chooses r2 at random) 3. KDC --> B: n,{r1,K_AB}K_A, {r2,K_AB}K_B (KDC creates K_AB) 4. B --> A: n,{r1,K_AB}K_A
PROTOCOL A 1. A --> B: n,A,{n,A,B,r1}K_A (A chooses n, r1 at random) 2. B --> KDC: n,B,{n,A,B,r1}K_A, {n,A,B,r2}K_B (B chooses r2 at random) 3. KDC --> B: n,{r1,K_AB}K_A, {r2,K_AB}K_B (KDC creates K_AB) 4. B --> A: n,{r1,K_AB}K_A PROTOCOL B 1. A --> B: n,A,B,r1, {n,A,B,r1}K_A (A chooses n, r1 at random) 2. B --> KDC: n,A,B,r1,r2, {n,A,B,r1}K_A, {n,A,B,r2}K_B (B chooses r2 at random) 3. KDC --> B: n,{r1,K_AB}K_A, {r2,K_AB}K_B (KDC creates K_AB) 4. B --> A: n,{r1,K_AB}K_A PROTOCOL C 1. A --> B: n,A,B, {n,B,r1}K_A (A chooses n, r1 at random) 2. B --> KDC: n,A,B, {n,B,r1}K_A, {n,A,r2}K_B (B chooses r2 at random) 3. KDC --> B: n,{r1,K_AB}K_A, {r2,K_AB}K_B (KDC creates K_AB) 4. B --> A: n,{r1,K_AB}K_A PROTOCOL D 1. A --> B: n,A,B, {n,A,B,r1}K_A (A chooses n, r1 at random) 2. B --> KDC: n,A,B, {{n,A,B,r1}K_A, n,A,B,r2}K_B (B chooses r2 at random) 3. KDC --> B: n,{{r1,K_AB}K_A, r2,K_AB}K_B (KDC creates K_AB) 4. B --> A: n,{r1,K_AB}K_A PROTOCOL E 1. A --> B: n,A,B, {n,A,r1}K_A (A chooses n, r1 at random) 2. B --> KDC: n,A,B, {n,A,r1}K_A, {n,B,r2}K_B (B chooses r2 at random) 3. KDC --> B: n,{r1,K_AB}K_A, {r2,K_AB}K_B (KDC creates K_AB) 4. B --> A: n,{r1,K_AB}K_A PROTOCOL F 1. A --> B: n,A,B, {n,B,r1}K_A (A chooses n, r1 at random) 2. B --> KDC: n,A,B, {n,B,r1}K_A, {n,A,r2}K_B (B chooses r2 at random) 3. KDC --> B: n,{r2,K_AB}K_B 4. KDC --> A: n,{r1,K_AB}K_A
1. A --> B: n,A,B,r1 2. B --> KDC: n,A,B,r1,r2 3. KDC --> B: n,{r1,r2,A,B,K_AB}K_A, {r1,r2,A,B,K_AB}K_B 4. B --> A: {r1,r2,A,B,K_AB}K_A
When the protocol terminates (with no participant crashing), what are the strongest conditions that
If these assumptions differ from Otway-Rees, state the differences explicitly.