# Public keys and their protocols

I'm having difficulties understanding exactly what this protocol means:

$S \to D : \{N_S , S\}K_D$

$D \to S : \{N_S , N_D \}K_S$

$S \to D : \{N_D \}K_D$

"where $S$ represents the supervisor’s console and $D$ represents the door controller and the other symbols have their usual security protocol meanings."

I understand $N$ to be a nonce, a randomly generated number/hash that will only be used once.

I'm assuming $K$ is the public key?

Could someone explain this protocol for me, I’ve looked everywhere and cannot find anything like this.

-

## 3 Answers

It seems like an authentication protocol. In the first message, $S$ identifies herself. In the 2nd message $D$ proves knowledge of her private key (otherwise she could not return $N_s$. In the third message, $S$ proves knowledge of her private key.

You asked in a comment about replay attacks. There are two possibilities, the attacker is impersonating $S$ or $D$.

For $S$, the attacker might replay a captured 1st message. $D$ would see it, decrypt, return $N_S$ with a randomly generated $N_D$. The attacker could not possibly know what $N_D$ is and could not send the last message.

For impersonating $D$, $S$ would send the first message, but the attacker couldn't decrypt it and therefore could not send the 2nd message.

So, it seems the protocol is secure against replay attacks.

-

But if there are two different doors $D_1$, $D_2$, then one of the doors is able to impersonate the supervisor to the other door. – CodesInChaos Dec 14 '12 at 13:30

Under the assumption that $K_X$ represents $X$'s public key, this is the three-message version of the Needham-Schroeder public-key protocol. Many mutual authentication protocols derive from this design.

Wikipedia has the seven-message version of the protocol. The essential difference between that version and the three-message version is that the seven-message version explicitly includes the certificate exchanges for the public keys. The three-message version simply assumes that the correct public keys are known.

The protocol was proven secure using a formalism called BAN logic, which is hardly used nowadays. Almost 20 years after the protocol was proposed it was shown that it is vulnerable to a man-in-the-middle attack if the adversary has his own public/private key pair, see this paper by Gavin Lowe.

-

This looks like a symmetric-key protocol: $S$ first sends a nonce $N_S$ along with its name encrypted under the key $K_D$. Then $D$ responds with an encryption of $N_S$ along with another nonce $N_D$, this time encrypted under $K_S$. Finally $S$ sends $N_D$ to $D$, this time encrypted under $K_D$.

-

Is it possible for a message to be retransmitted from an attacker? – George Orwell Dec 14 '12 at 1:48
{"extraction_info": {"found_math": true, "script_math_tex": 0, "script_math_asciimath": 0, "math_annotations": 0, "math_alttext": 0, "mathml": 0, "mathjax_tag": 0, "mathjax_inline_tex": 35, "mathjax_display_tex": 0, "mathjax_asciimath": 0, "img_math": 0, "codecogs_latex": 0, "wp_latex": 0, "mimetex.cgi": 0, "/images/math/codecogs": 0, "mathtex.cgi": 0}, "config": {"markdown_headings": true, "markdown_code": true, "boilerplate_config": {"ratio_threshold": 0.18, "absolute_threshold": 20, "end_threshold": 15, "enable": true}, "remove_buttons": true, "remove_image_figures": true, "remove_link_clusters": true, "table_config": {"min_rows": 2, "min_cols": 3, "format": "github"}, "remove_chinese": true, "remove_edit_buttons": true, "extract_latex": true}, "english_confidence": 0.9416391253471375, "perplexity_flag": "middle"}