Cryptographic Protocols - Everyday Cryptography - page 319

TTP Alice Bob

r B

r A || r B || Alice || Bob

E K AT ( r A || K AB || Bob ) || E K BT ( r B || K AB || Alice )

E K BT ( r B || K AB || Alice ) || E K AB ( r ' A || r B )

E K AB ( r B || r ' A || Alice )

Figure 9.13. An AKE protocol from ISO 9798-2

There is a further assumption made on the type of encryption mechanism used,
but we will discuss that when we consider data origin authentication. The protocol
is shown in Figure 9.13 and proceeds as follows:

1. Bob starts the protocol by randomly generating a nonce r B and sending it to
Alice.
2. Alice randomly generates a nonce r A and then sends a request for a symmetric
key to the TTP. This request includes both Alice's and Bob's names, as well as
the two nonces r A and r B .
3. The TTP generates a symmetric key K AB and then encrypts it twice. The first
ciphertext is intended for Alice and encrypted using K AT . The plaintext consists
of r A , K AB and Bob's name. The second ciphertext is intended for Bob and
encrypted using K BT . The plaintext consists of r B , K AB and Alice's name. The
two ciphertexts are sent to Alice.
4. Alice decrypts the first ciphertext using K AT and checks that it contains r A and
Bob's name. She extracts K AB . She then generates a new nonce r A . Next, she
generates a new ciphertext by encrypting r A and r B using K AB . Finally, she
forwards the second ciphertext that she received from the TTP, and the new
ciphertext that she has just created, to Bob.
5. Bob decrypts the first ciphertext that he receives (which is the second ciphertext
that Alice received from the TTP) using K BT and checks that it contains r B and
Alice's name. He extracts K AB . He then decrypts the second ciphertext using
K AB and checks to see if it contains r B . He extracts r A . Finally, he encrypts r B , r A
and Alice's name using K AB and sends this ciphertext to Alice.
6. Alice decrypts the ciphertext using K AB and checks that the plaintext consists
of r B , r A and Alice's name. If it does then the protocol concludes successfully.