Otway-Rees
|
|
Otway-Rees is a computer network authentication protocol designed for use on insecure networks (the Internet for example). It allows individuals communicating over a network to prove their identity to each other while also preventing evesdropping or replay attacks, and provides for detection of modification and the prevention of unauthorized reading.
The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server S:
1. <math>A \rightarrow B: M,A,B,\{M,A,B,N_A\}_{K_{AS}}<math>
2. <math>B \rightarrow S: M,A,B,\{M,A,B,N_A\}_{K_{AS}},\{M,A,B,N_B\}_{K_{BS}}<math>
3. <math>S \rightarrow B: M,\{N_A,K_{AB}\}_{K_{AS}},\{N_B,K_{AB}\}_{K_{BS}}<math>
4. <math>B \rightarrow A: M,\{N_A,K_{AB}\}_{K_{AS}}<math>
One problem with this protocol is that a malicious intruder can arrange for A and B to end up with different keys. Here is how. A and B execute the first three messages; at this point, B has received the key <math>K_{AB}<math>. The intruder intercepts the fourth message. S/he replays message 3, which results in S generating a new key <math>K'_{AB}<math> and sending it to B. The intruder intercepts this message too, but sends to A the part of it that B would have sent to A. So now A has finally received the expected fourth message, but with <math>K'_{AB}<math> instead of <math>K_{AB}<math>.
Another problem is that although the server tells B that A used a nonce, B doesn't know if this was a replay of an old message.
- See also: Kerberos, Needham-Schroeder, Wide Mouth Frog.Template:Compu-stub