Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm studying a one-pass key establishment protocol. Let be A client and B the Server.

A sends to B: E_w(t,b,k) where t is a timestamp requested for freshness, k is the ephemeral key that will be used for the communication.

My question is, what is b? I think an Identifier of the Server, but what is the utility?

I attach the image of the page of the book on which I'm studying. Maybe the problem is that My English is not well, so I don't understand fully the text.

book scan

The book states: "and a target identifier to prevent undetectable message replay back on A immediately."

Can you explain this sentence?

share|improve this question
What protocol are you referring to? – Terry Chia Jun 11 '13 at 10:40
Point-to-point key establishment – Edge7 Jun 11 '13 at 10:57
I don't think this question is off-topic, but if it gets closed, we can take it on Computer Science (don't repost there, we'll migrate the question if it gets closed here). You should mention what book the text is from (in fact, legally, you must, because you're citing a passage from the book). – Gilles Jun 11 '13 at 11:49
up vote 1 down vote accepted

The message E_K(r_A, t_A, B) is encrypted with the key K and includes the following data:

  • r_A: the session key
  • t_A: a unique value to avoid replay attacks. If there was only E_K(r_A, B), then an attacker could send this message to B later, and it could then communicate with B pretending to be A. The value t_A can be a timestamp, i.e. a value that changes over time, so that if A uses the same protocol again later then the value will have increased. t_A can also be a sequence number, i.e. a counter, which is incremented each time A uses this protocol. Another possibility (not mentioned in the text) would be for t_A to be a random nonce.
  • B: an identifier so that the message is marked as intended for B. Without this identifier, the same message could be sent to C, which might allow an attacker to pretend to C that he is A. I can't tell exactly what attack this identifier prevents without seeing the full protocol, but it is usually a good idea to include the identity of the sender and of the recipient in all messages: the goal is to avoid a situtation where the attacker can reuse this message in a different conversation, where it might be considered valid (because the message is valid, but in a different context).

I'm not sure what that “target identifier to prevent undetectable message replay back on A immediately” is. It seems to be another way to describe B, but this would be easier to understand with the full description of the protocol.

share|improve this answer

to prevent undetectable message replay back on A immediately

That sounds to me as if that "target identifier" specifies for which one of the two parties involved in the communication the message is intended. Here's why:

Let's say there's a communication between Alice and Bob (they talk a lot, it seems). They have a secret symmetric key for encrypting their communication and they sign their messages with a common HMAC key. Also, they include a sequence number like "this is the Nth message I sent you today" and the date to prevent simple replay attacks. Here's an attack:

Alice stands up and sends her first message of the day to Bob:

Let's meet at my place!

Mallory intercepts that message and sends it both to Bob (the original recipient) and Alice (the sender). As the message doesn't specify who sent it or who is the intended recipient, now Alice thinks that Bob wants her to come over to him. Confusion ensues. Also, the first packet by Bob will reuse an already-used sequence number, so Alice will treat it as a replay attempt and drop it.

To prevent this, Alice not only needs to ensure that the message came from herself or Bob, she also needs to make sure that it really didn't come from herself.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.