Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I am studying ISO 9798-2 Three-pass mutual authentication. There are 3 steps, as following:

  1. B -> A: NB // B sends to A a "nonce" value NB
  2. A -> B: {NB||NA}K // A's identity is proven to B by showing B that A has the correct pre-shared secret K to encrypt the challenge NB.
  3. B -> A: {NA||NB}K // B authenticates itself to A by decrypting the encrypted challenge NA.

My question is, why bother using NB again in the 3rd step ? Couldn't B proves its identity by simply sending A the NA value ? The 3rd step could be simplified like this: "B -> A: NA". From some documents on the Internet, it seems to have some crypto-purpose to re-add NB into the 3rd step. Why ?

share|improve this question

In all generality, authentication protocols strives to be provably secure while assuming the minimum of properties for the used primitives. For instance, do all challenges have the same length ? When using concatenation (as in NA || NB), is the separation between NA and NB unambiguously defined ? To what extent is the encryption mechanism malleable (e.g. what does happen if an attacker tries to swap the two halves of an encrypted message) ? Inclusion of NB in the third message is an attempt at avoiding some attacks of this kind.

See this document for an analysis of the ISO 9798 authentication protocols. The three-pass protocol is actually not optimally secure.

share|improve this answer
If AES is used in this three-pass mutual authentication protocol, is it still necessary to re-encrypt NB at the third step? – will1978 Sep 26 '13 at 6:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.