Needham–Schroeder protocol

Here, Alice ${\displaystyle (A)}$ initiates the communication to Bob ${\displaystyle B}$. ${\displaystyle S}$ is a server trusted by both parties. In the communication:

• ${\displaystyle A}$ and ${\displaystyle B}$ are identities of Alice and Bob respectively
• ${\displaystyle {K_{AS}}}$ is a symmetric key known only to ${\displaystyle A}$ and ${\displaystyle S}$
• ${\displaystyle {K_{BS}}}$ is a symmetric key known only to ${\displaystyle B}$ and ${\displaystyle S}$
• ${\displaystyle N_{A}}$ and ${\displaystyle N_{B}}$ are nonces generated by ${\displaystyle A}$ and ${\displaystyle B}$ respectively
• ${\displaystyle {K_{AB}}}$ is a symmetric, generated key, which will be the session key of the session between ${\displaystyle A}$ and ${\displaystyle B}$

The protocol can be specified as follows in security protocol notation:

${\displaystyle A\rightarrow S:\left.A,B,N_{A}\right.}$

Alice sends a message to the server identifying herself and Bob, telling the server she wants to communicate with Bob.

${\displaystyle S\rightarrow A:\{N_{A},K_{AB},B,\{K_{AB},A\}_{K_{BS}}\}_{K_{AS}}}$

The server generates ${\displaystyle {K_{AB}}}$ and sends back to Alice a copy encrypted under ${\displaystyle {K_{BS}}}$ for Alice to forward to Bob and also a copy for Alice. Since Alice may be requesting keys for several different people, the nonce assures Alice that the message is fresh and that the server is replying to that particular message and the inclusion of Bob's name tells Alice who she is to share this key with.

${\displaystyle A\rightarrow B:\{K_{AB},A\}_{K_{BS}}}$

Alice forwards the key to Bob who can decrypt it with the key he shares with the server, thus authenticating the data.

${\displaystyle B\rightarrow A:\{N_{B}\}_{K_{AB}}}$

Bob sends Alice a nonce encrypted under ${\displaystyle {K_{AB}}}$ to show that he has the key.

${\displaystyle A\rightarrow B:\{N_{B}-1\}_{K_{AB}}}$

Alice performs a simple operation on the nonce, re-encrypts it and sends it back verifying that she is still alive and that she holds the key.

This assumes the use of a public-key encryption algorithm.

Here, Alice ${\displaystyle (A)}$ and Bob ${\displaystyle (B)}$ use a trusted server ${\displaystyle (S)}$ to distribute public keys on request. These keys are:

• ${\displaystyle K_{PA}}$ and ${\displaystyle K_{SA}}$, respectively public and private halves of an encryption key-pair belonging to ${\displaystyle A}$ (${\displaystyle S}$ stands for "secret key" here)
• ${\displaystyle K_{PB}}$ and ${\displaystyle K_{SB}}$, similar belonging to ${\displaystyle B}$
• ${\displaystyle K_{PS}}$ and ${\displaystyle K_{SS}}$, similar belonging to ${\displaystyle S}$. (Note that this key-pair will be used for digital signatures, i.e., ${\displaystyle K_{SS}}$ used for signing a message and ${\displaystyle K_{PS}}$ used for verification. ${\displaystyle K_{PS}}$ must be known to ${\displaystyle A}$ and ${\displaystyle B}$ before the protocol starts.)

The protocol runs as follows:

${\displaystyle A\rightarrow S:\left.A,B\right.}$

${\displaystyle A}$ requests ${\displaystyle B}$'s public keys from ${\displaystyle S}$

${\displaystyle S\rightarrow A:\{K_{PB},B\}_{K_{SS}}}$

${\displaystyle S}$ responds with public key ${\displaystyle K_{PB}}$ alongside ${\displaystyle B}$'s identity, signed by the server for authentication purposes.

${\displaystyle A\rightarrow B:\{N_{A},A\}_{K_{PB}}}$

${\displaystyle A}$ chooses a random ${\displaystyle N_{A}}$ and sends it to ${\displaystyle B}$.

${\displaystyle B\rightarrow S:\left.B,A\right.}$

${\displaystyle B}$ now knows A wants to communicate, so ${\displaystyle B}$ requests ${\displaystyle A}$'s public keys.

${\displaystyle S\rightarrow B:\{K_{PA},A\}_{K_{SS}}}$

Server responds.

${\displaystyle B\rightarrow A:\{N_{A},N_{B}\}_{K_{PA}}}$

${\displaystyle B}$ chooses a random ${\displaystyle N_{B}}$, and sends it to ${\displaystyle A}$ along with ${\displaystyle N_{A}}$ to prove ability to decrypt with ${\displaystyle K_{SB}}$.

${\displaystyle A\rightarrow B:\{N_{B}\}_{K_{PB}}}$

${\displaystyle A}$ confirms ${\displaystyle N_{B}}$ to ${\displaystyle B}$, to prove ability to decrypt with ${\displaystyle K_{SA}}$

At the end of the protocol, ${\displaystyle A}$ and ${\displaystyle B}$ know each other's identities, and know both ${\displaystyle N_{A}}$ and ${\displaystyle N_{B}}$. These nonces are not known to eavesdroppers.

• Kerberos
• Otway–Rees protocol
• Yahalom
• Wide Mouth Frog protocol
• Neuman–Stubblebine protocol
• Diffie-Hellman key exchange

Wikimedia Commons has media related to Needham-Schroeder protocol.

• Roger Needham; Michael Schroeder (1978). "Needham-Schroeder Public Key". Laboratoire Spécification et Vérification.

• Roger Needham; Michael Schroeder (1978). "Needham Schroeder Symmetric Key". Laboratoire Spécification et Vérification.

• Gavin Lowe (1995). "Lowe's fixed version of Needham-Schroder Public Key". Laboratoire Spécification et Vérification.
• Explanation of man-in-the-middle attack by Computerphile.