Security Protocols I - Information Security

Sebastian Mödersheim 21Building a key establishment protocol (15)• The problem stems from the difference in quality between thelong-term key-encrypting keys shared initially with S, and thesession keys K AB generated for each protocol run.• Reasons for using session keys:◮ They are expected to be vulnerable to attack (by cryptanalysis).◮ Communications in different sessions should be separated.In particular, it should not be possible to replay messages fromprevious sessions.• A whole class of attacks becomes possible when old keys (or othersecurity-relevant data) may be replayed in a subsequent session.Security Assumption 4: the intruder is able to obtain thevalue of the session key K AB used in any “sufficiently old”previous run of the protocol.FMSEC Module 2, v.2 28.09.2009