The Andrew Protocol Corrected 1 A  B : {N A } K AB 2 B  A : {N A,N B } K AB 3 A  B : {N B } K AB 4 B  A : {K AB,N B,N A } K AB

The Andrew Protocol Corrected 1 A  B : {N A } K AB 2 B  A : {N A,N B } K AB 3 A  B : {N B } K AB 4 B  A : {K AB,N B,N A } K AB N A in the 4 th message is kown by A to be fresh

Checking the Andrew Protocol Corrected  B BABA B B shk K' AB shk K' AB fresh {K' AB,N' B,N A } K AB  shk K' AB AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB )

shk K' AB Checking the Andrew Protocol Corrected  B BABA B B shk K' AB AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB ) rec {K' AB,N' B,N A } K AB  B B send A {K' AB,N' B,N A } K AB fresh {K' AB,N' B,N A } K AB  B B fresh{K' AB,N' B,N A } K AB (fresh K' AB  fresh N' B  fresh N A )  rec {K' AB,N' B,N A } K AB  fresh {K' AB,N' B,N A } K AB

AG(rec {K' AB,N' B } K AB  B A fresh N A  B A B B shk K' AB ) Checking the Andrew Protocol Corrected  B BABA B B shk K' AB shk K' AB rec A {K' AB,N' B,N A } K AB  B A rec {K' AB,N' B,N A } K AB The property holds of the corrected Andrew Protocol