1. IT IS 6200/8200

2. Authentication & key exchange
Try to merge the previous two steps:
Establish the session key and persuade Alice that you are Bob
Tens of protocols have been developed: some good, some bad
Lesson we learn:
Do not try to be smart
Do not make messages too similar to each other

3. Protocol 1: Wide-Mouth Frog
Two-step protocol through TTP
Problems:
Why we need the timestamp: resend attack
With timestamp: still not safe
Message 1 and 2 too similar to each other
M keeps the timestamp fresh until it crashes the key
Is the key generated by Alice secure enough

4. Protocol 2: Needham-Schroeder
5 step protocol
The freshness is protected by random numbers and it seems that A has assured it.
What about B: K is for A and B, is it fresh? Is the other side A? (we can only verify that the other side knows K)
Problem: old key matters (B is not involved until step 3)
Solution: add a timestamp

5. Protocol 3: Otway-Rees ( a very good protocol)
4 steps
The freshness is protected by the random numbers
Both parties get involved from the very beginning

6. The Protocol n || Alice || Bob || { r1 || n || Alice || Bob } kA Alice
{ r2 || n || Alice || Bob } kB
Cathy
Bob
n || { r1 || ks } kA || { r2 || ks } kB
Cathy
Bob
n || { r1 || ks } kA
Alice
Bob

7. Protocol 4: Neuman-Stubblebine
4 step protocol
Good point:
Only timestamp from one party is involved, so avoid synchronization
Even M cracks K, he cannot conduct the attack and impersonate A since the timestamp would have expired.
Problem:
Type-flaw attack: an attacker can pretend to be Alice (it needs to control the path between B and T)

8. Protocol 5: Denning-Sacco (an unsafe protocol)
3 step protocol
Using public-private key
Still not safe:
B can impersonate A to talk to anyone else
Fix for this:
Identify communication parties that use the key

9. Lessons we learn: Identify the communication parties
Protect the freshness of the key
Get both parties involved early
Do not make packets similar to each other
Do not try to outsmart other researchers or hackers

10. Secret splitting: Secret sharing:
All parties are required to recover the secret
Solution: XOR
Secret sharing:
Only a threshold number of parties are required to recover the secret
The example using polynomial