AAA Mobile IP

MN, FA, AAAL, AAAH, HA : principal
N_FA : nonce
K_MnAAAH, K_FaAAAL, K_AAAHAAAL, K_AAAHHa : symkey
K_MnFa, K_MnHa, K_FaHa : fresh symkey

1. FA   -> MN   : FA, N_FA
2. MN   -> FA   : N_FA, MN, AAAH, {N_FA, MN, AAAH}K_MnAAAH
3. FA   -> AAAL : N_FA, MN, AAAH, {N_FA, MN, AAAH}K_MnAAAH
4. AAAL -> AAAH : N_FA, MN, AAAH, {N_FA, MN, AAAH}K_MnAAAH
5. AAAH -> HA   : MN, {K_MnHa, K_FaHa}K_AAAHHa, {K_MnFa, K_MnHa}K_MnAAAH, {MN, {K_MnHa, K_FaHa}K_AAAHHa, {K_MnFa, K_MnHa}K_MnAAAH}K_AAAHHa
6. HA   -> AAAH : {K_MnFa, K_MnHa}K_MnAAAH, {{K_MnFa, K_MnHa}K_MnAAAH}K_MnHa, {{K_MnFa, K_MnHa}K_MnAAAH, {{K_MnFa, K_MnHa}K_MnAAAH}K_MnHa}K_AAAHHa
7. AAAH -> AAAL : N_FA, {K_MnFa, K_FaHa}K_AAAHAAAL, {K_MnFa, K_MnHa}K_MnAAAH, {{K_MnFa, K_MnHa}K_MnAAAH}K_MnHa, {N_FA, {K_MnFa, K_FaHa}K_AAAHAAAL, {K_MnFa, K_MnHa}K_MnAAAH, {{K_MnFa, K_MnHa}K_MnAAAH}K_MnHa}K_AAAHAAAL
8. AAAL -> FA   : N_FA, {K_MnFa, K_FaHa}K_FaAAAL, {K_MnFa, K_MnHa}K_MnAAAH, {{K_MnFa, K_MnHa}K_MnAAAH}K_MnHa, {N_FA, {K_MnFa, K_FaHa}K_FaAAAL, {K_MnFa, K_MnHa}K_MnAAAH, {{K_MnFa, K_MnHa}K_MnAAAH}K_MnHa}K_FaAAAL
9. FA   -> MN   : {K_MnFa, K_FaHa}K_FaAAAL, {K_MnFa, K_MnHa}K_MnAAAH, {{K_MnFa, K_MnHa}K_MnAAAH}K_MnHa


Amended Needham Schroeder Symmetric Key

A, B, S : principal
 Na, Nb : number
 Kas, Kbs, Kab : key
 dec : number -> number

1. A -> B : A
 2. B -> A : {A, Nb}Kbs
 3. A -> S : A, B, Na, {A, Nb}Kbs
 4. S -> A : {Na, B, Kab, {Kab, Nb, A}Kbs}Kas
 5. A -> B : {Kab, Nb, A}Kbs
 6. B -> A : {Nb}Kab
 7. A -> B : {dec(Nb)}Kab


Andrew Secure RPC

A, B : principal
 Kab, K'ab : symkey
 Na, Nb, N'b : nonce
 succ : nonce -> nonce

1. A -> B : A, {Na}Kab
 2. B -> A : {succNa, Nb}Kab
 3. A -> B : {succNb}Kab
 4. B -> A : {K'ab, N'b}Kab


BAN concrete Andrew Secure RPC

A, B : principal
 Kab, K'ab : symkey
 Na, Nb, N'b : nonce
 succ : nonce -> nonce

1. A -> B : A, Na
 2. B -> A : {Na, K'ab}Kab
 3. A -> B : {Na}K'ab
 4. B -> A : Nb


BAN modified Andrew Secure RPC

A, B : principal
 Kab, K'ab : symkey
 Na, Nb, N'b : nonce
 succ : nonce -> nonce

1. A -> B : A, {Na}Kab
 2. B -> A : {succNa, Nb}Kab
 3. A -> B : {succNb}Kab
 4. B -> A : {K'ab, N'b, Na}Kab


BAN modified version of CCITT X.509 (3)

A, B : principal
 Na, Nb : nonce
 Ya, Yb : userdata
 Xa, Xb : userdata
 PK, SK : principal -> key (keypair)

1. A -> B : A, {Na, B, Xa, {Ya}PK(B)}SK(A)
 2. B -> A : B, {Nb, A, Na, Xb, {Yb}PK(A)}SK(B)
 3. A -> B : A, {B, Nb}SK(A)


BAN simplified version of Yahalom

A, B, S : principal
 Na, Nb : number fresh
 Kas, Kbs, Kab : key
 A knows : A, B, S, Kas
 B knows : B, S, Kbs
 S knows : S, A, B, Kas, Kbs

1. A -> B : A, Na
 2. B -> S : B, Nb, {A, Na}Kbs
 3. S -> A : Nb, {B, Kab, Na}Kas, {A, Kab, Nb}Kbs
 4. A -> B : {A, Kab, Nb}Kbs, {Nb}Kab


Bilateral Key Exchange with Public Key Protocol

A, B : principal
Ka, Kb : public key of A and B
K : shared symmetric key
Na, Nb : nonce
f : nonce -> msg

1. B -> A : B, E(Ka : Nb, B)
2. A -> B : E(Kb : f(Nb), Na, A, K)
3. B -> A : E(Kb : f(Na))


Bull's Authentication Protocol

A, B, C, S : principal
 Kab, Kbc : fresh symkey
 Na, Nb, Nc : fresh number
 Kas, Kbs, Kcs : symkey
 h : message, symkey -> message
 A computes Xa = h((A,B,Na),Kas), (A,B,Na)

1. A -> B : Xa
 B computes Xb = h((B,C,Nb,Xa),Kbs), (B,C,Nb,Xa)
 2. B -> C : Xb
 C computes Xc = h((C,S,Nc,Xb),Kcs), (C,S,Nc,Xb)
 3. C -> S : Xc
 4. S -> C : A, B, Kab xor h(Na,Kas), {A,B,Na}Kab,
 B, A, Kab xor h(Nb,Kbs), {B,A,Nb}Kab,
 B, C, Kbc xor h(Nb,Kbs), {B,C,Nb}Kbc,
 C, B, Kbc xor h(Nc,Kcs), {C,B,Nc}Kbc
 5. C -> B : A, B, Kab xor h(Na,Kas), {A,B,Na}Kab,
 B, A, Kab xor h(Nb,Kbs), {B,A,Nb}Kab,
 B, C, Kbc xor h(Nb,Kbs), {B,C,Nb}Kbc
 6. B -> A : A, B, Kab xor h(Na,Kas), {A,B,Na}Kab


CAM

M,C : principal
 Tm : timestamp
 PK,SK : principal -> key (keypair)
 HoA : principal -> address
 CoA : principal -> address
 i : salt

1. M -> C : CoA(M), HoA(C), HoA(M), PK(M), i, Tm,
 {H(CoA(M), HoA(C), HoA(M), Tm)}SK(M)
 HostPart(HoA(M)) = H(PK(M), i)


CCITT X.509 (1)

A, B : principal
 Na, Nb : nonce
 Ta, Tb : timestamp
 Ya, Yb : userdata
 Xa, Xb : userdata
 PK, SK : principal -> key (keypair)

1. A -> B : A, {Ta, Na, B, Xa, {Ya}PK(B)}SK(A)


CCITT X.509 (1c)

A, B : principal
 Na, Nb : nonce
 Ta, Tb : timestamp
 Ya, Yb : userdata
 Xa, Xb : userdata
 PK, SK : principal -> key (keypair)
 h : userdata -> userdata (one-way)

1. A -> B : A, {Ta, Na, B, Xa, {Ya, {h(Ya)}SK(A)}PK(B)}SK(A)


CCITT X.509 (3)

A, B : principal
 Na, Nb : nonce
 Ta, Tb : timestamp
 Ya, Yb : userdata
 Xa, Xb : userdata
 PK, SK : principal -> key (keypair)

1. A -> B : A, {Ta, Na, B, Xa, {Ya}PK(B)}SK(A)
 2. B -> A : B, {Tb, Nb, A, Na, Xb, {Yb}PK(A)}SK(B)
 3. A -> B : A, {Nb}SK(A)


Clark and Jacob modified Hwang and Chen modified SPLICE/AS

S, C, AS : principal
 N1, N2, N3 : nonce
 T : timestamp
 L : lifetime
 pk, sk : principal -> key (keypair)

1. C -> AS : C, S, N1
 2. AS -> C : AS, {AS, C, N1, S, pk(S)}sk(AS)
 3. C -> S : C, S, {T, L, {C, N2}pk(S)}sk(C)
 4. S -> AS : S, C, N3
 5. AS -> S : AS, {AS, S, N3, C, pk(C)}sk(AS)
 6. S -> C : S, C, {inc(N2)}pk(C)


Davis Swick Private Key Certificates Protocol

A, B : principal
T : trusted translator
Kbt : shared key between B and T
Kat : shared key between A and T
msg : message

1. B -> A : E(Kbt : A, msg)
2. A -> T : E(Kbt : A, msg), B
3. T -> A : E(Kat : msg, B)


Denning-Sacco shared key

A, B, S : principal
 Kas, Kbs, Kab : key
 T : timestamp

1. A -> S : A, B
 2. S -> A : {B, Kab, T, {Kab, A, T}Kbs}Kas
 3. A -> B : {Kab,A, T}Kbs


Diffie Helman

A, B : principal
 P, G, Xa, Xb : number
 one : -> number
 kap : number, number, number -> number

1. A -> B : P, G
 2. A -> B : kap(P, G, Xa)
 3. B -> A : kap(P, G, Xb)
 4. A -> B : {one()}kap(P, kap(P, G, Xb), Xa)


EAP-TLS

P, S : principal
Kp, Ks, Kca : public_key
Np, Ns, PMS : nonce
Version, SessionID, CipherSuite, Cipher : text
Ske, Shd, Ccs : text
H, KeyGen, PRF : hash_func
alias ClientK = KeyGen(P, Np, Ns, PRF(PMS, Np, Ns))
alias ServerK = KeyGen(S, Np, Ns, PRF(PMS, Np, Ns))
alias Finished = H(PRF(PMS, Np, Ns), P, S, Np, Cipher, SessionID)

1. S -> P : request_id
2. P -> S : respond_id, P
3. S -> P : start_tls
4. P -> S : Version, SessionID, Np, CipherSuite
5. S -> P : Version, SessionID, Ns, Cipher, {S, Ks}inv(Kca), Ske, Shd
6. P -> S : {P, Kp}inv(Kca), {PMS}Ks, {H(Np, Ns, S, PMS)}inv(Kp), Ccs, {Finished}ClientK
7. S -> P : Ccs, {Finished}ServerK


EAP-TTLS with Tunneled CHAP

P, S : principal
Ks, Kca : public_key
Np, Ns, PMS : nonce
Version, SessionID, CipherSuite, Cipher : text
Shd, Ccs, Txt : text
UName, ChapRs : text
H, PRF, CHAP_PRF, Tranc, KeyGen : hash_func
alias MS = PRF(PMS, Np, Ns)
alias ClientK = KeyGen(P, Np, Ns, MS)
alias ServerK = KeyGen(S, Np, Ns, MS)
alias Finished = H(MS, P, S, Np, Cipher, SessionID)
alias CHAP_challenge = Tranc(CHAP_PRF(MS, Txt, Np, Ns), 1, 16)
alias ChapId = Tranc(CHAP_PRF(MS, Txt, Np, Ns), 17, 17)

1. S -> P : request_id
2. P -> S : respond_id, P
3. S -> P : start_ttls
4. P -> S : Version, SessionID, Np, CipherSuite
5. S -> P : Version, SessionID, Ns, Cipher, {S, Ks}inv(Kca), Shd
6. P -> S : {PMS}Ks, Ccs, {Finished}ClientK
7. S -> P : Ccs, {Finished}ServerK
8. P -> S : {UName, CHAP_challenge, ChapId, ChapRs}ClientK
9. S -> P : success


Encrypted Key Exchange (EKE) Protocol

A, B : principal
P : password (symmetric key)
Ka : A's randomly generated public key
R : randomly generated session key
Na, Nb : nonces

1. A -> B : E(P : Ka)
2. B -> A : E(P : E(Ka : R))
3. A -> B : E(R : Na)
4. B -> A : E(R : Na, Nb)
5. A -> B : E(R : Nb)


GJM

A,B,T : principal
 C : msg
 PCS : (principal,msg,principal,principal):msg
 S-SIG : (principal,msg):msg
 TP-SIG : (principal,msg):msg
 resolved,aborted : bool
 abort : msg
 Exchange-1. A -> B : PCS(A,C,B,T)
 Exchange-2. B -> A : PCS(B,C,A,T)
 Exchange-3. A -> B : S-SIG(A,C)
 Exchange-4. B -> A : S-SIG(B,C)
 Abort-1. A -> T : S-SIG(A,[C,A,B,abort])
 Abort-2. T -> A : if (resolved) then S-SIG(B,C) else
S-SIG(T,S-SIG(A,[C,A,B,abort]))
 Resolve-A-1. A -> T : [PCS(B,C,A,T),S-SIG(A,C)]
 Resolve-A-2. T -> A : if (aborted) then
S-SIG(T,S-SIG(A,[C,A,B,abort])) else if (resolved) S-SIG(B,C) else
TP-SIG(B,C)
 Resolve-B-1. B -> T : [PCS(A,C,B,T),S-SIG(B,C)]
 Resolve-B-2. T -> B : if (aborted) then
S-SIG(T,S-SIG(A,[C,A,B,abort])) else if (resolved) S-SIG(A,C) else
TP-SIG(A,C)


Geopriv with pseudonym for Location Recipient only

T, LR, LS : principal
K_T_LR, K_T_LS : symkey
K_LS : public_key
N_LR : text
Psi_LR, PW_LR : text
K_LR : symkey
LI : text
PR : hash_func

1. LR -> T  : LR, {LR, N_LR}K_T_LR
2. LR <- T  : Psi_LR, {PW_LR, N_LR}K_T_LR
3. LS <- T  : T, Psi_LR, {PW_LR, T, PR}K_T_LS
4. LR -> LS : Psi_LR, {PW_LR, K_LR, T}K_LS
5. LR <- LS : {PR(LI), T}K_LR


Geopriv with pseudonyms for Location Recipient and Target

T, LR, LS : principal
K_T_LR : symkey
K_LS : public_key
N_LR : text
Psi_LR, Psi_T : text
K_LR : symkey
LI : text
PR : hash_func

1. LR -> T  : LR, {LR, K_LR, N_LR}K_T_LR
2. LR <- T  : {Psi_LR, Psi_T, N_LR}K_T_LR
3. LS <- T  : {Psi_LR, Psi_T, PR, LI, K_LR}K_LS
4. LR -> LS : {Psi_LR, Psi_T}K_LS
5. LR <- LS : {PR(LI), Psi_T}K_LR


Gong

A, B, S : principal
 Na, Nb, Ns : number
 Pa, Pb : number
 K, Ha, Hb : number
 f1 : number, number, number, number -> number
 f2 : number, number, number, number -> number
 f3 : number, number, number, number -> number
 g : number, number, number, number -> number
 xor : number,number -> number
 alias K = f1(Ns,Na,B,Pa)
 alias Ha = f2(Ns,Na,B,Pa)
 alias Hb = f3(Ns,Na,B,Pa)

1. A -> B : A, B, Na
 2. B -> S : A, B, Na, Nb
 3. S -> B : Ns, xor(f1(Ns, Nb, A, Pb), K),
 xor(f2(Ns, Nb, A, Pb), Ha),
 xor(f3(Ns, Nb, A, Pb), Hb),
 g(K, Ha, Hb, Pb)
 4. B -> A : Ns, Hb
 5. A -> B : Ha


H.530 Symmetric Security for H.323 Mobility (Fixed)

MT, VGK, AuF : principal
ZZ, ZZ_VA : symkey
X, Y : nonce
CH1, CH2, CH3, CH4 : nonce
NIL, G : text
F : hash_func
exp : text, nonce -> message
alias M1 = MT, VGK, NIL, CH1, exp(G, X)
alias M2 = M1, F(ZZ, M1), VGK, xor(exp(G, X), exp(G, Y))
alias M3 = VGK, MT, F(ZZ, VGK), F(ZZ, xor(exp(G, X), exp(G, Y))), xor(exp(G, X), exp(G, Y))
alias M4 = VGK, MT, CH1, CH2, exp(G, Y), F(ZZ, xor(exp(G, X), exp(G, Y))), F(ZZ, VGK)
alias M5 = MT, VGK, CH2, CH3
alias M6 = VGK, MT, CH3, CH4

1. MT  -> VGK : M1, F(ZZ, M1)
2. VGK -> AuF : M2, F(ZZ_VA, M2)
3. AuF -> VGK : M3, F(ZZ_VA, M3)
4. VGK -> MT  : M4, F(exp(exp(G, X), Y), M4)
5. MT  -> VGK : M5, F(exp(exp(G, X), Y), M5)
6. VGK -> MT  : M6, F(exp(exp(G, X), Y), M6)


H.530 Symmetric Security for H.323 Mobility (Original)

MT, VGK, AuF : principal
ZZ, ZZ_VA : symkey
X, Y : nonce
CH1, CH2, CH3, CH4 : nonce
NIL, G : text
F : hash_func
exp : text, nonce -> message
alias M1 = MT, VGK, NIL, CH1, exp(G, X)
alias M2 = M1, F(ZZ, M1), VGK, xor(exp(G, X), exp(G, Y))
alias M3 = VGK, MT, F(ZZ, VGK), F(ZZ, xor(exp(G, X), exp(G, Y)))
alias M4 = VGK, MT, CH1, CH2, exp(G, Y), F(ZZ, xor(exp(G, X), exp(G, Y))), F(ZZ, VGK)
alias M5 = MT, VGK, CH2, CH3
alias M6 = VGK, MT, CH3, CH4

1. MT  -> VGK : M1, F(ZZ, M1)
2. VGK -> AuF : M2, F(ZZ_VA, M2)
3. AuF -> VGK : M3, F(ZZ_VA, M3)
4. VGK -> MT  : M4, F(exp(exp(G, X), Y), M4)
5. MT  -> VGK : M5, F(exp(exp(G, X), Y), M5)
6. VGK -> MT  : M6, F(exp(exp(G, X), Y), M6)


Hwang and Chen modified SPLICE/AS

S, C, AS : principal
 N1, N2, N3 : nonce
 T : timestamp
 L : lifetime
 pk, sk : principal -> key (keypair)

1. C -> AS : C, S, N1
 2. AS -> C : AS, {AS, C, N1, S, pk(S)}sk(AS)
 3. C -> S : C, S, {C, T, L, {N2}pk(S)}sk(C)
 4. S -> AS : S, C, N3
 5. AS -> S : AS, {AS, S, N3, C, pk(C)}sk(AS)
 6. S -> C : S, C, {S, inc(N2)}pk(C)


Hwang modified version of Neumann Stubblebine

A, B, S : principal
 Na, Ma, Nb, Mb : number
 Kas, Kbs, Kab : key
 Ta, Tb : time

1. A -> B : A, Na
 2. B -> S : B, {A, Na, Tb, Nb}Kbs
 3. S -> A : {B, Na, Kab, Tb}Kas, {A, Kab, Tb}Kbs, Nb
 4. A -> B : {A, Kab, Tb}Kbs, {Nb}Kab
 5. A -> B : Ma, {A, Kab, Tb}Kbs
 6. B -> A : Mb, {Mb}Kab
 7. A -> B : {Mb}Kab


IEEE 802.1X EAPOL over RADIUS

C, A, S : principal
Kcs : symkey
NAS_ID, NAS_PORT : text
Chall_Message : text
Success : text
EAPOL_Start, EAPOL_Req_Identity, EAPOL_Success, Access_accept : text
MD5 : hash_func

1. C -> A : EAPOL_Start
2. A -> C : EAPOL_Req_Identity
3. C -> A : NAS_ID, NAS_PORT, MD5(Kcs)
4. A -> S : NAS_ID, NAS_PORT, MD5(Kcs)
5. S -> A : NAS_ID, Chall_Message
6. A -> C : NAS_ID, Chall_Message
7. C -> A : NAS_ID, {Chall_Message}Kcs
8. A -> S : NAS_ID, {Chall_Message}Kcs
9. S -> A : NAS_ID, Access_accept
10. A -> C : EAPOL_Success
11. C -> A : NAS_ID, Success


ISO Five-Pass Authentication Protocol

A, B, S : principal
Kab : session symkey
Kas, Kbs : long-term symkeys
Ra, Rb, R'b : nonce
Text1, Text2, Text3, Text4, Text5, Text6, Text7, Text8, Text9 : text

1. A -> B : Ra, Text1
2. B -> S : R'b, Ra, A, Text2
3. S -> B : Text5, {B, Kab, Ra, Text3}Kas, {A, Kab, R'b, Text4}Kbs
4. B -> A : Text7, {B, Kab, Ra, Text3}Kas, {Ra, Rb, Text6}Kab
5. A -> B : Text9, {Ra, Rb, Text8}Kab


ISO One-Pass Unilateral Authentication Protocol with CCFs

A, B : principal
Kab : shared key between A and B
Na : nonce
fKab : keyed cryptographic check function
text1, text2 : text messages

1. A -> B : [Ta|Na], B, text2, fKab([Ta|Na], B, text1)


ISO Public Key One-Pass Unilateral Authentication Protocol

A, B : principal
Ka-1 : private key of A
Na : nonce
CertA : certificate of A
text1, text2 : text

1. A -> B : CertA, [Ta|Na], B, text2, E(Ka-1: [Ta|Na], B, text1)


ISO Public Key Three-Pass Mutual Authentication Protocol

A, B : principal
Ka-1, Kb-1 : private keys of A and B
Ra, Rb : nonces
CertA, CertB : certificates of A and B
text1, text2, text3, text4, text5 : text

1. B -> A : Rb, text1
2. A -> B : CertA, Ra, Rb, B, text3, E(Ka-1: Rb, Ra, B, text2)
3. B -> A : CertB, Rb, Ra, A, text5, E(Kb-1: Rb, Ra, A, text4)


ISO Public Key Two-Pass Mutual Authentication Protocol

A, B : principal
Ka-1, Kb-1 : private keys of A and B
Ta, Tb : timestamps
Na, Nb : nonces
CertA, CertB : certificates of A and B
text1, text2, text3, text4 : text

1. A -> B : CertA, [Ta|Na], B, text2, E(Ka-1: [Ta|Na], B, text1)
2. B -> A : CertB, [Tb|Nb], A, text4, E(Kb-1: [Tb|Nb], A, text3)


ISO Public Key Two-Pass Parallel Mutual Authentication Protocol

A, B : principal
Ka-1, Kb-1 : private keys of A and B
Ra, Rb : nonces
CertA, CertB : certificates of A and B
text1, text2, text3, text4, text5, text6 : text

1. A -> B : CertA, Ra, text1
2. B -> A : Rb, Ra, A, text6, E(Kb-1: Rb, Ra, A, text5)
3. B -> A : CertB, Rb, text2
4. A -> B : Ra, Rb, B, text4, E(Ka-1: Rb, Ra, B, text3)


ISO Public Key Two-Pass Unilateral Authentication Protocol

A, B : principal
Ka-1 : private key of A
rA, rB : random numbers (nonces)
CertA : certificate of A
text1, text2, text3 : text

1. B -> A : rB, text1
2. A -> B : CertA, rA, rB, B, text3, E(Ka-1: rB, rA, B, text2)


ISO Symmetric Key One-Pass Unilateral Authentication Protocol

A, B : principal
Kab : symkey
Na : nonce
text1, text2 : text

1. A -> B : text2, {Ta | Na, B, text1}Kab


ISO Symmetric Key Three-Pass Mutual Authentication Protocol

A, B : principal
Kab : symkey
Ra, Rb : nonce
text1, text2, text3, text4, text5 : text

1. B -> A : Rb, text1
2. A -> B : text3, {Ra, Rb, B, text2}Kab
3. B -> A : text5, {Ra, Rb, text4}Kab


ISO Symmetric Key Two-Pass Mutual Authentication Protocol

A, B : principal
Kab : symkey
Na, Nb : nonce
text1, text2, text3, text4 : text

1. A -> B : text2, {Na, B, text1}Kab
2. B -> A : text4, {Nb, A, text3}Kab


ISO Symmetric Key Two-Pass Unilateral Authentication Protocol

A, B : principal
Kab : symkey
Rb : nonce
text1, text2, text3 : text

1. B -> A : Rb, text1
2. A -> B : text3, {Rb, B, text2}Kab


ISO Three-Pass Mutual Authentication Protocol with CCFs

A, B : principal
Kab : shared key between A and B
Ra, Rb : nonces generated by A and B respectively
fKab : keyed cryptographic check function
text1, text2, text3, text4, text5 : text messages

1. B -> A : Rb, text1
2. A -> B : Ra, text3, fKab(Ra, Rb, B, text2)
3. B -> A : text5, fKab(Rb, Ra, A, text4)


ISO Two-Pass Mutual Authentication Protocol with CCFs

A, B : principal
Kab : shared key between A and B
Na, Nb : nonces generated by A and B respectively
fKab : keyed cryptographic check function
text1, text2, text3, text4 : text messages

1. A -> B : [Ta|Na], text2, fKab([Ta|Na], B, text1)
2. B -> A : [Ta|Na], text4, fKab([Tb|Nb], A, text3)


ISO Two-Pass Unilateral Authentication Protocol with CCFs

A, B : principal
Kab : shared key between A and B
Rb : random nonce generated by B
fKab : keyed cryptographic check function
text1, text2, text3 : text messages

1. B -> A : Rb, text1
2. A -> B : text3, fKab(Rb, B, text2)


Idemix Anonymous Credential

User, Issuer, Verifier : principal
Nu, Ns, NuPrime, NsPrime : nonce
masec : master_secret
K_ptag, K_spk : fresh symkey

1. User -> Issuer : commit(masec, Issuer, Nu)
2. Issuer -> User : credential(Issuer, ptag(masec, Issuer, Nu, Ns), attributes)
3. User -> Verifier : ptag(masec, Verifier, NuPrime, NsPrime), spk(masec, public_values, statement, message)


KSL

A, B, S : principal
 Na, Nb, Nc, Ma, Mb : number
 Kas, Kbs, Kab, Kbb : key
 Tb : generalizedTimestamp

1. A -> B : Na, A
 2. B -> S : Na, A, Nb, B
 3. S -> B : {Nb, A, Kab}Kbs, {Na, B, Kab}Kas
 4. B -> A : {Na, B, Kab}Kas, {Tb, A, Kab}Kbb, Nc, {Na}Kab
 5. A -> B : {Nc}Kab
 6. A -> B : Ma, {Tb, A, Kab}Kbb
 7. B -> A : Mb, {Ma}Kab
 8. A -> B : {Mb}Kab


Kao Chow Authentication v.1

A, B, S : principal
 Na, Nb : number
 Kab, Kbs, Kas : key

1. A -> S : A, B, Na
 2. S -> B : {A, B, Na, Kab}Kas, {A, B, Na, Kab}Kbs
 3. B -> A : {A, B, Na, Kab}Kas, {Na}Kab, Nb
 4. A -> B : {Nb}Kab


Kao Chow Authentication v.2

A, B, S : principal
 Na, Nb : number
 Kab, Kbs, Kas : key

1. A -> S : A, B, Na
 2. S -> B : {A, B, Na, Kab, Kt}Kas, {A, B, Na, Kab, Kt}Kbs
 3. B -> A : B, {A, B, Na, Kab, Kt}Kas, {Na, Kab}Kt, Nb
 4. A -> B : {Nb, Kab}Kt


Kao Chow Authentication v.3

A, B, S : principal
 Na, Nb : number
 Kab, Kbs, Kas : key

1. A -> S : A, B, Na
 2. S -> B : {A, B, Na, Kab, Kt}Kas, {A, B, Na, Kab, Kt}Kbs
 3. B -> A : {A, B, Na, Kab, Kt}Kas, {Na, Kab}Kt, Nb, {A, B, Ta,
Kab}Kbs
 4. A -> B : {Nb, Kab}Kt, {A, B, Ta, Kab}Kbs


Kerberos V5

A, G, C, S, U : principal
 N1, N2 : nonce
 L1, L2 : nonce
 T1start, T1expire : timestamp
 T2start, T2expire : timestamp
 Kcg, Kcs, Kag, Ku, Kgs : key

1. C -> A : U, G, L1, N1
 2. A -> C : U, {U, C, G, Kcg, T1start, T1expire}Kag,
 {G, Kcg, T1start, T1expire}Ku
 3. C -> G : S, L2, N2, {U, C, G, Kcg, T1start, T1expire}Kag,
 {C, T1}Kcg
 4. G -> C : U, {U, C, S, Kcs, T2start, T2expire}Kgs,
 {S, Kcs, T2start, T2expire, N2}Kcg
 5. C -> S : {U, C, S, Kcs, T2start, T2expire}Kgs,
 {C, T2}Kcs
 6. S -> C : {T2}Kcs


Lowe modified BAN concrete Andrew Secure RPC

A, B : principal
 Kab, K'ab : symkey
 Na, Nb, N'b : nonce
 succ : nonce -> nonce

1. A -> B : A, Na
 2. B -> A : {Na, K'ab, B}Kab
 3. A -> B : {Na}K'ab
 4. B -> A : Nb


Lowe modified Denning-Sacco shared key

A, B, S : principal
 Nb : nonce
 Kas, Kbs, Kab : key
 T : timestamp
 dec : nonce -> nonce

1. A -> S : A, B
 2. S -> A : {B, Kab, T, {Kab, A, T}Kbs}Kas
 3. A -> B : {Kab,A, T}Kbs
 4. B -> A : {Nb}Kab
 5. A -> B : {dec(Nb)}Kab


Lowe modified KSL

A, B, S : principal
 Na, Nb, Nc, Ma, Mb : number
 Kas, Kbs, Kab, Kbb : key
 Tb : generalizedTimestamp

1. A -> B : Na, A
 2. B -> S : Na, A, Nb, B
 3. S -> B : {A, Nb Kab}Kbs, {Na, B, Kab}Kas
 4. B -> A : {Na, B, Kab}Kas, {Tb, A, Kab}Kbb, Nc, {B, Na}Kab
 5. A -> B : {Nc}Kab
 6. A -> B : Ma, {Tb, A, Kab}Kbb
 7. B -> A : Mb, {Ma, B}Kab
 8. A -> B : {A, Mb}Kab


Lowe modified Wide Mouthed Frog

A, S : principal
 Kas, Kbs, Kab : symkey
 Nb : nonce
 Ta, Ts : timestamp
 suc : nonce -> nonce

1. A -> S : A, {Ta, B, Kab}Kas
 2. S -> B : {Ts, A, Kab}Kbs
 3. B -> A : {Nb}Kab
 4. A -> B : {succ(Nb)}Kab


Lowe's fixed version of Needham-Schroder Public Key

A,B,S : Principal
 Na,Nb : Nonce
 KPa,KPb,KPs,KSa,KSb,KSs : Key
 KPa,KSa : is a key pair
 KPb,KSb : is a key pair
 KPs,KSs : is a key pair

1. A -> S : A,B
 2. S -> A : {KPb, B}KSs
 3. A -> B : {Na, A}KPb
 4. B -> S : B,A
 5. S -> B : {KPa, A}KSs
 6. B -> A : {Na, Nb, B}KPa
 7. A -> B : {Nb}KPb


Lowe's modified version of Yahalom

A, B, S : principal
 Na, Nb : number fresh
 Kas, Kbs, Kab : key
 A knows : A, B, S, Kas
 B knows : B, S, Kbs
 S knows : S, A, B, Kas, Kbs

1. A -> B : A, Na
 2. B -> S : {A, Na, Nb}Kbs
 3. S -> A : {B, Kab, Na, Nb}Kas
 4. S -> B : {A, Kab}Kbs
 5. A -> B : {A, B, S, Nb}Kab


Needham Schroeder Symmetric Key

A, B, S : principal
 Na, Nb : nonce
 Kas, Kbs, Kab : key
 dec : nonce -> nonce

1. A -> S : A, B, Na
 2. S -> A : {Na, B, Kab, {Kab, A}Kbs}Kas
 3. A -> B : {Kab,A}Kbs
 4. B -> A : {Nb}Kab
 5. A -> B : {dec(Nb)}Kab


Needham-Schroeder Public Key

A,B,S : Principal
 Na,Nb : Nonce
 KPa,KPb,KPs,KSa,KSb,KSs : Key
 KPa,KSa : is a key pair
 KPb,KSb : is a key pair
 KPs,KSs : is a key pair

1. A -> S : A,B
 2. S -> A : {KPb, B}KSs
 3. A -> B : {Na, A}KPb
 4. B -> S : B,A
 5. S -> B : {KPa, A}KSs
 6. B -> A : {Na, Nb}KPa
 7. A -> B : {Nb}KPb


Neumann Stubblebine

A, B, S : principal
 Na, Ma, Nb, Mb : number
 Kas, Kbs, Kab : key
 Ta, Tb : time

1. A -> B : A, Na
 2. B -> S : B, {A, Na, Tb}Kbs, Nb
 3. S -> A : {B, Na, Kab, Tb}Kas, {A, Kab, Tb}Kbs, Nb
 4. A -> B : {A, Kab, Tb}Kbs, {Nb}Kab
 5. A -> B : Ma, {A, Kab, Tb}Kbs
 6. B -> A : Mb, {Ma}Kab
 7. A -> B : {Mb}Kab


Otway Rees

A, B, S : principal
 M, Na, Nb : nonce
 Kas, Kbs, Kab : key

1. A -> B : M, A, B, {Na, M, A, B}Kas
 2. B -> S : M, A, B, {Na, M, A, B}Kas , {Nb, M, A, B}Kbs
 3. S -> B : M, {Na, Kab}Kas, {Nb, Kab}Kbs
 4. B -> A : M, {Na, Kab}Kas


PEAP with MS-CHAP

P, S : principal
Ks, Kca : public_key
Pw : symmetric_key
Np, Ns, PMS : nonce
SessionID, CipherSuite : text
Ccs : text
H1, H2, PRF, KeyGen : hash_func
alias M = PRF(PMS, Np, Ns)
alias ClientK = KeyGen(P, Np, Ns, M)
alias ServerK = KeyGen(S, Np, Ns, M)
alias Finished = H1(M, P, S, Np, CipherSuite, SessionID)

1. S -> P : id_request
2. P -> S : P
3. S -> P : start_peap
4. P -> S : Np, SessionID, CipherSuite
5. S -> P : Ns, SessionID, CipherSuite, {S, Ks}inv(Kca)
6. P -> S : {PMS}Ks, Ccs
7. S -> P : Ccs, {Finished}ServerK
8. P -> S : {P}ClientK
9. S -> P : {Ns}ServerK
10. P -> S : {Np, H2(Pw, Np, Ns, P)}ClientK
11. S -> P : {H2(Pw, Np)}ServerK
12. P -> S : ack_message
13. S -> P : eap_success


Paulson's strengthened version of Yahalom

A, B, S : principal
 Na, Nb : number fresh
 Kas, Kbs, Kab : key
 A knows : A, B, S, Kas
 B knows : B, S, Kbs
 S knows : S, A, B, Kas, Kbs

1. A -> B : A, Na
 2. B -> S : B, Nb, {A, Na}Kbs
 3. S -> A : Nb, {B, Kab, Na}Kas, {A, B, Kab, Nb}Kbs
 4. A -> B : {A, B, Kab, Nb}Kbs, {Nb}Kab


RADIUS Remote Authentication Dial In User Service

C, S : principal
Kcs : symkey
NAS_ID, NAS_PORT : text
Success, Failure, Access_accept, Access_reject : text
MD5 : hash_func

1. C -> S : NAS_ID, NAS_PORT, MD5(Kcs)
2. S -> C : NAS_ID, Access_accept
3. C -> S : NAS_ID, Success


RADIUS Remote Authentication Dial In User Service (with challenge)

C, S : principal
Kcs : symkey
NAS_ID, NAS_PORT : text
Chall_Message : text
Success, Failure, Access_accept, Access_reject : text
MD5 : hash_func

1. C -> S : NAS_ID, NAS_PORT, MD5(Kcs)
2. S -> C : NAS_ID, Chall_Message
3. C -> S : NAS_ID, {Chall_Message}Kcs
4. S -> C : NAS_ID, Access_accept
5. C -> S : NAS_ID, Success


SAML v.2 Web SSO Profile (IdP-initiated with back channels)

C, IdP, SP : principal
KIdP : public_key
URI : protocol_id
IDaa, IDresolve, Resource, REF : text

1. C -> IdP : C, URI, SP
2. IdP -> C : SP, IdP, REF
3. C -> SP : IdP, REF
4. SP -> IdP : IDresolve, SP, IdP, REF
5. IdP -> SP : IDresolve, IdP, URI, IDaa, SP, IdP, C, URI
6. SP -> C : URI, Resource


SAML v.2 Web SSO Profile (IdP-initiated with front channels)

C, IdP, SP : principal
KIdP : public_key
URI : protocol_id
IDaa, Resource : text

1. C -> IdP : C, URI, SP
2. IdP -> C : IdP, URI, IDaa, SP, IdP, C, URI
3. C -> SP : IDaa, IdP, URI, SP, C
4. SP -> C : URI, Resource


SAML v.2 Web SSO Profile (SP-initiated with back channels)

C, IdP, SP : principal
KIdP : public_key
URI : protocol_id
IDar, IDaa, IDresolve_1, IDresolve_2, Resource, REF_1, REF_2 : text

1. C -> SP : C, URI
2. SP -> C : IdP, SP, REF_1
3. C -> IdP : C, SP, REF_1
4. IdP -> SP : IDresolve_1, IdP, SP, REF_1
5. SP -> IdP : IDresolve_1, SP, IdP, IDar, URI
6. IdP -> C : SP, IdP, REF_2
7. C -> SP : IdP, REF_2
8. SP -> IdP : IDresolve_2, SP, IdP, REF_2
9. IdP -> SP : IDresolve_2, IdP, URI, IDar, {SP, IdP, C, IDaa, URI}inv(KIdP)
10. SP -> C : URI, Resource


SAML-based SSO for Google Apps (SP-initiated with front channels, fixed variant)

C, IdP, SP : principal
KIdP : public_key
URI : protocol_id
ID, Resource : text

1. C -> SP : URI
2. SP -> C : C, IdP, (ID, SP), URI
3. C -> IdP : C, IdP, (ID, SP), URI
4. IdP -> C : SP, {SP, C, IdP, ID}inv(KIdP), URI
5. C -> SP : SP, {SP, C, IdP, ID}inv(KIdP), URI
6. SP -> C : Resource


SAML-based SSO for Google Apps (SP-initiated, Google unsafe variant)

C, IdP, SP : principal
KIdP : public_key
URI : protocol_id
ID, Resource : text

1. C -> SP : URI
2. SP -> C : C, IdP, (ID, SP), URI
3. C -> IdP : C, IdP, (ID, SP), URI
4. IdP -> C : SP, {C, IdP}inv(KIdP), URI
5. C -> SP : SP, {C, IdP}inv(KIdP), URI
6. SP -> C : Resource


SIP Diameter Session Initiation Protocol

UAC, SS1, SS2, DS : principal
Nonce : nonce
PWD : text
Dest : protocol_id
H : hash_func
sipregister, sip401, sip200 : protocol_id

1.  UAC -> SS1 : sipregister, UAC, Dest
2.  SS1 -> DS  : UAC, Dest
3.  DS  -> SS1 : UAC, SS2
4.  SS1 -> SS2 : sipregister, UAC, Dest
5.  SS2 -> DS  : Dest, UAC
6.  DS  -> SS2 : Nonce, UAC
7.  SS2 -> SS1 : sip401, Nonce
8.  SS1 -> UAC : sip401, Nonce
9.  UAC -> SS1 : sipregister, UAC, Dest, Nonce, H(Nonce, H(UAC, PWD), H(Dest))
10. SS1 -> DS  : UAC, Dest
11. DS  -> SS1 : UAC, SS2
12. SS1 -> SS2 : sipregister, UAC, Dest, Nonce, H(Nonce, H(UAC, PWD), H(Dest))
13. SS2 -> DS  : Dest, UAC, Nonce, H(Nonce, H(UAC, PWD), H(Dest))
14. DS  -> SS2 : UAC, success
15. SS2 -> SS1 : sip200
16. SS1 -> UAC : sip200


SK3

A, B, S, Ca, Cb : principal
 Ka, Kb : symkey
 Kac, Kbc : symkey
 Na, Nb : nonce
 0,1,2 : number
 alias Kab = {A, 0}Kb
 alias Pab = Kab + {B, 1}Ka

1. A -> S : A, B
 2. S -> A : Pab, {Pab, B, 2}Ka
 3. A -> Ca : A
 4. Ca -> A : Na, {Na, 1, 1}Kac
 5. A -> B : A, Na
 6. B -> Cb : A, Na
 7. Cb -> B : Nb, {Nb, 0, 0}Kab, {Na, Nb, 1}Kab, {Nb, 0, 1}Kab
 8. B -> A : Nb, {Na, Nb, 1}Kab
 9. A -> Ca : B, Na, Nb, Pab, {Pab, B, 2}Ka, {Na, Nb, 1}Kab,
{Nb, 0, 1}Kab
10. Ca -> A : {Nb, 0, 0}Kab, {Nb, 0, 1}Kab
11. A -> B : {Nb, 0, 1}Kab


SPLICE/AS

S, C, AS : principal
 N1, N2, N3 : nonce
 T : timestamp
 L : lifetime
 pk, sk : principal -> key (keypair)

1. C -> AS : C, S, N1
 2. AS -> C : AS, {AS, C, N1, pk(S)}sk(AS)
 3. C -> S : C, S, {C, T, L, {N2}pk(S)}sk(C)
 4. S -> AS : S, C, N3
 5. AS -> S : AS, {AS, S, N3, pk(C)}sk(AS)
 6. S -> C : S, C, {S, inc(N2)}pk(C)


SRP: Secure Remote Passwords

A, B: principal (Client, Server)
Password: shared secret between A and B
Salt: random value known to server, used to prevent dictionary attacks
G: generator for Diffie-Hellman exponentiation
Na, Nb: nonces generated by A and B respectively
V: password verifier = g^x mod N, with x = SHA(salt | SHA(A | ':' | Password))
DHX, DHY: Diffie-Hellman public values
K: session key derived from DH values and verifier
M: proof of key, H(A,B,K,...)

1. A -> B: A, G^Na
2. B -> A: Salt, {G^Nb}_V
3. A -> B: M
4. B -> A: H(G^Na, M, K)


Schnorr's Protocol

A, B : principal
 Na, Nb : fresh number
 Sa : private key
 Pa = exp(g,Sa) : public key
 A chooses Na and computes a = exp(g,Na)

1. A -> B : a
 B chooses Nb
 2. B -> A : Nb
 A computes r = Na + Nb Sa
 3. A -> B : r
 B checks that exp(g, r) = a exp(Pa,Nb)


Shamir-Rivest-Adleman Three Pass Protocol

A, B : principal
 Ka, Kb : symkey
 M : fresh number

1. A -> B : {M}Ka
 2. B -> A : {{M}Ka}Kb
 3. A -> B : {M}Kb


SmartRight view-only

CC, TC : principal
 VoKey, VoR, VoRi, CW : number
 Kc : key
 h : number -> number

1. CC -> TC : {VoKey, CW+VoR}Kc
 2. TC -> CC : VoRi
 3. CC -> TC : VoR, {h(VoRi)}VoKey


TESLA: Timed Efficient Stream Loss-tolerant Authentication

S, R: principal
K_N: random symmetric key generated by S
K_i: keys derived from K_N using a one-way function F
M_i: messages broadcast by S
N: total number of messages
F: one-way hash function
text: generic message content

1. S -> R: {N, K_0}inv(K_S) where K_0 = F^N(K_N)
2. For i = 1 to N-1, S -> R: M_i, hash(K_i, M_i), K{i-1}


TMN

A, B, S : principal
 Ka, Kb : key
 PK, SK : principal -> key (keypair)

1. A -> S : B, {Ka}PK(S)
 2. S -> B : A
 3. B -> S : A, {Kb}PK(S)
 4. S -> A : B, {Kb}Ka


TSIG Transaction Signature

C, S : principal
K : symkey
N1, N2 : nonce
M1, M2 : text
TAG1, TAG2 : text
H : hash_func

1. C -> S : TAG1, M1, {H(TAG1, M1), N1}K
2. S -> C : TAG2, M1, M2, {H(TAG2, M1, M2), N2}K


UMTS-AKA: Authentication and Key Agreement

S, M: principal (Server, Mobile)
k(M): shared secret key between S and M
seq: sequence number maintained by both S and M
r: random nonce generated by S
F1, F2, F3, F4, F5: cryptographic hash or one-way functions
CK, IK, KA: session keys derived from k(M) and r
AUTN: authentication token

1. M -> S: M
2. S -> M: r; {seq}_Ka; F1(k(M); seq; r)
3. M computes KA, seq, and verifies F1(k(M); seq; r); if valid, increments seq
4. M -> S: F2(k(M); r)


Using Non-reversible Function Protocol

A, B : principal
Kab, K : symkey
Ra, Rb : nonce
f : randomNo -> msg

1. B -> A : B, Rb
2. A -> B : A, {f(Rb), Ra, A, K}Kab
3. B -> A : B, {f(Ra)}K


Wide Mouthed Frog

A, S : principal
 Kas, Kbs, Kab : symkey
 Ta, Ts : timestamp

1. A -> S : A, {Ta, B, Kab}Kas
 2. S -> B : {Ts, A, Kab}Kbs


Wired Equivalent Privacy Protocol

A, B : principal
 Kab : symkey
 RC4 : message, symkey -> message
 C : message -> message

1. A -> B : v, ((M,C(M)) xor RC4(v,Kab))


Woo and Lam Mutual Authentication

P, Q, S : principal
 Kps, Kqs, Kpq : key
 N1, N2 : number

1. P -> Q : P, N1
 2. Q -> P : Q, N2
 3. P -> Q : {P, Q, N1, N2}Kps
 4. Q -> S : {P, Q, N1, N2}Kps, {P, Q, N1, N2}Kqs
 5. S -> Q : {Q, N1, N2, Kpq}Kps, {P, N1, N2,Kpq}Kqs
 6. Q -> P : {Q, N1, N2, Kpq}Kps, {N1, N2}Kpq
 7. P -> Q : {N2}Kpq


Woo and Lam Pi

A, B, S : principal
 Nb : nonce
 Kas, Kbs : skey

1. A -> B : A
 2. B -> A : Nb
 3. A -> B : {Nb}Kas
 4. B -> S : {A, {Nb}Kas}Kbs
 5. S -> B : {Nb}Kbs


Woo and Lam Pi 1

A, B, S : principal
 Nb : nonce
 Kas, Kbs : skey

1. A -> B : A
 2. B -> A : Nb
 3. A -> B : {A,B,Nb}Kas
 4. B -> S : {A, B, {A, B, Nb}Kas}Kbs
 5. S -> B : {A, B, Nb}Kbs


Woo and Lam Pi 2

A, B, S : principal
 Nb : nonce
 Kas, Kbs : skey

1. A -> B : A
 2. B -> A : Nb
 3. A -> B : {A,Nb}Kas
 4. B -> S : {A, {A, Nb}Kas}Kbs
 5. S -> B : {A, Nb}Kbs


Woo and Lam Pi 3

A, B, S : principal
 Nb : nonce
 Kas, Kbs : skey

1. A -> B : A
 2. B -> A : Nb
 3. A -> B : {Nb}Kas
 4. B -> S : {A, {Nb}Kas}Kbs
 5. S -> B : {A, Nb}Kbs


Woo and Lam Pi f

A, B, S : principal
 shared : (principal, principal):key
 Nb : nonce

1. A -> B : A
 2. B -> A : Nb
 3. A -> B : {A,B,Nb}shared(A, S)
 4. B -> S : {A, B, Nb, {A, B, Nb}shared(A, S)}shared(B, S)
 5. S -> B : {A, B, Nb}shared(B, S)


Yahalom

A, B, S : principal
 Na, Nb : number fresh
 Kas, Kbs, Kab : key
 A knows : A, B, S, Kas
 B knows : B, S, Kbs
 S knows : S, A, B, Kas, Kbs

1. A -> B : A, Na
 2. B -> S : B, {A, Na, Nb}Kbs
 3. S -> A : {B, Kab, Na, Nb}Kas, {A, Kab}Kbs
 4. A -> B : {A, Kab}Kbs, {Nb}Kab