= Solution
Alice's own freshness evidence is the ticket
$$
U=E_{\mathit{pk}_A}(\mathit{nonce}_A\Vert\mathit{secret}_A\Vert A\Vert B\Vert k_{AB}).
$$
After <decryption>, she checks her pending <cryptographic nonce>, the long-term shared secret and both identities. Only Alice and Tim know $\mathit{secret}_A$; with honest Tim and an unpredictable new $\mathit{nonce}_A$, a valid matching ticket establishes that Tim generated this <session key> after that challenge was issued. A merely unused but predictable challenge does not establish that temporal ordering.
The claimed <authentication> of Alice to Bob, however, is false for the printed <protocol>. To exhibit the failure, let $I$ initiate message 1 using Alice's name while Alice is absent. Bob and Tim carry out messages 2 and 3 normally. Write the genuine message 3 as $(U,b,V)$, where $b=\mathit{nonce}_B$ and $V=E_{\mathit{pk}_B}(A\Vert B\Vert k_{AB})$. The adversary intercepts it, learns the unencrypted $b$, and chooses a symmetric key $z$ of its own.
The adversary sends Bob
$$
\bigl(U,b,E_{\mathit{pk}_B}(A\Vert B\Vert z)\bigr).
$$
Bob's checks of $b$ and the ticket identities pass, because anyone can encrypt using his <public key>. Bob sends message 4 using $z$; the adversary suppresses that message and returns $E_z(\text{Hello Bob})$ as message 5. Bob accepts Alice, although Alice has done nothing. No <encryption> has been broken.
$$
\boxed{\text{Alice can check her ticket's freshness, but Bob has not authenticated Alice.}}
$$
The tempting intended argument is that only Alice, Bob and Tim could know the transported key, so message 5 proves Alice's participation. The substituted ticket invalidates its premise: Bob's accepted key is $z$, which the adversary knows.
Back to article page
