Past exam of the computer science course of the University of Oxford / 2015 / Computer security / 2 / b / iii / Solution

The final messages contain fixed greetings, rather than a fresh challenge for their particular run. Their freshness is inherited entirely from the session key. If a key is reused, a previously recorded $E_k(\text{Hello Alice})$ or $E_k(\text{Hello Bob})$ becomes acceptable evidence again. An adversary can then mount a replay attack without knowing $k$ and without the purported speaker taking part in the new run.

Reusing a previously compromised session key is worse: the adversary can create both confirmations and read protected traffic. Fresh independent session keys limit that reuse, although they cannot fix the unauthenticated-ticket flaw shown in solution.