= Solution
The final messages contain fixed greetings, rather than a fresh challenge for their particular run. Their freshness is inherited entirely from the <session key>. If a key is reused, a previously recorded $E_k(\text{Hello Alice})$ or $E_k(\text{Hello Bob})$ becomes acceptable evidence again. An adversary can then mount a <replay attack> without knowing $k$ and without the purported speaker taking part in the new run.
Reusing a previously compromised <session key> is worse: the adversary can create both confirmations and read protected traffic. Fresh independent <session keys> limit that reuse, although they cannot fix the unauthenticated-ticket flaw shown in <2/b/i/solution>.
$$
\boxed{\text{Fixed confirmations are fresh only when their session key is fresh.}}
$$
Back to article page
