= Solution
Bob especially needs unpredictability, because $\mathit{nonce}_B$ is intended to be secret until Tim processes the request. A predictable counter destroys even that limited assurance.
If the adversary knows Bob's next value $b$, it initiates a run with Alice's name and intercepts Bob's request. Without consulting Tim, it chooses a key $z$, constructs $V^*=E_{\mathit{pk}_B}(A\Vert B\Vert z)$, and sends $(U^*,b,V^*)$ as message 3, with any suitably shaped opaque ticket $U^*$ for Alice. Bob cannot inspect that ticket. He accepts $z$, sends message 4, and accepts the adversary's $E_z(\text{Hello Bob})$. Alice and Tim need not participate.
This <preplay attack> requires a correct prediction of Bob's outstanding value, knowledge of his <public key>, and the ability to intercept or race the genuine response. Observing an earlier unencrypted response may expose a counter value from which to predict the next. With an independent uniformly random hidden $64$-<bit> value, blind prediction succeeds with <probability> $2^{-64}$ per attempt.
$$
\boxed{\text{A random hidden nonce blocks prediction, but not message-3 substitution.}}
$$
In particular, random <cryptographic nonces> do not make the printed <protocol> sound. After the genuine message 3 reveals $b$, the adversary can use exactly the substitution in <2/b/i/solution>. Predictability allows an earlier attack without Tim; lack of response binding allows an attack even with perfect unpredictability.
Back to article page
