= Solution
A <denial-of-service attack> can exploit both an honest relay and replay at Tim. The adversary repeatedly sends cheap unauthenticated message-1 requests naming Alice and Bob. Bob then performs the public-key <encryption> in message 2, and Tim performs a private-key <decryption>, generates a <session key>, looks up the users' records and performs two public-key <encryptions>. The adversary's first messages contain no cryptographic work.
Alternatively, after observing one valid message 2, the adversary submits copies directly to Tim. It remains well formed; the printed <protocol> has no request-replay cache. Tim's promise to reject malformed requests does not imply duplicate suppression. Each replay can provoke the expensive operations again. If such a cache is added, the repeated-message-1 method still induces distinct requests through Bob unless admission is controlled.
$$
\boxed{\text{Unauthenticated initiations or replayed valid requests amplify work at Tim.}}
$$
Back to article page
