Attack on Double Encryption Scheme
EDIT: I think what I do is provide a little more than a hint so don't read further if that is an issue.


   This problem is very much like the NSL protocol in that it allows an intermediary due to neither party declaring their own identity:


That is:


   A -&gt; E : { &lt;[A, {K}pk(E)]&gt; }pk(E) }  E -&gt; B : { &lt;[A, {K}pk(B)]&gt; }pk(B) }  B -&gt; E : { &lt;[B, {K}pk(A)]&gt; }pk(A) }  E -&gt; A the above


Resulting in:


   Now B believes it has a shared channel with A but E is involved.  You can even simplify and omit A entirely since its existence was never proven to party B:


Alternatively:


   E -&gt; B : { &lt;[A, {K}pk(B)]&gt; }pk(B) } B -&gt; anyone : { &lt;[B, {K}pk(A)]&gt;}pk(A) }


and


   Now 'B' presumably believes key $K$ is shared with party $A$ when in fact party $E$ holds a copy.