Why is this authentication protocol with a nonce and tree parties not secure? Why is the following authentication service not secure?

C⟶S: $I_C$

S⟶C: $N$

C⟶S: $E(K_{C,A}, N)$

S⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$

A⟶S: $E(K_{S,A}, N)$

where:


C = client
S = server
A = authentication service
$I_X$ = identification string of entity X
$N$ is nonce
$E(K, M)$ is the encryption operation using key $K$ and message $M$
$K_{X,Y}$ = symmetric key shared by X and Y
Suppose that the client and server were once connected by random number $N$, and adversary is eavesdropped these messages. So he has $I_C$, $N$, $E(K_{C,A}, N)$, $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$ and $E(K_{S,A}, N)$. Now in the new session, the adversary can easily impersonate the identity of the server. To do so, just follow the steps below:

C⟶Adversary: $I_C$

Adversary⟶C: $N$

C⟶Adversary: $E(K_{C,A}, N)$

Adversary⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N)\})$

A⟶Adversary: $E(K_{S,A}, N)$

Note that in this protocol, the server can use $E(K_{S,A}, N)$ to verify client identity, but the client does not have any information about the identity of the server.

Edit: Also, an adversary cannot impersonate the client using $E(K_{C,A},N)$ because $N$ is generated by a valid server and will change in each session. Therefore, an adversary cannot find the valid $E(K_{C,A},N)$ using previous eavesdropped messages. To prevent this attack, you can modify the protocol as follows:

C⟶S: $I_C$

S⟶C: $N$

C⟶S: $E(K_{C,A}, N, M)$

S⟶A: $E(K_{S,A}, \{I_C, E(K_{C,A}, N, M)\})$

A⟶S: $E(K_{S,A}, N, E(K_{C,A}, M))$

S⟶C: $E(K_{C,A}, M)$

However, this is just a change, and the resistance of this protocol to other attacks should be investigated. "Cryptographic Protocol: Security Analysis Based on Trusted Freshness" By Ling Dong and Kefei Chen, is a valuable book on protocols that you can refer to for more information.