Understanding a faulty Needam-Schroeder protocol Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works.


A chooses $N$ (nonce) and sends to C (trusted server): $A, B, N$
C chooses $K$ and sends to A: $Kac(N, K, B, Kbc(K,A))$
Now Trudy acts in place of Alice
A decodes, checks $N$ and $B$, and sends to B: $Kbc(K,A)$
T (as A) replays to B: $Kbc(K',A)$, where $K'$ is an older session key
B decodes, chooses nonce $N'$ and sends to A: $K'(this is B, N')$
B sends to T (not to A): $K'$ (this is $B, N'$)
A sends to B, $K$ (this is $A, N'-1$)


If $Kbc$ is the shared secret key between Bob and the trusted server C, how is it possible for Trudy compute $Kbc(K',A)$? Trudy does not have $Kbc$…
The trick here is that Trudy does not need to know $K_{bc}$ (as you mentioned, it's not public). 

However, what Trudy really needs to do is observe (by just monitoring the network) and store a previous "$K_{bc}(K,A)$" value that A has sent to B (publicly) beforehand (step 4). 

So now in any future protocol sessions. Given that $K_{bc}$ is going to be the same, Trudy has the previous value it needs to preform the replay attack.