Use of nonces in Kerberos and Needham–Schroeder protocols Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport.

In particular :


Can you explain me the use of $N_A$?


And also, I suppose $N_B$ is used for the scope of letting $B$ know that $A$ shares the same key $K_{AB}$ and was able to decipher the value of $N_B$, alter it and encrypt it back by using $K_{AB}$.


Is this assumption correct?


And finally:


How does the use of the nonces provide more security to the protocol?


Here you can find more details about the two protocols.
For Needham-Schroeder, $N_A$ is used to prevent a replay attack. Look at the message from $S\to A$. Without a nonce, a malicious server could replay an old but valid response. The message would still decrypt, etc. Furthermore, the key $K_{AB}$ would be the same as a previously used key which could open up the system to more attacks.

It is the same for Kerberos.

You are correct with $N_B$. The only way Alice could return $N_B-1$ is if she knows $K_{AB}$. Thus it is to prove knowledge of the key.

The nonce $N_B'$ in Needham-Schroeder is used to prevent a replay attack with someone spoofing Alice to Bob.


  How does the use of the nonces provide more security to the protocol?


It ties messages to specific sessions of the protocol. This ensures that all messages are "fresh" which prevents replay attacks.