Security of a security protocol for key exchange, using symmetric-key cryptography This is an exam question:

$A \to B$: Alice, $nonce_A$

$B \to A$: $nonce_B$, $E_{k_{AB}}(nonce_A \| k_1)$

$A \to B$: $E_{k_{AB}}(nonce_B \| k_2)$
Alice and Bob both compute $k_s$ = $k_1$ xor $k_2$

$A \to B$: $E_{k_s}(...)$

$B \to A$: $E_{k_s}(...)$


The protocol is based on a long term secret $k_{AB}$ shared between Alice and Bob.The session, which begins at message 4, is supposed to be confidential and secure against reflection, replay, and re-ordering of the contents ( with $E_{k_s}(...)$ in step 4 and 5 can be anything as long as the protocol satisfy the above requirement).There does exist a flaw in the protocol, can you find it and explain why it constitute an attack on the protocol ?
I can tell that a man in the middle attack doesn't work because $k_1$ and $k_2$ are encrypted so the attacker can not know $k_s$ therefore can not continue to send messages to A and B after the authentication phase.
Another attack I can think of is when $nonce_A$ = $nonce_B$ a Dolev-Yao attacker can pose as B and send A $E_{k_{AB}}$$(nonce_A \| k_1)$ in message 3 then $k_s$ = $k_1$ xor $k_1$ = 0 then the attacker know $k_s$ then he can send message and decrypt message. But the chance $nonce_A$ = $nonce_B$ is very small so I'm not sure if it constitutes an attack.
If we assume that $E$ is just semantically secure, without providing authenticity and integrity of the encrypted message then this scheme is has a huge drawback. It would be possible for an attacker to pose himself as either A or B, or to alter any message send from A to B.

So without authenticated encryption, this scheme may protect against eavesdropping, but not against alteration of messages. Although the attacker won't be able to decrypt messages from the other party, it is possible for an attacker to create an active attack and inject garbage into the messages received by either A or B.

As indicated, many smart cards provide similar key establishment routines, but those schemes use two master keys and two session keys - one for encryption providing confidentiality (symmetric encryption) and one for entity authentication and message authentication (MAC), although a single key and authenticated encryption (CCM or GCM) may also be used for $E$.



Note that above does not constitute a full crypto-analysis of the protocol, it simply points out that $E$ should be an authenticated cipher.