Attack on Double Encryption Scheme In this protocol:


A → B : { &lt;[A, {K}pk(B)]> }pk(B)
B → A : { &lt;[B, {K}pk(A)]> }pk(A)


I'd like to determine why this is insecure.  How can the attacker learn the key K if A and B are both honest agents?

This is what I have started with:


A → B : { &lt;[A, {K}pk(B)]> }pk(B)


An attacker M can intercept this, however M cannot decrypt this.  M sends it to B so B thinks the message is coming from M:


M → B : { &lt;[A, {K}pk(B)]> }pk(B)


Then I run into the problem that A's identity is still in the message.  When B decrypts, he will realize that D and A do not match, and end the session.

Any help, hints, or advice would be appreciated! Thanks!
EDIT: I think what I do is provide a little more than a hint so don't read further if that is an issue.


   This problem is very much like the NSL protocol in that it allows an intermediary due to neither party declaring their own identity:


That is:


   A -&gt; E : { &lt;[A, {K}pk(E)]&gt; }pk(E) }  E -&gt; B : { &lt;[A, {K}pk(B)]&gt; }pk(B) }  B -&gt; E : { &lt;[B, {K}pk(A)]&gt; }pk(A) }  E -&gt; A the above


Resulting in:


   Now B believes it has a shared channel with A but E is involved.  You can even simplify and omit A entirely since its existence was never proven to party B:


Alternatively:


   E -&gt; B : { &lt;[A, {K}pk(B)]&gt; }pk(B) } B -&gt; anyone : { &lt;[B, {K}pk(A)]&gt;}pk(A) }


and


   Now 'B' presumably believes key $K$ is shared with party $A$ when in fact party $E$ holds a copy.