mutual authentication using MAC I have the following protocol for mutual authentication ($V=$ verifier, $P = $ prover, $r_V$ and $r_P$ random values, $h_k$ a keyed hash function)


$V\rightarrow P:r_V$
$P\rightarrow V:r_P,h_k(r_V,r_P)$
$V\rightarrow P:h_k(r_P,r_V)$


My question is why does the prover send back to the verifier $h_k(r_V,r_P)$? Can't he just send back $h_k(r_V)$? Or is this less secure.
(EDIT: question before edit asked about case where $r_v$ is missing from hash, that's why the answer is mostly about it:)

This would totally break security of the scheme. Assume that protocol looks like this (only change is in step 2 - missing $r_v$):


$V\rightarrow P:r_V$
$P\rightarrow V:r_P,h_k(r_P)$
$V\rightarrow P:h_k(r_P,r_V)$


Let's assume that Eve sees message from step 2. She can now start another authentication session and send to $V$ the same pair $r_P,h_k(r_P)$ again and get authenticated as $P$ (in as many separated sessions as she wants).

You can prevent this by requiring that each $r_P$ can be used only once but tracking used values is way more expensive and error-prone than simply including challenge from $V$ in hash. 

Please note that if you drop $r_P$ from step 3 as well and Eve sees all messages then she can pretend to be $V$ in communication with $P$ as well.

If protocol looks like:


$V\rightarrow P:r_V$
$P\rightarrow V:r_P,h_k(r_V)$
$V\rightarrow P:h_k(r_P)$


then you can force $P$ to sign whatever message you want (impersonating $V$ ) or force $V$ to sign whatever you want performing man-in-the-middle attack and changing $r_P$. This can potentially lead to some replay attack if you use strong MAC or to secret key recovery if MAC is not chosen plaintext secure.