A simple client/server authentication protocol Some days ago I asked for a help to find and correct the problems of an authentication protocol. I closed the post because I was convinced I can correct it but, unfortunately I'm having some troubles. The "old" post is the following:I'm dealing with this problem: establish if the following protocol is 'secure' and, if it isn't, modify it to make it secure.

I will use the subsequent notation to describe the protocol:


$N$ is a nonce
$X \longrightarrow Y: \space   M$
to indicate that $X$ sends $M$ to $Y$
$K_{XY}$ to indicate the symmetric key shared by $X$ and $Y$
and $K_{XY}(M)$  to indicate that the message $M$ has been encrypted with the symmetric key $K_{XY}$.


The protocol allows a client $C$ to authenticate itself to a server $S$ using an authentication service $A$. 

$C \longrightarrow S:\space  C$ 
$S \longrightarrow C:\space   N$ 
$C \longrightarrow S:\space   K_{CA}(N)$
$S \longrightarrow A:\space   K_{SA}(C, K_{CA}(N))$
$A \longrightarrow S:\space   K_{SA}(N)$

$S$ authenticates $C$ if and only if the nonce received $N$, got by the authentication service ($A$), is equal to the nonce sent to $C$.

Assuming the communication channel is not secure, an attacker (called Eve) can impersonate $C$ simply sending the message "C" and $K_{CA}(N)$ whenever $C$ tries to authenticate himself.

How to avoid impersonation and offline nonce-guessing in this case? Any suggestion? I don't want the answer to the problem, just a few tips to continue on my own. At the end, I want to say that I know how to make the protocol secure but my answer consists in completely change the protocol described above, and so I think my answer is not the most appropriate. Recently I thought to modify the protocol as follows:
$C \longrightarrow S:\space  C$ 
$S \longrightarrow C:\space   K_{SA}(N)$ 
$C \longrightarrow S:\space   K_{CA}(K_{SA}(N))$
$S \longrightarrow A:\space   K_{SA}(C, K_{CA}(K_{SA}(N)))$
$A \longrightarrow S:\space   K_{SA}(N)$ Can it work now?
If Eve knows $C, \space N, \space K_{CA}(N)$ then she is able to impersonate $C$ just by following the protocol you described above.

If she just knows $K_{CA}(N)$ for a single $N$ then the effectiveness of the attack depends on the set wherein $N$ is picked.

But as you are supposing that the communication channel is not secure, an attacker could spy several authentication session to get a sufficient number of pairs $(N, K_{CA}(N))$ to successfully attack with high probability.