Attack on a key-exchange,symmetric-key cryptography protocol This is an exam question in Oxford 's Computer Security course:


  Here is the start of a protocol, based on a long-term secret key $k_{AB}$ previously shared between Alice and Bob, designed to offer bilateral authentication and establishment of a session key $k_s$. The session, which begins at message 4, is supposed to be confidential and secure against reflection, replay, and re-ordering of the contents.
  1.$A \to B$: Alice, $nonce_A$
  2.$B \to A$: $nonce_B$, $E_{k_{AB}}$$(nonce_A \| k_1)$
  3.$A \to B$: $E_{k_{AB}}$$(nonce_B \| k_2)$
  Alice and Bob both compute $k_s$ = $k_1$ ⊕ $k_2$
  4.$A \to B$: $E_{k_s}(...)$
  5.$B \to A$: $E_{k_s}(...)$     
  
  a) Why would Alice and Bob want a session key $k_s$, rather than simply using the already shared secret key $k_{AB}$ for session encryption?
  b) How should Alice and Bob format the contents of their session, messages 4 onwards, to meet the aims of the protocol?
  c) If they additionally wish to ensure the integrity of the session, what should they add to the protocol?
  d) Does this protocol provide key agreement or does it provide key transport? Explain your answer.
  The following appears to be a man-in-the-middle attack on the protocol, under the usual Dolev- Yao model:  
  
  1.$A→I_B$: Alice ,$nonce_A$
  1´.$I_A→B$: Alice, $nonce_A$
  2´.$B→I_A$: $nonce_B$,$E_{k_{AB}}$$(nonce_A ∥ K_1)$
  2.$I_B→A$: $nonce_B$,$E_{k_{AB}}$$(nonce_A∥K_1)$
  3.$A→I_B$: $E_{k_{AB}}$$(nonce_B∥K_2)$
  3´.$I_A→B$: $E_{k_{AB}}$$(nonce_B∥K_2)$
  Alice and Bob continue their sessions with the intruder.
  e) Why does the above sequence not constitute an attack on the protocol?
  f) Although not subject to man-in-the-middle attacks, there does exist a flaw in the protocol. Find it, and explain carefully why it does constitute an attack on the protocol.  


Part f) is where I'm currently stuck.

One attack I can think of is when $nonce_A = nonce_B$ a Dolev-Yao attacker can pose as B and send A $E_{k_{AB}}$$(nonce_A ∥ k_1)$ in message 3 then $k_s = k_1 ⊕ k_1 = 0$ then the attacker know s$k_s$ and he can send message and decrypt message. But the chance $nonce_A = nonce_B$ is very small, so I'm not sure if it constitutes an attack.
I'm not sure but in my point of view.

Since $k_{AB}$ is used to authenticate both side.
Mapped $nounce_x:E_{k_{AB}}$$(nonce_x∥k_x)$ pair on one side can be used on both side.
Thus we can gather $nounce_x:E_{k_{AB}}$$(nonce_x∥k_x)$ pairs from $B$ since $B$ will happily echo $E_{k_{AB}}$$(nonce_x∥k_x)$ for every $nounce_x$ I asked.

This doesn't form practical MITM attack but I can make $A$ agree on $randomK_1⊕k_2$ as $k_s$ while on the other side $B$ will accept $k_1⊕k_2$ as $k_s$. In another word we can make $A$ and $B$ agree on different values at probability equivalent to (or more than because we can query it ourself) birthday attack.

This might make some cryptanalysis possible but I don't know the details.

As you suggested in chat:
$nonce$ collision is unnecessary we rather change the scheme to something like:
After received $nonce_A$ we send it to $B$ twice but only sent the first response to $A$