Role of session identifier in Otway-Rees protocol According to Wikipedia, Otway-Ress protocol is as follow:


  The protocol can be specified as follows in security protocol notation, where Alice is authenticating herself to Bob using a server $S$ ($M$ is a session-identifier, $N_A$ and $N_B$ are nonces):


\begin{align}
 A &amp; \rightarrow B : M,A,B, \{N_A,M,A,B\}_{K_{AS}}\\
 B &amp; \rightarrow S : M,A,B, \{N_A,M,A,B\}_{K_{AS}},\{N_B,M,A,B\}_{K_{BS}}\\
 S &amp; \rightarrow B : M, \{N_A,K_{AB}\}_{K_{AS}},\{N_B,K_{AB}\}_{K_{BS}}\\
 B &amp; \rightarrow A : M, \{N_A,K_{AB}\}_{K_{AS}}
\end{align}

What is the role of $M$, the session identifier, in the security of protocol?

What will happen if we remove all $M$ in the protocol? (I think there will be no flow, I don't understand the role of $M$)
The $M$ in  Otway-Ress protocol (It is $C$ as the Challenge in the article);


  
  In mutual authentication, both parties are suspicious of each other and of the freshness of the authentication messages; therefore each must generate independent challenges in order to assure themselves of the
  timeliness of the interaction.
  Its important property is that it has not previously been used to authenticate the two parties concerned.
  This property can be guaranteed either by storing all previously used challenges, by using numbers from a monotonically increasing sequence (e.g. time) or probabilistically by generating a sufficiently large number randomly. 
  


$M$ is used to prevent replay attacks.