An attack on a recursive authentication protocol: A cautionary tale

Abstract

We describe an attack on a recursive authentication protocol proposed by John Bull of APM. The protocol is an implementation of a more abstract design that was analysed by Paulson and shown to establish session keys in a secure manner. The fact that Bull's implementation nevertheless fails to be secure in this sense provides an object lesson on how careful one has to be in interpreting the results of a formal analysis. © 1998 Elsevier Science B.V.