We consider the following protocol intended to allow Alice to authenticate herself to Bob with the help of a trusted third party $T$ . Alice and Bob do not know each other, but each of them shares a symmetric key, $K_{AT}$ and $K_{BT}$ , respectively, with $T$ .

$A\longrightarrow B$ : $A$ .
$B\longrightarrow A$ : $N_{B}$ .
$A\longrightarrow B$ : $\{N_{B}\}_{K_{AT}}$ .
$B\longrightarrow T$ : $\{A,\{N_{B}\}_{K_{AT}}\}_{K_{BT}}$ .
$T\longrightarrow B$ : $\{A,N_{B}\}_{K_{BT}}$ .

After receiving message 5, Bob decrypts it and checks that the encrypted message contains Alice’s name and the nonce he created and sent in message 2. If so, he accepts the run and Alice is authenticated.

Now consider the following attack, where the adversary $C$ will manage to get himself authenticated as Alice.

$C(A)\longrightarrow B$ : $A$ .
$B\longrightarrow C(A)$ : $N_{B}$ .
$C(A)\longrightarrow B$ : $N_{B}$ .

Note that in message 3, $C$ deviates from the protocol. Your task is to show how the protocol run is completed by $B$ and $C$ – in fact, $C$ will intercept also message 4 (masquerading as $T$ ) and himself send message 5 to $B$ . Finally, you must explain $B$ :s reasoning in accepting the run.