The adversary eavesdrops and hears the two first messages. He then notices he can construct a valid message $4$ , as follows: He uses the encrypted part of message $2$ , i.e. $\{A,N_{A},T_{B}\}_{K_{BT}}$ , as the first part of his message. It has the correct structure, with $A$ first and $B$ :s timestamp $T_{B}$ last, and in the middle the nonce $N_{A}$ playing the role of $K_{AB}$ . To complete the message, he just needs to encrypt $N_{B}$ using $N_{A}$ as key (both these were sent unencrypted in messages $1$ and $2$ ). The complete protocol run is

$1.\ \ A\rightarrow B$ $:\ \ A,N_{A}$
$2.\ \ B\rightarrow T$ $:\ \ B,\{A,N_{A},T_{B}\}_{K_{BT}},N_{B}$
$3.\ \ T\rightarrow A$ $:\ \ \dots$
$4.\ \ C(A)\rightarrow B$ $:\ \ \{A,N_{A},T_{B}\}_{K_{BT}},\{N_{B}\}_{N_{A}}$

The third message, from $T$ to $A$ , plays no role in the attac