ffgg

• Protocol where A is the initiator and B is the responder, and N₁ and N₂ are uniquely originating:
  • A->B: A
  • B->A: B, N₁, N₂
  • A->B: A, {N₁, N₂, M}_pub(B) %{N₁, X, Y}_pub(B)
  • B->A: B, N₁, X, {X, Y, N₁}_pub(B)
• Point of view: responder with M uniquely originating, privk(B) non-originating, and a listener for M