Alice and Bob, each of whom has an initial pool of knowledge represented with white boxes. Alice’s initial knowledge, for example, consists of her own public/private key pair $PK(A)$/$SK(A)$, identity $A$, nonce $N_A$, and Bob’s public key $PK(B)$ and identity $B$. The purpose of the protocol is to distribute the nonces between Alice and Bob in such a way that the following conditions hold at the end: (1) Alice and Bob both know $N_A$ and $N_B$, and (2) no other principal knows the nonces.

To initiate the protocol, Alice first expands her pool of knowledge to include $E_{PK(B)}(A, N_A)$, an encryption of her identity and nonce with Bob’s public key. She then sends the cipher to Bob who decrypts it using his private key, $SK(B)$. At the end of the first step of the protocol, each principal’s knowledge has increased to include the values in light gray boxes. Bob performs the second step of the protocol by adding $E_{PK(A)}(N_A, N_B)$ to his current knowledge and sending the cipher to Alice. She uses her private key to decrypt Bob’s message and extract $N_B$. By using $N_B$ and $PK(B)$, Alice can set up an authenticated and private channel with Bob as is 