Attack and revison of an electronic auction protocol using OFMC

In the article we show an attack on the cryptographic protocol of electronic auction with extended requirements [1]. The found attack consists of authentication breach and secret retrieval. It is a kind of “man in the middle attack”. The intruder impersonates an agent and learns some secret information. We have discovered this flaw using OFMC an automatic tool of cryptographic protocol verification. After a description of this attack, we propose a new version of the e-auction protocol. We also check with OFMC the secrecy for the new protocol and give an informal proof of the other properties that this new e-auction protocol has to guarantee.