Exercise $3.$ Katz$-$Lindell Exercise $11\mathrm{.}4[40$ points$]$ Consider the following key$-$

exchange protocol:

$($a$)$ Alice chooses uniform $k,$rin$\{0,1{\}}^n,$ and sends $s$:$=ko+r$ to Bob.

$($b$)$ Bob chooses uniform tin$\{0,1{\}}^n,$ and sends $u$:$=so+t$ to Alice.

$($c$)$ Alice computes $w$:$=uo+r$ and sends $w$ to Bob.

$($d$)$ Alice outputs $k$ and Bob outputs $wo+t.$

Show that Alice and Bob output the same key. Analyze the security of this protocol

$($i$.$e$.,$ either prove its security or show a concrete attack$).$