An authentication and session key agreement protocol based on identity signature

Abstract

A new authentication and session key agreement protocol based on identity signature is proposed. The proposed protocol is composed of four parts: the registration of users, user identity initialization, the authentication of user's identity and the generation of session key. The proposed system involves three partners, user A, user B and the trusted party (TP). The existence of TP prevents the man-in-middle attack. During the generation of session key, TP is allowed to be offline. Our protocol combines the public key with the identity of user, and makes it feasible that the network identity of a user is represented by the public key. The generation of private key and session key is accomplished by user alone, without the participation of a TP. During the generation of session key, the users authenticate the identity of each other using the corresponding user signatures. The authentication is performed without the participation of a TP, thus reducing the risk of exposing of the master key. The proposed protocol is highly efficient and secure.