Authenticated Key Exchange Protocol Research Articles

Security analysis of SM2 key exchange protocol in TPM2.0

AbstractThe new released trusted platform module (TPM) specification, TPM2.0, adds cryptographic support for key exchange by providing SM2 authenticated key exchange (AKE) application programming interface (API) commands. Xu analyzed the SM2 AKE protocol and found that it was insecure in common computing environment by presenting two types of unknown key share attacks. Here, we present another design weakness of the SM2 AKE protocol, which might cause that the protocol cannot be proven secure in modern security models. We also analyze the security of SM2 AKE protocol in TPM2.0, whose running environment is very different and find that (i) it indeed gets some security improvements through the protection capability provided by the two SM2 AKE commands of TPM2.0 but (ii) it still has some weaknesses, which might lead to unknown key share and key‐compromise impersonation attacks because of the bad design of the TPM2.0 application programming interface. We solve the weaknesses of SM2 AKE protocol in TPM2.0 by slightly modifying one SM2 AKE command and finally give a formal proof of our solution in the Canetti and Krawczyk model. Our work shows that TPM2.0 could provide a proven secure SM2 AKE by slightly modifying one command. Copyright © 2014 John Wiley & Sons, Ltd.

Cryptanalysis of a Strongly Secure Authenticated Key Exchange Protocol

Cryptanalysis of a Strongly Secure Authenticated Key Exchange Protocol

Authenticated key exchange protocol under computational Diffie–Hellman assumption from trapdoor test technique

SUMMARYThis paper investigates authenticated key exchange (AKE) protocol under computational Diffie–Hellman assumption in the extended Canetti–Krawczyk model. The core technical component of our protocol is the trapdoor test technique, which is originally introduced to remove the gap Diffie–Hellman (GDH) assumption for the public key encryption schemes. Our contributions are twofold.First, we clarify some misunderstandings of the usage of the trapdoor test technique in AKE protocols showing its adaptation to the AKE protocols is not trivial. We point out some errors in some recent work which attempts to make use of the trapdoor test technique to remove GDH assumption.Second, based on trapdoor test technique, we propose an efficient extended Canetti–Krawczyk secure AKE protocol under computational Diffie–Hellman assumption instead of GDH assumption. Additionally, our protocol does not make use of NAXOS trick and has a tight reduction. In comparison with all existing AKE protocols with the properties as previously mentioned, our protocol with only three exponentiations is most efficient. Copyright © 2013 John Wiley & Sons, Ltd.

A Lightweight Three-Party Privacy-preserving Authentication Key Exchange Protocol Using Smart Card

How to make people keep both the confidentiality of the sensitive data and the privacy of their real identity in communication networks has been a hot topic in recent years. Researchers proposed privacy-preserving authenticated key exchange protocols (PPAKE) to answer this question. However, lots of PPAKE protocols need users to remember long secrets which are inconvenient for them. In this paper we propose a lightweight three-party privacy-preserving authentication key exchange (3PPAKE) protocol using smart card to address the problem. The advantages of the new 3PPAKE protocol are: 1. The only secrets that the users need to remember in the authentication are their short passwords; 2. Both of the users can negotiate a common key and keep their identity privacy, i.e., providing anonymity for both users in the communication; 3. It enjoys better performance in terms of computation cost and security. The security of the scheme is given in the random oracle model. To the best of our knowledge, the new protocol is the first provably secure authentication protocol which provides anonymity for both users in the three-party setting.

Characterization of Strongly Secure Authenticated Key Exchanges without NAXOS Technique

This paper examines two-pass authenticated key exchange (AKE) protocols that are secure without the NAXOS technique under the gap Diffie-Hellman assumption in the random oracle model: FHMQV [18], KFU1 [21], SMEN ― [13], and UP [17]. We introduce two protocol, biclique DH protocol and multiplied biclique DH protocol, to analyze the subject protocols, and show that the subject protocols use the multiplied biclique DH protocol as internal protocols. The biclique DH protocol is secure, however, the multiplied biclique DH protocol is insecure. We show the relations between the subject protocols from the viewpoint of how they overcome the insecurity of the multiplied biclique DH protocol: • FHMQV virtually executes two multiplied biclique DH protocols in sequence with the same ephemeral key on two randomized static keys. • KFU1 executes two multiplied biclique DH protocols in parallel with the same ephemeral key. • UP is a version of KFU1 in which one of the static public keys is generated with a random oracle. • SMEN ― can be thought of as a combined execution of two multiplied biclique DH protocols. In addition, this paper provides ways to characterize the AKE protocols and defines two parameters: one consists of the number of static keys, the number of ephemeral keys, and the number of shared secrets, and the other is defined as the total sum of these numbers. When an AKE protocol is constructed based on some group, these two parameters indicate the number of elements in the group, i.e., they are related to the sizes of the storage and communication data.

One-Round Authenticated Key Exchange with Strong Forward Secrecy in the Standard Model against Constrained Adversary

Forward secrecy (FS) is a central security requirement of authenticated key exchange (AKE). Especially, strong FS (sFS) is desirable because it can guarantee security against a very realistic attack scenario that an adversary is allowed to be active in the target session. However, most of AKE schemes cannot achieve sFS, and currently known schemes with sFS are only proved in the random oracle model. In this paper, we propose a generic construction of AKE protocol with sFS in the standard model against a constrained adversary. The constraint is that session-specific intermediate computation results (i.e., session state) cannot be revealed to the adversary for achieving sFS, that is shown to be inevitable by Boyd and Gonzalez Nieto. However, our scheme maintains weak FS (wFS) if session state is available to the adversary. Thus, our scheme satisfies one of strongest security definitions, the CK + model, which includes wFS and session state reveal. The main idea to achieve sFS is to use signcryption KEM while the previous CK + secure construction uses ordinary KEM. We show a possible instantiation of our construction from Diffie-Hellman problems.

A simple and robust anonymous two-factor authenticated key exchange protocol

Recently two-factor authenticated key exchange (AKE) protocols have been widely used in various networks to ensure communication security. In 2009, Sun et al. proposed an improved password authenticated key agreement scheme based on smart cards. It is efficient in two-factor authentication key exchange protocols. However, we found that the scheme of Sun et al. was vulnerable to a password-guessing attack and a key compromise impersonation (KCI) attack. We made an improvement on the scheme of Sun et al. by using an elegant but simple trick to eliminate the security vulnerabilities. The improved scheme possesses untraceability, which is absent in the scheme of Sun et al. but important in anonymous communication. Moreover, the new scheme can also resist KCI attack, which is a strong secure property in AKE protocol. We proved the security of our protocol in the random oracle model provided that the Elliptic Curve Gap Diffie–Hellman assumption holds. The trick used in this paper can provide a new way for designing authenticated key agreement in two-factor authentication mechanism. Copyright © 2012 John Wiley & Sons, Ltd.

Towards ID-Based Authenticated Group Key Exchange Protocol with Identifying Malicious Participants

An authenticated group key exchange (AGKE) protocol allows participants to construct a common key and provide secure group communications in cooperative and distributed applications. Recently, Choi...

Strongly Secure Predicate-Based Authenticated Key Exchange: Definition and Constructions

This paper firstly provides the extended Canetti-Krawzcyk (eCK) security model for predicate-based authenticated key exchange (AKE) that guarantees resistance to leakage of ephemeral secret keys. Moreover, we propose two-pass key-policy (resp. session-policy) attribute-based AKE protocol secure in the proposed predicate-based eCK security model based on key-policy (resp. ciphertext-policy) attribute-based encryption. The proposed protocols have advantages in security against leakage of ephemeral secret keys and the round complexity compared to the previous predicate-based AKE protocols.

Universal Composable Password Authenticated Key Exchange Protocol in the Standard Model

PDF HTML阅读 XML下载 导出引用 引用提醒 标准模型下通用可组合的口令认证密钥交换协议 DOI: 10.3724/SP.J.1001.2011.03910 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: 国家自然科学基金(60873261); 国家高技术研究发展计划(863)(2009AA01Z417); 国家科技支撑计划(2008BAH37B02-2) Universal Composable Password Authenticated Key Exchange Protocol in the Standard Model Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:通过构造不可延展的、可提取的且是弱模拟可靠的陷门承诺体制,以及相应的平滑投射Hash 函数簇,设计了一个高效的通用可组合(universal composable,简称UC)安全的两方口令认证密钥交换(password authenticated key exchange,简称PAKE)协议,并在静态腐化模型下给出了严格的安全性证明.该协议使得PAKE 协议在UC框架下达到了最优的两轮.与已有的协议相比,该协议避免了零知识证明协议的使用,在保持计算复杂度相当的前提下有效地提高了通信效率. Abstract:Through constructing and utilizing non-malleable, extractable, and weak simulation-sound trapdoor commitment schemes and corresponding smooth projective hash function familes, this paper proposes an efficient two-party password authenticated key exchange (PAKE) protocol within the universal composable (UC) framework, which is the optimal two-round PAKE protocol in this setting. Rigorous security proofs based on standard assumptions in the presence of static corruption adversary are then given out. Comparisons with previously proposed protocols show that, this protocol avoids the use of zero-knowledge protocols, and achieves a higher performance in terms of communication efficiency while attaining a comparable computational complexity. 参考文献 相似文献 引证文献

Analysis of Two ID-Based Key Exchange Protocols

In this paper, we analyze two ID-based authenticated key exchange (AKE) protocols in the eCK model. One is a two-party AKE protocol between members of distinct domains proposed by Xia et al. in 2009. The other is a dynamic group AKE protocol proposed by Xie et al. in 2010. The results of analysis show that both of them are insecure in the eCK model.

Provably Secure Two-Party Authenticated Key Exchange Protocol in eCK Model

How to construct secure key agreement protocol is one of the most challenging problems in information security area.However,most of the current secure protocols can only achieve "heuristic" security,the security assumptions and efficiencies of these protocols are not perfect.To solve these problems,the authors propose a new 2 rounds two-party authenticated key agreement protocol and point out some principles to construct a secure protocol by analyzing the security properties of the protocol,then prove strictly that the new protocol is secure in eCK model.According to pertinent literature,eCK model provides the strongest definition of security for two party key agreement protocol at present.Performance analysis shows that the protocol has a good balance between computational cost and security assumption.The authors also present a three-round variant of the protocol to realize key conformation property.

비대칭 무선랜 환경을 위한 안전한 패스워드 인증 키 교환 프로토콜

사용자 인증과 비밀키 교환은 암호학의 매우 중요한 응용 분야 가운데 하나로서, 사용자 인증의 경우 일반적으로 패스워드를 이용하고 있지만, 패스워드를 이용한 사용자 인증은 패스워드 추측 공격에 취약한 문제가 있다. 1992년 Bellovin과 Merritt은 패스워드 추측 공격에 안전하면서 비밀키 교환까지 할 수 있는 EKE(Encrypted Key Exchange) 프로토콜을 제안한 바 있으며, 이후 효율성과 안전성을 개선한 많은 논문이 제안되고 있다. 이 가운데 Lo는 Yeh 등이 제안한 패스워드 기반 인증키 교환 프로토콜의 취약점을 지적함과 동시에 개선된 프로토콜을 2006년에 제안하였다. 하지만, Lo의 프로토콜 역시 오프라인 패스워드 추측 공격에 취약함이 Cao와 Lin에 의해 지적되었다. 본 논문에서는 새로운 공격 방법으로 Lo의 프로토콜이 온라인 패스워드 추측공격에도 취약함을 보이고, 온라인 패스워드 추측 공격에도 안전한 개선된 프로토콜을 제안한다. 제안한 프로토콜은 비대칭 무선 네트워크 환경에서 패스워드 기반 인증키 교환 프로토콜로 사용될 수 있다. User authentication and key exchange protocols are the most important cryptographic applications. For user authentication, most protocols are based on the users' secret passwords. However, protocols based on the users' secret passwords are vulnerable to the password guessing attack. In 1992, Bellovin and Merritt proposed an EKE(Encrypted Key Exchange) protocol for user authentication and key exchage that is secure against password guessing attack. After that, many enhanced and secure EKE protocols are proposed so far. In 2006, Lo pointed out that Yeh et al.'s password-based authenticated key exchange protocol has a security weakness and proposed an improved protocol. However, Cao and Lin showed that his protocol is also vulnerable to off-line password guessing attack. In this paper, we show his protocol is vulnerable to on-line password guessing attack using new attack method, and propose an improvement of password authenticated key exchange protocol for imbalanced wireless networks secure against password guessing attack.

Efficient and Secure Authenticated Key Exchange Protocols in the eCK Model

In this paper, we propose two authenticated key exchange (AKE) protocols and prove their security in the extended Canetti-Krawczyk model. The first protocol, called NAXOS+, is obtained by slightly modifying the NAXOS protocol proposed by LaMacchia, Lauter and Mityagin [15]. We prove its security under the Computational Diffie-Hellman (CDH) assumption by using the trapdoor test introduced in [6]. To the authors' knowledge, this is the first AKE protocol which is secure under the CDH assumption in the eCK model. The second protocol, called NETS, enjoys a simple and tight security reduction compared to existing schemes including HMQV and CMQV without using the Forking Lemma. Since each session of the NETS protocol requires only three exponentiations per party, its efficiency is also comparable to MQV, HMQV and CMQV.

An eCK-secure Authenticated Key Exchange Protocol Without Random Oracles

This paper presents a (PKI-based) two-pass authenticated key exchange (AKE) protocol that is secure in the extended Canetti-Krawczyk (eCK) security model. The security of the proposed protocol is proven without random oracles (under three assumptions), and relies on no implementation techniques such as a trick by LaMacchia, Lauter and Mityagin (so-called the NAXOS trick). Since an AKE protocol that is eCK-secure under a NAXOS-like implementation trick will be no more eCK-secure if some realistic information leakage occurs through side-channel attacks, it has been an important open problem how to realize an eCK-secure AKE protocol without using the NAXOS tricks (and without random oracles).

Hierarchical ID-Based Authenticated Key Exchange Resilient to Ephemeral Key Leakage

In this paper, the first extended Canetti-Krawzcyk (eCK) security model for hierarchical ID-based authenticated key exchange (AKE) that guarantee resistance to leakage of ephemeral secret keys is proposed. Moreover, an two-pass hierarchical ID-based AKE protocol secure in the proposed hierarchical ID-based eCK security model based on a hierarchical ID-based encryption is also proposed.

An Improvement on A Three-Party Authentication Key Exchange Protocol Using Elliptic Curve Cryptography

The authentication key exchange protocol enables communication participants to authenticate each other and agree on the session key over an insecure public network. Recently, a three-party authentication key exchange protocol based on Elliptic curve cryptograph is proposed. In this paper, we improve the three-party encrypted key exchange protocol by bilinear maps. The proposed threeparty authentication key exchange protocol is provable secure under Computational Diffie-Hellman assumptions in the standard model. Furthermore, the novel protocol is more efficient.

A Note on an Enhanced Three-Party Authentication Key Exchange Protocol

Recently, Chen et al. proposed an efficient three-party encrypted key exchange protocol based upon Schnorr’s digital signature scheme with fewer rounds. However, J.H. Yang and C. C. Chang showed that Chen et al.’s protocol still has the high computation cost and communication cost. Moreover, Chen et al.’s protocol suffers from stolen-verifier attacks. Then J.H. Yang and C. C. Chang proposed a three-party authenticated key exchange protocol without password by using elliptic curve cryptography. Their improved protocol requires smaller transmitted message size and less communication times, which is well suitable for resource-limited environments such as mobile communication and mobile commerce. Unfortunately, we find that Yang et al.’s protocol is vulnerable to replay attacks, denial-of-Service attacks and impersonation attacks.

An Enhanced Three-Party Authentication Key Exchange Protocol for Mobile Commerce Environments

Recently, Yang et al. proposed a three-party encrypted key exchange protocol (3PAKE) which is based on Elliptic curve cryptography. Their 3PAKE protocol is efficient because it requires less computation cost and less communication cost, which is well suitable for mobile commerce environments. However, Yang et al.’s 3PAKE protocol is susceptible to parallel attacks and impersonation attacks. We presented an enhancement to resolve such security problems. Detailed analyses show that our proposed protocol is a secure 3PAKE protocol and more efficient.

Security model and modular design of fair authentication key exchange protocols

It is traditionally assumed that the legal two parties in authentication key exchange (AKE) communications are both credible. However, in more and more network applications nowadays, it is often required that such protocols be run under the circumstances where ones do not trust in each other. Therefore, in this paper we propose the idea of fair authentication key exchange (FAKE), which has not only the basic properties of AKE protocols, but also some new properties: the “session proof” embedded in the input of protocols by the customer; and if not revealed, the protocols have the deniability, otherwise the transcript of protocol is binding for the identifications. Such a method is capable of solving the contradiction between protecting privacy and the dissension on network service. Then the security model of FAKE protocols is formulated systematically and a flaw of the security model of current signature schemes proposed by Kudla is also corrected. Finally, a kind of FAKE protocol based on current signature schemes is designed and the mBJM-AK security, conditional deniability and fairness of FAKE protocols are proved in the random oracle model.