Gap Diffie-Hellman Assumption Research Articles

A strengthened eCK secure identity based authenticated key agreement protocol based on the standard CDH assumption

An Authenticated Key Agreement (AKA) protocol enables two communicating parties to compute a session key with equal partnership, such that each entity is assured of the authenticity of its peer. Identity-based AKA (ID-AKA) protocols facilitate implicit authentication of the participating entities, without certificate verification. However, most of the existing ID-AKA schemes are proven secure based on the strong Gap Diffie-Hellman (GDH) assumption. Currently, there are no known implementation methods to realize the GDH assumption without using bilinear pairings. Further, none of the existing ID-AKA protocols have provable security against practical attacks due to intermediate result leakages. To this end, we propose a purely pairing-free ID-AKA protocol based on the Computational Diffie-Hellman assumption. The protocol offers provable security under the strengthened eCK (seCK) model that captures attacks resulting from intermediate result leakages. Comparative analysis with other ID-AKA protocols suggests that the proposed protocol satisfies stronger security requirements, without the gap assumption.

A Provably Secure Identity Based Authenticated Key Agreement Protocol with Multiple PKG Compatibility for Inter-Vehicular Ad hoc Networks

Vehicular Ad hoc Networks (VANETs) facilitate the timely dissemination of road traffic information, including early warnings related to road conditions, weather updates, traffic congestion and collisions. The information exchanged in VANETs is crucial for maintaining uninterrupted traffic flow, minimizing road mishaps, expediting emergency services and analyzing potential detours in case of congestion. In order to ensure the legitimacy of the interchanged messages and to preserve confidentiality, it is essential to establish secure authenticated channels among the communicating automotive nodes. Considering the highly dynamic nature of VANETs and the diversity of the participating vehicular nodes, Identity based Authenticated Key Agreement (ID-AKA) protocol in the multiple Private Key Generator (PKG) setting, is an ideal cryptographic technique for securing inter-vehicular communications. We cryptanalyze the existing pairing-free multiple PKG compatible ID-AKA (mPKG-ID-AKA) protocol designed for securing VANETs and prove that the protocol lacks weak Perfect Forward Secrecy (wPFS). Our investigations also reveal that previous attempts to model mPKG-ID-AKA protocols are computation-intensive and provide weaker security guarantees. To this end, we propose an efficient eCK secure mPKG-ID-AKA protocol based on the gap Diffie-Hellman assumption. Experimental analysis suggests that the proposed protocol attains the highest computation efficiency, when compared to the existing mPKG-ID-AKA schemes and is therefore highly suitable for securing inter-vehicular communications.

Analysis of Certificateless Signcryption Schemes and Construction of a Secure and Efficient Pairing-free one based on ECC

Signcryption is a cryptographic primitive that provides authentication (signing) and confidentiality (encrypting) simultaneously at a lower computational cost and communication overhead. With the proposition of certificateless public key cryptography (CLPKC), certificateless signcryption (CLSC) scheme has gradually become a research hotspot and attracted extensive attentions. However, many of previous CLSC schemes are constructed based on time-consuming pairing operation, which is impractical for mobile devices with limited computation ability and battery capacity. Although researchers have proposed pairing-free CLSC schemes to solve the issue of efficiency, many of them are in fact still insecure. Therefore, the challenging problem is to keep the balance between efficiency and security in CLSC schemes. In this paper, several existing CLSC schemes are cryptanalyzed and a new CLSC scheme without pairing based on elliptic curve cryptosystem (ECC) is presented. The proposed CLSC scheme is provably secure against indistinguishability under adaptive chosen-ciphertext attack (IND-CCA2) and existential unforgeability under adaptive chosen-message attack (EUF-CMA) resting on Gap Diffie-Hellman (GDH) assumption and discrete logarithm problem in the random oracle model. Furthermore, the proposed scheme resists the ephemeral secret leakage (ESL) attack, public key replacement (PKR) attack, malicious but passive KGC (MPK) attack, and presents efficient computational overhead compared with the existing related CLSC schemes.

Efficient identity-based authenticated key agreement protocol with provable security for vehicular ad hoc networks

In vehicular ad hoc networks, establishing a secure channel between any two vehicles is fundamental. Authenticated key agreement is a useful mechanism, which can be used to negotiate a shared key for secure data transmission between authentic vehicles in vehicular ad hoc networks. Among the existing identity-based two-party authenticated key agreement protocols without pairings, there are only a few protocols that provide provable security in strong security models such as the extended Canetti–Krawczyk model. This article presents an efficient pairing-free identity-based one-round two-party authenticated key agreement protocol with provable security, which is more suitable for real-time application environments with highly dynamic topology such as vehicular ad hoc networks than the existing identity-based two-party authenticated key agreement protocols. The proposed protocol is proven secure under the passive and active adversaries in the extended Canetti–Krawczyk model based on the Gap Diffie–Hellman assumption. The proposed protocol can capture all essential security attributes including known-session key security, perfect forward secrecy, basic impersonation resistance, key compromise impersonation resistance, unknown key share resistance, no key control, and ephemeral secrets reveal resistance. Compared with the existing identity-based two-party authenticated key agreement protocols, the proposed protocol is superior in terms of computational cost and running time while providing higher security.

Directed proxy signature with fast revocation proven secure in the standard model

As a kind of special proxy signature, directed proxy signature can be used to sign messages, such that only the designated verifier can easily verify the validity of the signature while others cannot. At the same time, if necessary, the proxy signer or designated verifier can prove the validity of the signature to any third party. However, the revocation of delegated rights has never been considered in the existing directed proxy signature schemes. In fact, in these directed proxy signature schemes, even if the period of delegation has expired, the proxy signer still can generate the valid proxy signature, and the original signer can do nothing to prevent it. Therefore, the authors give a solution to the delegation revocation problem and propose a directed proxy signature scheme with fast revocation in this study. The security and the invisibility of the authors’ scheme are proven based on the gap Diffie–Hellman assumption and under the decisional Diffie–Hellman problem in the standard model, respectively.

Strongly secure identity-based authenticated key agreement protocols without bilinear pairings

In this paper, we present two strongly secure pairing-free identity-based (ID-based) two-party authenticated key agreement (AKA) protocols achieving implicit authentication, which are proven secure in the extended Canetti–Krawczyk (eCK) model. The proposals can offer provable security against both passive and active adversaries in the random oracle model. Our schemes capture all basic desirable security properties including key-compromise impersonation resilience, ephemeral secrets reveal resistance, (weak) perfect forward secrecy and master key forward secrecy etc. We show the security of one of these proposals can be reduced to the standard computational Diffie–Hellman assumption, and the security of the other relies on the gap Diffie–Hellman assumption while having a lower computational overhead. Currently, there are few pairing-free ID-based AKA protocols that are provably secure in such strong security models as the eCK model. Our schemes can provide strong security assurances and in the meanwhile achieve a good computational efficiency. Compared with previous related schemes, our protocols have advantages over them in security, efficiency or both.

A strongly secure pairing-free certificateless authenticated key agreement protocol under the CDH assumption

Certificateless authenticated key agreement (CL-AKA) protocols have been studied a great deal since they neither suffer from a heavy certificate management burden nor have the key escrow problem. Recently, many efficient CL-AKA protocols without pairings have been built. However, these pairing-free CL-AKA protocols are either not proved in any formal security model or proved under the gap Diffie-Hellman (GDH) assumption, a non-standard and strong assumption. With available implementation technologies, pairings are needed to realize the GDH assumption, which means that these pairing-free CL-AKA protocols are not pure pairing-free. Furthermore, these protocols are insecure in the strengthened eCK (seCK) model, which encompasses the eCK model and considers leakages on intermediate results. In this paper, we present a pure pairing-free CL-AKA protocol, which is provably secure in the seCK model under the standard computational Diffie-Hellman (CDH) assumption. Compared with the existing CL-AKA protocols, the proposed protocol has advantage over them in security or efficiency.

Unified security model of authenticated key exchange with specific adversarial capabilities

The most widely accepted models in the security proofs of authenticated key exchange protocols are the Canetti–Krawczyk (CK) and extended CK models that admit different adversarial queries with ambiguities and incomparable strength. It is desirable to incorporate specific and powerful adversarial queries into a single unified security model and establish a more practical oriented security notion. Concerning the security of one-round implicitly authenticated Diffie–Hellman (DH) key exchange protocols, the authors present a unified security model that has many advantages over the previous ones. In the model, a system environment is set up, all of adversarial queries are practically interpreted and definitely characterised through physical environment, and some rigorous rules of secret leakage are also specified. To demonstrate usability of their model, a new protocol based on the OAKE protocol is proposed, which satisfies the presented strong security notion and attains high efficiency. The protocol is proven secure in random oracle model under gap DH assumption.

On security analysis of an after-the-fact leakage resilient key exchange protocol

In this paper, we revisit the security result of an authenticated key exchange (AKE) scheme proposed in AsiaCCS'14 by Alawatugoda, Stebila and Boyd (which is referred to as ASB scheme). The ASB scheme is proved to be secure in a new bounded (continuous) after-the-fact leakage extended Canetti–Krawczyk (B(C)AFL-eCK) model without random oracles, where the B(C)AFL-eCK is extended from the eCK model. However we disprove their security results. We first show an attack against ASB scheme in the eCK model. This also implies that the insecurity of ASB scheme in the B(C)AFL-eCK model. Secondly we point out that the security of ASB scheme is incorrectly reduced to DDH assumption. A solution is proposed to fix the problem of ASB scheme with minimum changes, which yields a new ASB' scheme. We prove the eCK security of ASB' in the random oracle model under Gap Diffie–Hellman assumption.

Authenticated key exchange protocol under computational Diffie–Hellman assumption from trapdoor test technique

SUMMARYThis paper investigates authenticated key exchange (AKE) protocol under computational Diffie–Hellman assumption in the extended Canetti–Krawczyk model. The core technical component of our protocol is the trapdoor test technique, which is originally introduced to remove the gap Diffie–Hellman (GDH) assumption for the public key encryption schemes. Our contributions are twofold.First, we clarify some misunderstandings of the usage of the trapdoor test technique in AKE protocols showing its adaptation to the AKE protocols is not trivial. We point out some errors in some recent work which attempts to make use of the trapdoor test technique to remove GDH assumption.Second, based on trapdoor test technique, we propose an efficient extended Canetti–Krawczyk secure AKE protocol under computational Diffie–Hellman assumption instead of GDH assumption. Additionally, our protocol does not make use of NAXOS trick and has a tight reduction. In comparison with all existing AKE protocols with the properties as previously mentioned, our protocol with only three exponentiations is most efficient. Copyright © 2013 John Wiley & Sons, Ltd.

A novel pairing-free certificateless authenticated key agreement protocol with provable security

Recently, He et al. (Computers and Mathematics with Applications, 2012) proposed an efficient pairing-free certificateless authenticated key agreement (CL-AKA) protocol and claimed their protocol was provably secure in the extended Canetti-Krawczyk (eCK) model. By giving concrete attacks, we indicate that their protocol is not secure in the eCK model. We propose an improved protocol and show our improvement is secure in the eCK model under the gap Diffie-Hellman (GDH) assumption. Furthermore, the proposed protocol is very efficient.

Characterization of Strongly Secure Authenticated Key Exchanges without NAXOS Technique

This paper examines two-pass authenticated key exchange (AKE) protocols that are secure without the NAXOS technique under the gap Diffie-Hellman assumption in the random oracle model: FHMQV [18], KFU1 [21], SMEN ― [13], and UP [17]. We introduce two protocol, biclique DH protocol and multiplied biclique DH protocol, to analyze the subject protocols, and show that the subject protocols use the multiplied biclique DH protocol as internal protocols. The biclique DH protocol is secure, however, the multiplied biclique DH protocol is insecure. We show the relations between the subject protocols from the viewpoint of how they overcome the insecurity of the multiplied biclique DH protocol: • FHMQV virtually executes two multiplied biclique DH protocols in sequence with the same ephemeral key on two randomized static keys. • KFU1 executes two multiplied biclique DH protocols in parallel with the same ephemeral key. • UP is a version of KFU1 in which one of the static public keys is generated with a random oracle. • SMEN ― can be thought of as a combined execution of two multiplied biclique DH protocols. In addition, this paper provides ways to characterize the AKE protocols and defines two parameters: one consists of the number of static keys, the number of ephemeral keys, and the number of shared secrets, and the other is defined as the total sum of these numbers. When an AKE protocol is constructed based on some group, these two parameters indicate the number of elements in the group, i.e., they are related to the sizes of the storage and communication data.

A simple and robust anonymous two-factor authenticated key exchange protocol

Recently two-factor authenticated key exchange (AKE) protocols have been widely used in various networks to ensure communication security. In 2009, Sun et al. proposed an improved password authenticated key agreement scheme based on smart cards. It is efficient in two-factor authentication key exchange protocols. However, we found that the scheme of Sun et al. was vulnerable to a password-guessing attack and a key compromise impersonation (KCI) attack. We made an improvement on the scheme of Sun et al. by using an elegant but simple trick to eliminate the security vulnerabilities. The improved scheme possesses untraceability, which is absent in the scheme of Sun et al. but important in anonymous communication. Moreover, the new scheme can also resist KCI attack, which is a strong secure property in AKE protocol. We proved the security of our protocol in the random oracle model provided that the Elliptic Curve Gap Diffie–Hellman assumption holds. The trick used in this paper can provide a new way for designing authenticated key agreement in two-factor authentication mechanism. Copyright © 2012 John Wiley & Sons, Ltd.

Directed proxy signature in the standard model

A directed signature is a type of signature with restricted verification ability. Directed signatures allow only a designated verifier to check the validity of the signature issued to him, and at the time of trouble or if necessary, any third party can verify the signature with the help of the signer or the designated verifier. Directed signature schemes are widely used in situations where the receiver’s privacy should be protected. Proxy signatures allow an entity to delegate its signing capability to another entity in such a way that the latter can sign message on behalf of the former when the former is not available. Proxy signature schemes have found numerous practical applications such as distributed systems and mobile agent applications. In this paper, we firstly define the notion of the directed proxy signature by combining the proxy signature and directed signature. Then, we formalize its security model and present a concrete scheme in the standard model. Finally, we use the techniques from provable security to show that the proposed scheme is unforgeable under the gap Diffie-Hellman assumption, and invisible under the decisional Diffie-Hellman assumption.

Efficient strong designated verifier signature schemes without random oracle or with non-delegatability

Designated verifier signature (DVS) allows a signer to convince a designated verifier that a signature is generated by the signer without letting the verifier transfer the conviction to others, while the public can still tell that the signature must be generated by one of them. Strong DVS (SDVS) strengthens the latter part by restricting the public from telling whether the signature is generated by one of them or by someone else. In this paper, we propose two new SDVS schemes. Compared with existing SDVS schemes, the first new scheme has almost the same signature size and meanwhile, is proven secure in the standard model, while the existing ones are secure in the random oracle model. It has tight security reduction to the DDH assumption and the security of the underlying pseudorandom functions. Our second new scheme is the first SDVS supporting non-delegatability, the notion of which was introduced by Lipmaa, Wang and Bao in the context of DVS in ICALP 2005. The scheme is efficient and is provably secure in the random oracle model based on the discrete logarithm assumption and Gap Diffie–Hellman assumption.

CMQV+: An authenticated key exchange protocol from CMQV

Ustaoglu presents a secure and efficient key exchange protocol named CMQV, based on the design rationales of HMQV and NAXOS. Compared with the latter two protocols, on one hand, CMQV achieves high performance of HMQV, and on the other, it is proven secure in eCK model as NAXOS is. However, CMQV enjoys the security proof under gap Diffie-Hellman assumption as indicated by its creators. In this paper, we propose a variant of CMQV, called CMQV+, which is proven secure under a weaker assumption (i.e. computational Diffie-Hellman assumption) in eCK model with random oracles while maintaining the high-performance feature of CMQV as much as possible.

Blake-Wilson, Johnson & Menezes protocol revisited

In this paper, we investigate the famous Blake-Wilson, Johnson & Menezes (BJM) authenticated key exchange protocols. We observe that the BJM model fails to model the adversary’s capability in the public setting well. We modify the BJM model by providing it with a new Register query and a modified Corrupt query. This way, we bring the BJM model further to practice. Moreover, our modification has a significant impact on the security proof of the BJM protocols. Specifically, the security proofs using CDH assumption will no longer work in the modified BJM model. With some modifications, we show that the BJM protocols are secure in the modified BJM model under the gap Diffie-Hellman assumption (GDH).

Password-based authenticated key distribution in the three-party setting with forward security

Key establishment protocols are used for distributing shared keying material in a secure manner. In 1995, Bellare and Rogaway presented a three-party server-based key distribution (3PKD) protocol. But the protocol was recently found insecure and then was fixed by Choo et al. (2005b). But forward-secrecy is not considered in the revised protocol. In this paper, we demonstrate that it is not forward secure indeed. We then revise the protocol to be a password-based authenticated key distribution in the three-party setting and prove our protocol is forward secure in the random-oracle and ideal-cipher models under the password-based chosen-basis gap Diffie-Hellman assumption. Our protocol is quite simple and elegant, and rather efficient when compared to previous solutions.

Proof of Forward Security for Password-Based Authenticated Key Exchange

Recently, M. Abdalla et al. proposed a slightly different variant of AuthA, based on the scheme proposed by E. Bresson et al., and provided the first complete proof of forward-secrecy for AuthA. They claimed that under the Gap Diffie-Hellman assumption the variant of AuthA was forward-secure in the random-oracle model. In this paper, we present an active attack to reveal a previously unpublished flaw in their proof. To fix their proof, we have to introduce one more variant Diffie-Hellman assumption. If so, we found the scheme proposed by E. Bresson et al. could be proved forward secure as well. Since the proposal of E. Bresson et al. is simpler for implementation in practice, we only provided the rigorous proof of forward security for it.