Key Compromise Impersonation Research Articles

A Key Distribution Protocol Based On Wdh Assumption

Key distribution is critical for the practicality of any public key cryptosystem and identity-based encryption (IBE) system. When new users register on the PKG, it is important for him/her to obtain his/her private key safely. In this paper, we propose a solution to deal with this problem without smart cards or a third service. We subjoin a user's private master key using authentication message, by which users can validate the registration information and make sure the security of the protocol based on WDH assumption. We prove that the protocol proposed in this paper can defend the Key Compromise Impersonation (KCI) and Key replicating Attack (KRA).

Cryptanalysis of an Efficient Secret Handshakes Scheme with Unlinkability

In 2011, Gu-Xue proposed an improved secret handshakes scheme with unlinkability based on the Huang-Cao scheme that can achieve strong unlinkability against an outsider adversary. How- ever, this paper points out that Gu-Xue scheme is insecure to key-compromise impersonation (K-CI) attack and cannot provide master key forward secrecy (MFS).

Authenticated key exchange protocol with enhanced freshness properties

AbstractThis paper investigates the security model for authenticated key exchange protocols. We further enhance the enhanced Canetti‐Krawczyk (eCK) model by introducing a notion called strong key compromise impersonation (SKCI) resilience which is first identified in this paper. SKCI resilience guarantees that the adversary cannot masquerade as another party B to communicate with party A even if the static private key and the ephemeral private key of party A are compromised. We point out that the three‐pass authenticated key exchange protocol generically transformed from the two‐pass one secure in the eCK model cannot resist the SKCI attack. Finally, we introduce a new authenticated key exchange protocol SIG‐DH+ and prove that it satisfies our new definition. Copyright © 2010 John Wiley & Sons, Ltd.

Cryptanalysis and Enhancement of Two-pass Authenticated Key Agreement with Key Confirmation Protocols

In NRSC24, Elkamchouchi et al. proposed a new approach for key controlled agreement to provide key control in the Pour public key distribution system. In NRSC25, they further proposed an efficient and confirmed protocol for authenticated key agreement to provide forward secrecy in their previously proposed protocol. This paper, however, will show that Pour’s protocol and Elkamchouchi et al.’s two protocols cannot withstand key compromise impersonation resilience, and man-in-the-middle attacks, and do not have perfect forward secrecy resilience. To eliminate the pointed out security leaks, we further propose a new two-pass authenticated key agreement with a key confirmation protocol. The proposed protocol has the following properties: (i) it is proved to be secure against above attacks and stronger adversary attacks, and provides the desirable security properties as a three-pass authenticated key agreement protocol. (ii) It can provide entity authentication and assurance for key reception in an indirect way. (iii) It can withstand denial of service attacks. In addition, we also propose a derivation one-pass protocol from the proposed two-pass protocol to fit a one-way communication channel, which is suitable for mobile stations and electronic business transactions. The security and the computational complexities of the proposed two protocols outperform those of previously proposed protocols.

A pairing-free identity-based authenticated key agreement protocol with minimal message exchanges

Based on the computational Diffie–Hellman problem, this paper proposes an identity-based authenticated key agreement protocol which removes bilinear pairings. Compared with previous protocols, the new protocol minimizes message exchange time with no extra cost. The protocol provides strong security guarantees including key compromise impersonation resilience, perfect forward secrecy, and master key forward secrecy. A security proof with the modular approach in the modified Bellare–Rogaway model is also provided.

Improvement of McCullagh-Barreto key agreement with KCI-security

McCullagh-Barreto key agreement protocol and its variant achieve perfect forward security and key generation center (KGC) forward security, but provide no resistance to key compromise impersonation attack (KCI attack). In this paper, we give a formal treatment of key compromise impersonation (KCI) attack and define the security notion against it. Then an variant of McCullagh-Barreto protocol is presented with only one more Hash operation. The improved protocol preserves perfect forward security and KGC forward security, and furthermore is proved to be secure against KCI attack under k-Gap-BCAA1 assumption.

Efficient and Strongly Secure Password-based Server Aided Key Exchange

In ACNS'06, Cliff, et al. proposed the password-based server aided key exchange (PSAKE) as one of password-based authenticated key exchanges in the three-party setting (3-party PAKE) in which two clients with different passwords exchange a session key with the help of their corresponding server. Though they also studied a strong security definition of the 3-party PAKE, their security model is not strong enough because there are desirable security properties which cannot be captured. In this paper, we define a new formal security model of the 3-party PAKE which is stronger than the previous model. Our model captures all known desirable security requirements of the 3-party PAKE, like the resistance to key-compromise impersonation, to the leakage of ephemeral private keys of servers and to the undetectable on-line dictionary attack. Also, we propose a new scheme as an improvement of PSAKE with the optimal number of rounds for a client, which is secure in the sense of our model.

Modeling key compromise impersonation attacks on group key exchange protocols

Two-party key exchange (2PKE) protocols have been rigorously analyzed under various models considering different adversarial actions. However, the analysis of group key exchange (GKE) protocols has not been as extensive as that of 2PKE protocols. Particularly, an important security attribute called key compromise impersonation (KCI) resilience has been completely ignored for the case of GKE protocols. Informally, a protocol is said to provide KCI resilience if the compromise of the long-term secret key of a protocol participant A does not allow the adversary to impersonate an honest participant B to A . In this paper, we argue that KCI resilience for GKE protocols is at least as important as it is for 2PKE protocols. Our first contribution is revised definitions of security for GKE protocols considering KCI attacks by both outsider and insider adversaries. We also give a new proof of security for an existing two-round GKE protocol under the revised security definitions assuming random oracles. We then show how to achieve insider KCIR in a generic way using a known compiler in the literature. As one may expect, this additional security assurance comes at the cost of an extra round of communication. Finally, we show that a few existing protocols are not secure against outsider KCI attacks. The attacks on these protocols illustrate the necessity of considering KCI resilience for GKE protocols.

Two improved two-party identity-based authenticated key agreement protocols

Many authenticated key agreement protocols based on identity information were published in recent years. Hsieh et al. presented their protocol in 2002. However, Tseng et al. found a flaw in the protocol which resulted in a key compromise impersonation attack. Later, Tseng proposed his protocol conforming which conforms to all desirable security properties and is efficient. In this paper we propose two new two-party identity-based authenticated key agreement protocols. The first is based on Hsieh et al.'s protocol and makes it immune against Tseng et al.'s attack, while the second is an efficiently improved protocol based on Tseng's protocol.

A deniable authenticated key agreement protocol

This paper presents a deniable authenticated key agreement protocol. This protocol can provide an authenticated session key while the sender and the receiver can deny their involvement in such a protocol if the protocol is executed successfully. Then both can deny their transmitted messages protected by the authenticated session key. If this protocol fails, no authenticated session key can be established and no protected messages can be transmitted. The protocol can be proved secure against key compromise impersonation attack. The protocol employs a new method to isolate a session key from confirmation keys.

An improved identity-based key agreement protocol and its security proof

We revisit the identity-based (ID-based) key agreement protocol due to Ryu et al. The protocol is highly efficient and suitable for real-world applications despite offering no resilience against key-compromise impersonation (K-CI). We show that the protocol is also insecure against reflection attacks. We propose a slight modification to the protocol and prove its security in a widely accepted model.

Breaking and repairing the certificateless key agreement protocol from ASIAN 2006

The certificateless authenticated key agreement protocol proposed by Mandt et al does not have the property of key-compromise impersonation (K-CI) resilience. An improved protocol with a simple modification of their protocol is proposed in this paper. In particular, our improved protocol is proved to be immune to the K-CI attack and at the same time possess other security properties.

Cryptanalysis and improvement of an elliptic curve Diffie-Hellman key agreement protocol

In SAC'05, Strangio proposed protocol ECKE- 1 as an efficient elliptic curve Diffie-Hellman two-party key agreement protocol using public key authentication. In this letter, we show that protocol ECKE-1 is vulnerable to key-compromise impersonation attacks. We also present an improved protocol - ECKE-1N, which can withstand such attacks. The new protocol's performance is comparable to the well-known MQV protocol and maintains the same remarkable list of security properties.

On security proof of McCullagh Barreto's key agreement protocol and its variants

McCullagh and Barreto presented an identity-based authenticated key agreement protocol in CT-RSA 2005. Their protocol was found to be vulnerable to a key-compromise impersonation attack. In order to recover the weakness, McCullagh and Barreto and Xie proposed two variants of the protocol respectively. In each of these works, a security proof of the proposed protocol was presented. In this paper, we revisit these three security proofs and show that all the reductions in these proofs are invalid, because the property of indistinguishability between their simulation and the real world was not held. As a replacement, we slightly modify the McCullagh and Barreto's second protocol and then formally analyse the security of the modified scheme in the Bellare Rogaway key agreement model.

Pairwise Key Agreement Protocols Based on the Weil Pairing

To achieve security in the networks, it is important to be able to encrypt and authenticate messages sent between the users. Keys for encryption and authentication purposes must be agreed upon by the users in the networks. Three new pairwise key agreement protocols based on Weil pairing are proposed in this paper. In those protocols, all the users share common secret information. They may arrange the pairwise key and authenticate each other by fewer messages. The proposed protocols have the security attributes such as known session key security, perfect forward secrecy, no key-compromise impersonation, no unknown key-share and no key control.

Revisit of McCullagh-Barreto Two-Party ID-Based Authenticated Key Agreement Protocols

We revisit the two-party identity-based authenticated key agreement protocol (2P-IDAKA) and its variant resistant to key-compromise impersonation due to McCullagh & Barreto (2005). Protocol 2P-IDAKA carries a proof of security in the Bellare & Rogaway (1993) model. In this paper, we demonstrated why both the protocol and its variant are not secure if the adversary is allowed to send a Reveal query to reveal non-partner players who had accepted the same session key (i.e., termed key-replicating attack in recent work of Krawczyk (2005)). We also demonstrate that both protocols do not achieve the key integrity property, first discussed by Janson & Tsudik (1995).

On the security of efficient user identification scheme

A user identification scheme was proposed by Tseng et al. in 1998, as one of applications that are based on the ideas of ID-based cryptosystems. Recently, Hwang et al. presented an improvement of the Tseng et al.' scheme for wireless mobile environment. In wireless environment, the time for waiting and responding of a mobile device must be reduced due to the lack of the capacity of the battery. The authors tried to achieve this goal by optimizing the pass of the scheme. However, here we show their scheme has some limitation for practical usage in the sense that it is not secure against a key compromise impersonation attack.

On the security of an efficient two-pass key agreement protocol

The MQV key agreement protocol has been included in recent standards (IEEE and ANSI), but its two-pass form is vulnerable to an unknown key-share attack. Recently, Lee et al. proposed an efficient two-pass key agreement protocol to withstand the unknown key-share attack. However, this article shows that their protocol is vulnerable to a key-compromise impersonation attack.