Long-term Secret Research Articles

Implementation of an eCK-secure Key Exchange Protocol for OpenSSL

Security models have been developed over time to analyze the security of two-party authenticated key exchange (AKE) protocols. LaMacchia et al. (ProSec 2007) presented a strong security model for AKE protocols, namely the extended Canetti-Krawczyk (eCK) model, addressing wide range of real-world attack scenarios. They constructed a protocol called NAXOS, that is proven-secure in the eCK model. In order to satisfy the eCK security, the NAXOS protocol uses a hash function to combine the long-term secret key and the ephemeral secret key, which is often called as “NAXOS-trick”. However, for the NAXOS-trick-based protocols, the way of leakage modelled in the eCK model leads to an unnatural assumption of leak-free computation of the hash function. Precisely, the eCK model allows the attacker to reveal the ephemeral key while the output of the NAXOS-trick computation remains safe (leak-free). In a recent work of Alawatugoda et al. (IMA Cryptography and Coding 2015), a NAXOS-trick-free eCK-secure AKE protocol is presented, namely protocol P1. In this work, we implement the protocol P1 to be used with the widely-used OpenSSL cryptographic library. OpenSSL implementations are widely used with the real-world security protocol suites, such as Security Socket Layer (SSL) and Transport Layer Security (TLS). As per best of our knowledge, this is the first implementation of a eCK-secure key exchange protocol for the OpenSSL library. Thus, we open up the direction to use the recent advancements of cryptography for real-world Internet communication.

CacheQuote: Efficiently Recovering Long-term Secrets of SGX EPID via Cache Attacks

Intel Software Guard Extensions (SGX) allows users to perform secure computation on platforms that run untrusted software. To validate that the computation is correctly initialized and that it executes on trusted hardware, SGX supports attestation providers that can vouch for the user’s computation. Communication with these attestation providers is based on the Extended Privacy ID (EPID) protocol, which not only validates the computation but is also designed to maintain the user’s privacy. In particular, EPID is designed to ensure that the attestation provider is unable to identify the host on which the computation executes. In this work we investigate the security of the Intel implementation of the EPID protocol. We identify an implementation weakness that leaks information via a cache side channel. We show that a malicious attestation provider can use the leaked information to break the unlinkability guarantees of EPID. We analyze the leaked information using a lattice-based approach for solving the hidden number problem, which we adapt to the zero-knowledge proof in the EPID scheme, extending prior attacks on signature schemes.

A biometric-based authenticated key agreement scheme for session initiation protocol in ip-based multimedia networks

Session Initial Protocol (SIP) has been widely adopted for signaling and controlling interactive sessions in multimedia communication networks. Despite its various advantages compared to predecessor protocols, the security and privacy of the SIP remain challenges due to the risk of real-world public networks. While most SIP applications utilize end-to-end communications, existing studies mainly focus on client-server protocols. In this study, we propose a novel SIP authenticated key agreement protocol for all user-server, user-user, and group communications. An end user employs a short-term token to communicate with either end-users or multimedia servers without connecting to a trusted server. Our security analyzes show that the scheme not only resists all known attacks, but provides the system with many desirable features, including direct end-to-end communications, preserving biometric template privacy, user access control, smart card revocation, and long-term secret updates. The latency of the authenticated key agreement phase is relatively small, and thus this signaling protocol is appropriate for a wide range of real-time applications.

On the leakage-resilient key exchange

AbstractTypically, secure channels are constructed from an authenticated key exchange (AKE) protocol, which authenticates the communicating parties based on long-term public keys and establishes secret session keys. In this paper we address the partial leakage of long-term secret keys of key exchange protocol participants due to various side-channel attacks. Security models for two-party authenticated key exchange protocols have been developed over time to provide security even when the adversary learns certain secret values. This paper combines and extends the advances of security modelling for AKE protocols addressing more granular partial leakage of long-term secrets of protocol participants. Further, we fix some flaws in security proofs of previous leakage-resilient key exchange protocols.

Strong authenticated key exchange with auxiliary inputs

Leakage attacks, including various kinds of side-channel attacks, allow an attacker to learn partial information about the internal secrets such as the secret key and the randomness of a cryptographic system. Designing a strong, meaningful, yet achievable security notion to capture practical leakage attacks is one of the primary goals of leakage-resilient cryptography. In this work, we revisit the modelling and design of authenticated key exchange (AKE) protocols with leakage resilience. We show that the prior works on this topic are inadequate in capturing realistic leakage attacks. To close this research gap, we propose a new security notion named leakage-resilient eCK model w.r.t. auxiliary inputs ( $$\mathsf {AI\hbox {-}LR\text{-}eCK}$$ ) for AKE protocols, which addresses the limitations of the previous models. Our model allows computationally hard-to-invert leakage of both the long-term secret key and the randomness, and also addresses a limitation existing in most of the previous models where the adversary is disallowed to make leakage queries during the challenge session. As another major contribution of this work, we present a generic framework for the construction of AKE protocols that are secure under the proposed $$\mathsf {AI\hbox {-}LR\text{-}eCK}$$ model. An instantiation based on the decision Diffie–Hellman (DDH) assumption in the standard model is also given to demonstrate the feasibility of our proposed framework.

Generic construction of an $$\mathrm {eCK}$$ eCK -secure key exchange protocol in the standard model

LaMacchia, Lauter and Mityagin presented a strong security model for authenticated key agreement, namely the \(\mathrm {eCK}\) model. They also constructed a protocol, namely the NAXOS protocol, that enjoys a simple security proof in the \(\mathrm {eCK}\) model. However, the NAXOS protocol uses a random oracle-based technique to combine the long-term secret key and the per session randomness, so-called NAXOS trick, in order to achieve the \(\mathrm {eCK}\) security definition. For NAXOS trick-based protocols, the leakage of per session randomness modeled in the \(\mathrm {eCK}\) model is somewhat unnatural, because the \(\mathrm {eCK}\) model leaks per session randomness, while the output of the NAXOS trick computation remains safe. In this work, we present a standard model \(\mathrm {eCK}\)-secure protocol construction, eliminating the NAXOS trick. Moreover, our protocol is a generic construction, which can be instantiated with arbitrary suitable cryptographic primitives. Thus, we present a generic \(\mathrm {eCK}\)-secure, NAXOS-free, standard model key exchange protocol. To the best of our knowledge this is the first paper on generic transformation of a \(\mathrm {CCA2}\)-secure public-key encryption scheme to an \(\mathrm {eCK}\)-secure key exchange protocol in the standard model.

DP5: A Private Presence Service

Abstract Users of social applications like to be notified when their friends are online. Typically, this is done by a central server keeping track of who is online and offline, as well as of all of the users’ “buddy lists”, which contain sensitive information. We present DP5, a cryptographic service that implements online presence indication in a privacy-friendly way. DP5 allows clients to register their online presence and query the presence of their list of friends while keeping this list secret. Besides presence, high-integrity status updates are supported, to facilitate key update and rendezvous protocols. While infrastructure services are required for DP5 to operate, they are designed to not require any long-term secrets and provide perfect forward secrecy in case of compromise. We provide security arguments for the indistinguishability properties of the protocol, as well as an evaluation of its scalability and performance.

A secure and privacy-preserving event reporting scheme for vehicular Ad Hoc networks

In vehicular ad hoc networks, vehicles should report events to warn the drivers of unexpected hazards on the roads. While these reports can contribute to safer driving, vehicular ad hoc networks suffer from various security threats; a major one is Sybil attacks. In these attacks, an individual attacker can pretend as several vehicles that report a false event. In this paper, we propose a secure event-reporting scheme that is resilient to Sybil attacks and preserves the privacy of drivers. Instead of using asymmetric key cryptography, we use symmetric key cryptography to decrease the computation overhead. We propose an efficient pseudonym generation technique. The vehicles receive a small number of long-term secrets to compute pseudonyms/keys to be used in reporting the events without leaking private information about the drivers. In addition, we propose a scheme to identify the vehicles that use their pool of pseudonyms to launch Sybil attacks without leaking private information to road side units. We also study a strong adversary model assuming that attackers can share their pool of pseudonyms to launch colluding Sybil attacks. Our security analysis and simulation results demonstrate that our scheme can detect Sybil attackers effectively with low communication and computation overhead. Copyright © 2015John Wiley & Sons, Ltd.

Privacy preserving smartcard-based authentication system with provable security

In this paper, we suggest a new privacy preserving smartcard-based password authenticated key exchange SC-PAKE with provable security. Only the user who has two secrets smartcard and password can go through authentication with key exchange while concealing its identifier from outsider adversaries. For guaranteeing both authentication and identity ID protection, we define a security of session key and an anonymity of identifier. We also show that the proposed protocol satisfies two definitions under computational Diffie-Hellman assumption and chosen ciphertext attack CCA secure symmetric encryption. One problem is how a common secure key an encryption/decryption key can be shared between a server and a user without letting the corresponding server know a certain ID of user. For this issue, we set two kinds of long-term secrets; one is used to make a symmetric key for ID protection with user's ephemeral value, and the other is issued for helping agreement of a final session key for mutual authentication. Performance analysis shows that the proposed SC-PAKE has better efficiency in computation and communication costs than recent SC-PAKE schemes. To the best of our knowledge, it is the first scheme to guarantee both the session key security with authentication and privacy-enjoying provable security. Copyright © 2015John Wiley & Sons, Ltd.

PUF 기반 RFID 인증 프로토콜의 효율적 설계에 관한 연구

PUF(physically unclonable function)는 태그 혹은 디바이스 내에 삽입되어 구현되며, 해당 디바이스의 고유한 물리적인 성질을 이용해서, 입력 값 x에 대해 노이지 y값을 출력한다. 비록 x가 동일하게 입력되더라도 매번 다른 출력 값(<TEX>$y_1,{\cdots}y_n$</TEX>)을 출력하며, 탬퍼 방지 (tamper-resistance) 성질로 인해, 암호 프로토콜에 활용도가 매우 높다. 본 논문에서는 이러한 PUF를 이용하여 RFID 인증 프로토콜을 안전하고 효율적으로 설계하는 방법에 대해 연구한다. 본 논문에서 제안된 방법은, 기존의 방법과 비교했을 시, 공격자가 메모리 노출 공격을 통해 비휘발성 메모리에 존재하는 롱텀(long-term) 키 값을 알게 되더라도, 그 세션 전후에 사용된 태그(tag)의 안전성 및 프라이버시가 보장되도록 설계하였다. 또한, PUF에 사용된 키 값을 복원하는 알고리즘이 태그 측이 아닌 RFID 리더에서 수행하도록 설계함으로써, 태그 구현 비용 및 전체 프로토콜 실행시간을 최소화할 수 있도록 하였다. A PUF is embedded and implemented into a tag or a device, and outputs a noise y with an input of x, based on its own unique physical characteristics. Although x is used multiple times as inputs of PUF, the PUF outputs slightly different noises, (<TEX>$y_1,{\cdots}y_n$</TEX>), and also the PUF has tamper-resistance property, hence it has been widely used in cryptographic protocol. In this paper, we study how to design a PUF-based RFID authentication protocol in a secure and an efficient way. Compared with recent schemes, the proposed scheme guarantees both authentication and privacy of backword/forward under the compromise of long-term secrets stored in tag. And also, the most cost and time-consumming procedure, key recovery algorithm used with PUF, has been desgined in the side of RFID reader, not in the tag, and, consequently, gives possibility to minimize costs for implementation and running time.

Enhancing the security of password authenticated key agreement protocols based on chaotic maps

Password authenticated key agreement allows users to only keep a weak password and establish an authentication key shared with a server. However, the chaotic maps based authenticated key agreement protocol of Xiao et al. in which time-stamps are used to resist replaying attacks and the subsequent group key agreement protocol of Guo and Zhang in which chaotic hash is used as an alternative are insecure against off-line password guessing attacks and violate the session key security. Therefore, this work presents two secure password authenticated key agreement protocols based on chaotic maps. One is based on synchronized clocks, while the other uses nonces. Besides preventing the limitations of previous protocols and reducing the number of messages during communication, the proposed protocols do not require extra equipment for storing long-term secrets in the client.

Cross-Domain Password-Based Authenticated Key Exchange Revisited

We revisit the problem of secure cross-domain communication between two users belonging to different security domains within an open and distributed environment. Existing approaches presuppose that either the users are in possession of public key certificates issued by a trusted certificate authority (CA), or the associated domain authentication servers share a long-term secret key. In this article, we propose a generic framework for designing four-party password-based authenticated key exchange (4PAKE) protocols. Our framework takes a different approach from previous work. The users are not required to have public key certificates, but they simply reuse their login passwords, which they share with their respective domain authentication servers. On the other hand, the authentication servers, assumed to be part of a standard PKI, act as ephemeral CAs that certify some key materials that the users can subsequently use to exchange and agree on as a session key. Moreover, we adopt a compositional approach. That is, by treating any secure two-party password-based key exchange (2PAKE) protocol and two-party asymmetric-key/symmetric-key-based key exchange (2A/SAKE) protocol as black boxes, we combine them to obtain generic and provably secure 4PAKE protocols.

Scalable attribute-based group key establishment: from passive to active and deniable

A protocol compiler is presented which transforms any unauthenticated (attribute-based) group key establishment protocol into an authenticated attribute-based group key establishment. If the protocol to which the compiler is applied does not make use of long-term secrets, then the resulting protocol is, in addition, deniable. In particular, applying our compiler to an unauthenticated 2-round protocol going back to Burmester and Desmedt results in a 3-round solution for attribute-based group key establishment, offering both forward secrecy and deniability.

Beyond eCK: perfect forward secrecy under actor compromise and ephemeral-key reveal

We show that it is possible to achieve perfect forward secrecy (PFS) in two-message or one-round key exchange (KE) protocols even in the presence of very strong active adversaries that can reveal random values of sessions and compromise long-term secret keys of parties. We provide two new game-based security models for KE protocols with increasing security guarantees, namely, eCK\(^{w}\) and eCK-PFS. The eCK\(^{w}\) model is a slightly stronger variant of the extended Canetti–Krawczyk (eCK) security model. The eCK-PFS model captures PFS in the presence of eCK\(^{w}\) adversaries. We propose a security-strengthening transformation (i. e., a compiler) from eCK\(^{w}\) to eCK-PFS that can be applied to protocols that only achieve security in a weaker model than eCK\(^{w}\), which we call eCK\(^{\text {passive}}\). We show that, given a two-message Diffie–Hellman type protocol secure in eCK\(^{\text {passive}}\), our transformation yields a two-message protocol that is secure in eCK-PFS. We demonstrate how our transformation can be applied to concrete KE protocols. In particular, our methodology allows us to prove the security of the first known one-round protocol that achieves PFS under actor compromise and ephemeral-key reveal.

Cryptanalysis of a Password-based Group Key Exchange Protocol Using Secret Sharing

Yuan et al. recently introduced a password-based group key transfer protocol that uses secret sharing, which they claim to be efficient and secure [9]. We remark its resemblance to the construction of Harn and Lin [1], which Nam et al. proved vulnerable to a replay attack [3]. It is straightforward that the same attack can be mount against Yuan et al.’s protocol, proving that the authors’ claim is false. In the same paper, Nam et al. propose a countermeasure that may also apply to Yuan et al.’s protocol. However, we show that their protocol remains susceptible to an insider attack (even if it stands against the replay attack): any malicious participant can recover the long-term secret password of any other user and therefore becomes able to compute group keys he is unauthorized to know.

Efficient arbitrated quantum signature and its proof of security

In this paper, an efficient arbitrated quantum signature scheme is proposed by combining quantum cryptographic techniques and some ideas in classical cryptography. In the presented scheme, the signatory and the receiver can share a long-term secret key with the arbitrator by utilizing the key together with a random number. While in previous quantum signature schemes, the key shared between the signatory and the arbitrator or between the receiver and the arbitrator could be used only once, and thus each time when a signatory needs to sign, the signatory and the receiver have to obtain a new key shared with the arbitrator through a quantum key distribution protocol. Detailed theoretical analysis shows that the proposed scheme is efficient and provably secure.

Simple Group Password-based Authenticated Key Agreements for the Integrated EPR Information System

The security and privacy are important issues for electronic patient records (EPRs). The goal of EPRs is sharing the patients' medical histories such as the diagnosis records, reports and diagnosis image files among hospitals by the Internet. So the security issue for the integrated EPR information system is essential. That is, to ensure the information during transmission through by the Internet is secure and private. The group password-based authenticated key agreement (GPAKE) allows a group of users like doctors, nurses and patients to establish a common session key by using password authentication. Then the group of users can securely communicate by using this session key. Many approaches about GAPKE employ the public key infrastructure (PKI) in order to have higher security. However, it not only increases users' overheads and requires keeping an extra equipment for storing long-term secret keys, but also requires maintaining the public key system. This investigation presents a simple group password-based authenticated key agreement (SGPAKE) protocol for the integrated EPR information system. The proposed SGPAKE protocol does not require using the server or users' public keys. Each user only remembers his weak password shared with a trusted server, and then can obtain a common session key. Then all users can securely communicate by using this session key. The proposed SGPAKE protocol not only provides users with convince, but also has higher security.

Robust Fuzzy Extractors and Authenticated Key Agreement From Close Secrets

Consider two parties holding samples from correlated distributions $W$ and $W^{\prime}$ , respectively, where these samples are within distance $t$ of each other in some metric space. The parties wish to agree on a close-to-uniformly distributed secret key $R$ by sending a single message over an insecure channel controlled by an all-powerful adversary who may read and modify anything sent over the channel. We consider both the keyless case, where the parties share no additional secret information, and the keyed case, where the parties share a long-term secret ${\ssr SK}_{\ssr Ext}$ that they can use to generate a sequence of session keys $\{R_{j}\}$ using multiple pairs $\{(W_{j}, W^{\prime}_{j})\}$ . The former has applications to, e.g., biometric authentication, while the latter arises in, e.g., the bounded-storage model with errors. We show solutions that improve upon previous work in several respects. The best prior solution for the keyless case with no errors (i.e., $t=0$ ) requires the min-entropy of $W$ to exceed $2n/3$ , where $n$ is the bit length of $W$ . Our solution applies whenever the min-entropy of $W$ exceeds the minimal threshold $n/2$ , and yields a longer key.

Security Weaknesses in Harn-Lin and Dutta-Barua Protocols for Group Key Establishment

Key establishment protocols are fundamental for establishing secure communication channels over public insecure networks. Security must be given the topmost priority in the design of a key establishment protocol. In this work, we provide a security analysis on two recent key establishment protocols: Harn and Lin’s group key transfer protocol and Dutta and Barua’s group key agreement protocol. Our analysis shows that both the Harn-Lin protocol and the Dutta-Barua protocol have a flaw in their design and can be easily attacked. The attack we mount on the Harn-Lin protocol is a replay attack whereby a malicious user can obtain the long-term secrets of any other users. The Dutta-Barua protocol is vulnerable to an unknown key-share attack. For each of the two protocols, we present how to eliminate their security vulnerabilities. We also improve Dutta and Barua’s proof of security to make it valid against unknown key share attacks.

Comments on "An Anonymous and Self-Verified Mobile Authentication with Authenticated Key Agreement for Large-Scale Wireless Networks"

In a recent paper (IEEE Trans. Wireless Commun., vol. 9, no. 11, 2010), Chang and Tsai presented a self-verified mobile authentication scheme for large-scale wireless networks. In this letter, we show that there is a serious security flaw in the key delegation phase of the scheme: two colluding mobile users can retrieve the long-term secret key of their home server without performing any active attacks. We then present a suggestion to fix the problem without losing any features (such as high efficiency and scalability) of the original scheme.