Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1611.07299 · International Journal of Communication Systems

Cryptanalysis of an identity‐based authenticated key exchange protocol

Younes Hatri, Ayoub Otmani, Kenza Guenda

Published Dec 11, 2017• 11 citations
arXivHTMLPDF

Abstract

Summary Authenticated key exchange protocols represent an important cryptographic mechanism that enables several parties to communicate securely over an open network. Elashry, Mu, and Susilo proposed an identity‐based authenticated key exchange (IBAKE) protocol where different parties establish secure communication by means of their public identities.The authors also introduced a new security notion for IBAKE protocols called resiliency, that is, if the secret shared key is compromised, the entities can generate another shared secret key without establishing a new session between them. They then claimed that their IBAKE protocol satisfies this security notion. We analyze the security of their protocol and prove that it has a major security flaw, which renders it insecure against an impersonation attack. We also disprove the resiliency property of their scheme by proposing an attack where an adversary can compute any shared secret key if just one secret bit is leaked.

DOI
10.1002/dac.3477

Related papers

A resilient identity-based authenticated key exchange protocol

Ibrahim F. Elashry, Yi Mu, Willy Susilo

This paper presents a new security notion for key exchange (KE) protocols called resiliency. That is, if a shared secret between a group of parties is compromised or leaked, they can generate another completely new shared secret without the need to set up a new KE session. We present an identity-based authenticated KE protocol that satisfies the resiliency security property. We prove that if an l-bit shared secret key (SSK) is leaked, then two parties P1 and P2 can safely generate another shared secret SSK1 without the need to establish a new session. We adjust the unauthenticated adversarial model of the Canetti–Krawczyk to meet this security property and prove the security of the proposed protocol using the Canetti–Krawczyk model based on the quadratic residuosity assumption. Copyright © 2015 John Wiley & Sons, Ltd.

Security and Communication Networks•Jan 23, 2015•11 citations

An Identity Based Key Exchange Scheme with Perfect Forward Security

Sonalin Subhadarshini

Identity-based authenticated key exchange protocol(IBAKE) with perfect forward security(PFS) is one of the major advancement in the field of cryptography. This protocol is used to establish secure communication between two parties who are provided with their own unique identities, by establishing their common secret keys without the need of sending and verifying their public key certificates. This scheme involves a key generation centre(KGC) which would provide the two parties involved, with their static key that can be authenticated by the parties. Our protocol can be viewed as a variant of the protocol proposed by Xie et al. in 2012 [8]. Our protocol does not rely on bilinear pairings. We have made a comparative study of the existing protocol and the proposed protocol and proved that our protocol is more efficient. We have also provided enough proofs to verfy that our protocol is secure under attacks and is not forgeable.

•Jan 1, 2015•0 citations

Malicious Private-key Generator in Identity-based Authenticated-key Exchange

Kazuma Wariki, Atsushi Fujioka, Kazuki Yoneyama +3 more

This paper introduces two new security models for identity-based authenticated-key exchange (IBAKE): the id-neCK security model and the id-reCK security model. While most existing IBAKE models assume that the private-key generator (PKG) behaves honestly, the id-neCK model captures a malicious scenario in which an adversary can obtain the random string used by the PKG to generate the master public- and secret-keys. In contrast, the id-reCK model captures an attack in which an adversary can replace the master public- and secret-keys generated by an honest PKG. We prove that the id-reCK security notion is strictly stronger than both the id-neCK security notion and the existing id-eCK (identity-based extended Canetti-Krawczyk) security notion, which guarantees resistance against ephemeral private information leakage. Next, assuming the existence of a secure public-key cryptosystem, we show that there exists an IBAKE protocol that is id-eCK secure but not id-neCK secure. This implies that, under this assumption, the id-neCK security notion is strictly stronger than the id-eCK security notion. Finally, we discuss IBAKE protocols that satisfy these security notions.

Journal of Information Processing•Jan 1, 2026•0 citations

A Leakage-Resilient ID-Based Authenticated Key Exchange Protocol With a Revocation Mechanism

Tung‐Tso Tsai, Yun‐Hsin Chuang, Yuh‐Min Tseng +2 more

Establishing a session key (SSK) is very important for real-world deployment in open networks, which enables secure communication between remote parties. In the past, some authenticated key exchange (AKE) protocols have been proposed to generate a SSK, but the certificate management issue is inhered in the traditional public key infrastructure and must be addressed. To tackle this issue, the identity (ID)-based concept is added to AKE, called ID-AKE. Indeed, the security of the existing AKE/ID-AKE protocols is gaining increasing importance due to some new types of attacks, namely, side-channel attacks. In such attacks, adversaries could obtain secret keys’ partial information during the execution of cryptographic protocols (including AKE/ID-AKE). To withstand such attacks, many leakage-resilient ID-AKE (LR-ID-AKE) protocols resisting side-channel attacks have been proposed. However, these existing LR-ID-AKE protocols have no efficient solution to revoke compromised users. In this article, the first LR-ID-AKE protocol with an efficient revocation mechanism, called LR-RID-AKE, is proposed. The proposed protocol is not only as secure as existing LR-ID-AKE protocols but also able to efficiently revoke compromised users from the system.

IEEE Access•Jan 1, 2021•10 citations

An RSA-Based Leakage-Resilient Authenticated Key Exchange Protocol Secure against Replacement Attacks, and Its Extensions

SeongHan Shin, Kazukuni Kobara, Hideki Imai

Secure channels can be realized by an authenticated key exchange (AKE) protocol that generates authenticated session keys between the involving parties. In [32], Shin et al., proposed a new kind of AKE (RSA-AKE) protocol whose goal is to provide high efficiency and security against leakage of stored secrets as much as possible. Let us consider more powerful attacks where an adversary completely controls the communications and the stored secrets (the latter is denoted by “replacement” attacks). In this paper, we first show that the RSA-AKE protocol [32] is no longer secure against such an adversary. The main contributions of this paper are as follows: (1) we propose an RSA-based leakage-resilient AKE (RSA-AKE2) protocol that is secure against active attacks as well as replacement attacks; (2) we prove that the RSA-AKE2 protocol is secure against replacement attacks based on the number theory results; (3) we show that it is provably secure in the random oracle model, by showing the reduction to the RSA one-wayness, under an extended model that covers active attacks and replacement attacks; (4) in terms of efficiency, the RSA-AKE2 protocol is comparable to [32] in the sense that the client needs to compute only one modular multiplication with pre-computation; and (5) we also discuss about extensions of the RSA-AKE2 protocol for several security properties (i.e., synchronization of stored secrets, privacy of client and solution to server compromise-impersonation attacks).

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Jan 1, 2010•6 citations

Authenticated key exchange protocol with enhanced freshness properties

Hai Huang, Zhenfu Cao

Abstract This paper investigates the security model for authenticated key exchange protocols. We further enhance the enhanced Canetti‐Krawczyk (eCK) model by introducing a notion called strong key compromise impersonation (SKCI) resilience which is first identified in this paper. SKCI resilience guarantees that the adversary cannot masquerade as another party B to communicate with party A even if the static private key and the ephemeral private key of party A are compromised. We point out that the three‐pass authenticated key exchange protocol generically transformed from the two‐pass one secure in the eCK model cannot resist the SKCI attack. Finally, we introduce a new authenticated key exchange protocol SIG‐DH+ and prove that it satisfies our new definition. Copyright © 2010 John Wiley & Sons, Ltd.

Security and Communication Networks•Aug 28, 2010•2 citations
Summary Authenticated key exchange protocols represent an important cryptographic mechanism that enables several parties to communicate securely over an open network. Elashry, Mu, and Susilo proposed an identity‐based authenticated key exchange (IBAKE) protocol where different parties establish secure communication by means of their public identities.The authors also introduced a new security notion for IBAKE protocols called resiliency, that is, if the secret shared key is compromised, the entities can generate another shared secret key without establishing a new session between them. They then claimed that their IBAKE protocol satisfies this security notion. We analyze the security of their protocol and prove that it has a major security flaw, which renders it insecure against an impersonation attack. We also disprove the resiliency property of their scheme by proposing an attack where an adversary can compute any shared secret key if just one secret bit is leaked.
This paper presents a new security notion for key exchange (KE) protocols called resiliency. That is, if a shared secret between a group of parties is compromised or leaked, they can generate another completely new shared secret without the need to set up a new KE session. We present an identity-based authenticated KE protocol that satisfies the resiliency security property. We prove that if an l-bit shared secret key (SSK) is leaked, then two parties P1 and P2 can safely generate another shared secret SSK1 without the need to establish a new session. We adjust the unauthenticated adversarial model of the Canetti–Krawczyk to meet this security property and prove the security of the proposed protocol using the Canetti–Krawczyk model based on the quadratic residuosity assumption. Copyright © 2015 John Wiley & Sons, Ltd.
Identity-based authenticated key exchange protocol(IBAKE) with perfect forward security(PFS) is one of the major advancement in the field of cryptography. This protocol is used to establish secure communication between two parties who are provided with their own unique identities, by establishing their common secret keys without the need of sending and verifying their public key certificates. This scheme involves a key generation centre(KGC) which would provide the two parties involved, with their static key that can be authenticated by the parties. Our protocol can be viewed as a variant of the protocol proposed by Xie et al. in 2012 [8]. Our protocol does not rely on bilinear pairings. We have made a comparative study of the existing protocol and the proposed protocol and proved that our protocol is more efficient. We have also provided enough proofs to verfy that our protocol is secure under attacks and is not forgeable.
This paper introduces two new security models for identity-based authenticated-key exchange (IBAKE): the id-neCK security model and the id-reCK security model. While most existing IBAKE models assume that the private-key generator (PKG) behaves honestly, the id-neCK model captures a malicious scenario in which an adversary can obtain the random string used by the PKG to generate the master public- and secret-keys. In contrast, the id-reCK model captures an attack in which an adversary can replace the master public- and secret-keys generated by an honest PKG. We prove that the id-reCK security notion is strictly stronger than both the id-neCK security notion and the existing id-eCK (identity-based extended Canetti-Krawczyk) security notion, which guarantees resistance against ephemeral private information leakage. Next, assuming the existence of a secure public-key cryptosystem, we show that there exists an IBAKE protocol that is id-eCK secure but not id-neCK secure. This implies that, under this assumption, the id-neCK security notion is strictly stronger than the id-eCK security notion. Finally, we discuss IBAKE protocols that satisfy these security notions.
Establishing a session key (SSK) is very important for real-world deployment in open networks, which enables secure communication between remote parties. In the past, some authenticated key exchange (AKE) protocols have been proposed to generate a SSK, but the certificate management issue is inhered in the traditional public key infrastructure and must be addressed. To tackle this issue, the identity (ID)-based concept is added to AKE, called ID-AKE. Indeed, the security of the existing AKE/ID-AKE protocols is gaining increasing importance due to some new types of attacks, namely, side-channel attacks. In such attacks, adversaries could obtain secret keys’ partial information during the execution of cryptographic protocols (including AKE/ID-AKE). To withstand such attacks, many leakage-resilient ID-AKE (LR-ID-AKE) protocols resisting side-channel attacks have been proposed. However, these existing LR-ID-AKE protocols have no efficient solution to revoke compromised users. In this article, the first LR-ID-AKE protocol with an efficient revocation mechanism, called LR-RID-AKE, is proposed. The proposed protocol is not only as secure as existing LR-ID-AKE protocols but also able to efficiently revoke compromised users from the system.
Secure channels can be realized by an authenticated key exchange (AKE) protocol that generates authenticated session keys between the involving parties. In [32], Shin et al., proposed a new kind of AKE (RSA-AKE) protocol whose goal is to provide high efficiency and security against leakage of stored secrets as much as possible. Let us consider more powerful attacks where an adversary completely controls the communications and the stored secrets (the latter is denoted by “replacement” attacks). In this paper, we first show that the RSA-AKE protocol [32] is no longer secure against such an adversary. The main contributions of this paper are as follows: (1) we propose an RSA-based leakage-resilient AKE (RSA-AKE2) protocol that is secure against active attacks as well as replacement attacks; (2) we prove that the RSA-AKE2 protocol is secure against replacement attacks based on the number theory results; (3) we show that it is provably secure in the random oracle model, by showing the reduction to the RSA one-wayness, under an extended model that covers active attacks and replacement attacks; (4) in terms of efficiency, the RSA-AKE2 protocol is comparable to [32] in the sense that the client needs to compute only one modular multiplication with pre-computation; and (5) we also discuss about extensions of the RSA-AKE2 protocol for several security properties (i.e., synchronization of stored secrets, privacy of client and solution to server compromise-impersonation attacks).
Abstract This paper investigates the security model for authenticated key exchange protocols. We further enhance the enhanced Canetti‐Krawczyk (eCK) model by introducing a notion called strong key compromise impersonation (SKCI) resilience which is first identified in this paper. SKCI resilience guarantees that the adversary cannot masquerade as another party B to communicate with party A even if the static private key and the ephemeral private key of party A are compromised. We point out that the three‐pass authenticated key exchange protocol generically transformed from the two‐pass one secure in the eCK model cannot resist the SKCI attack. Finally, we introduce a new authenticated key exchange protocol SIG‐DH+ and prove that it satisfies our new definition. Copyright © 2010 John Wiley & Sons, Ltd.