Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1906.09330

The Saeed-Liu-Tian-Gao-Li authenticated key agreement protocol is insecure

Chris J. Mitchell

Published Jun 21, 2019• 2 citations
arXivHTMLPDF

Abstract

A recently proposed authenticated key agreement protocol is shown to be insecure. In particular, one of the two parties is not authenticated, allowing an active man in the middle opponent to replay old messages. The protocol is essentially an authenticated Diffie-Hellman key agreement scheme, and the lack of authentication allows an attacker to replay old messages and have them accepted. Moreover, if the ephemeral key used to compute a protocol message is ever compromised, then the key established using the replayed message will also be compromised. Fixing the problem is simple - there are many provably secure and standardised protocols which are just as efficient as the flawed scheme.

DOI
10.48550/arxiv.1906.09330

Related papers

On the security of certificateless authenticated key agreement protocol

Mengbo Hou, Qiuliang Xu

Authenticated key agreement protocol is a fundamental building block for ensuring private communications between two or more parties over an insecure network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In the recent work, Wang et al. proposed an efficient two-party certificateless authenticated key agreement protocol from pairings used to protect the Web client/server communication. However, we found the scheme cannot withstand key compromise impersonation attack, and also, is vulnerable to one form of the man-in-the-middle attack -- key replicating attack, thus it doesn't possess some desirable security attributes,such as key compromise impersonation resilience and key integrity. We analyze the key replicating attack against the protocol in the BR93 security model in detail, and demonstrate that the protocol is not secure if the adversary was allowed to send a reveal query to reveal non-partner players who had accepted the same session key.

International Conference on Information Technology in Medicine and Education•Aug 1, 2009•2 citations

An efficient protocol for two‐party explicit authenticated key agreement

Minghui Zheng, Huihua Zhou, Jing Chen

Summary Successful and efficient key management plays a critical role toward secured computing and communication systems. Many authenticated key agreement protocols have been proposed to meet the great challenges of information security. The two‐party key agreement protocol can be classified into two categories: implicit and explicit key authentications. This paper investigates the issue on authenticated two‐party key agreement protocol over an insecure public network and extends the existing implicit authenticated key agreement protocol into the explicit one by introducing the authenticators. The advantage of this explicit protocol is that it does not need any fixed public key infrastructure. Furthermore, this explicit protocol is provably secure in the random oracle under the Computation Gap Diffie‐Hellman assumption. Concurrency and Computation: Practice and Experience, 2013.© 2013 Wiley Periodicals, Inc.

Concurrency and Computation Practice and Experience•Dec 26, 2013•11 citations

Weakness and Improvement of an Efficient Key Agreement Protocol

Shuang Qing Liu, Liang Xia, Meng Zi Zhang +1 more

Xiao and Li proposed protocol XKAS and claimed it to be an efficient and secure two-party authenticated Diffie-Hellman key agreement protocol. In this letter, we show that the protocol is vulne- rable to a key-compromise impersonation attack. We also proposed XKAS+, which can withstand such attacks. The new protocol enjoys this property at the expense of a slight increase in computational workload with respect to the original version.

Applied Mechanics and Materials•Aug 1, 2014•0 citations

Cryptanalysis of an efficient certificateless two-party authenticated key agreement protocol.

Qingfeng Cheng

Abstract. Recently, He et al. (Computers and Mathematics with Applications, 2012, 64(6): 1914-1926) proposed a new efficient certificateless two-party authenticated key agreement protocol. They claimed their protocol was provably secure in the extended Canetti-Krawczyk (eCK) model. In this paper, we will show that their protocol is insecure. A type I adversary, who obtains one party’s ephemeral private key, can impersonate the party to cheat the other party and compute the shared session key successfully. For overcoming this weakness, we also propose a simple countermeasure.

•Jan 1, 2012•4 citations

Security analysis of authenticated key agreement protocols and digital signature schemes

Peter Nose

Key agreement and digital signature are two significant and most useful contributions of modern cryptography. Such protocols and schemes allow two or more parties to establish a common session key securely in the presence of a malicious adversary and provide means of ensuring data origin authentication, data integrity and non-repudiation. Thus, secure key agreement protocols and signature schemes are fundamental building blocks for constructing complex higher-level protocols. In this thesis, we deal with security analysis of existing key agreement protocols and digital signature schemes. We examine ten authenticated key agreement protocols without key confirmation, out of which half are two-party and the other half are three-party, and one deterministic identity-based aggregate signature scheme. By giving concrete attacks, we show that these protocols and the scheme do not possess the desirable security attributes or security attributes claimed by their authors. We also present a secure deterministic identity-based signature scheme that supports partial aggregation. First, we show that Okamoto's and Chen et al.’s protocol cannot withstand the key-compromise impersonation attack and that Tan et al.’s, Lim et al.’s and two protocols of Holbl et al. are insecure against the impersonation attack and the man-in-the-middle attack. Next, we prove that one protocol of Holbl et al. is vulnerable to the insider attack, one to the unknown key-share attack, one protocol allows an adversary to compute the private key of any user and one protocol allows her to compute the shared session key. We also show that Selvi et. al.'s deterministic identity-based aggregate signature scheme is universally forgeable, i.e., anyone is able to easily generate valid signatures on any messages of his choice having on average twelve genuine digital signatures. In the end, we introduce a new deterministic identity-based signature scheme and formally prove its security in the random oracle model. The scheme is a major improvement of the signature scheme proposed by Selvi et. al. and offers the same tight security reduction to the underlying gap Diffie-Hellman problem. Because the newly proposed scheme is deterministic it allows partial aggregation, i.e., all the signatures from the same signer can be aggregated into one single short signature.

•Mar 17, 2014•0 citations

Key Replicating Attack on Certificateless Authenticated Key Agreement Protocol

Mengbo Hou, Qiuliang Xu

Authenticated key agreement protocol is crucial in providing data confidentiality and integrity to subsequent communications among two or more parties over a public network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In 2007, Y.J Shi and J.H Li proposed a two-party authenticated key agreement protocol based on the certificateless encryption scheme proposed by B. Libert and J.J. Quisquater. It is found that the scheme is vulnerable to the key replicating attack (one form of the man-in-the-middle attack), so it doesnpsilat possess the security attribute of implicit key authentication and key control. We analyze such an attack of this protocol in the BR93 model in detail, and demonstrate that the protocol is not secure if the adversary is allowed to send a reveal query to reveal non-partner players who had accepted the same session key.

Asia-Pacific Conference on Information Processing•Jul 1, 2009•6 citations
A recently proposed authenticated key agreement protocol is shown to be insecure. In particular, one of the two parties is not authenticated, allowing an active man in the middle opponent to replay old messages. The protocol is essentially an authenticated Diffie-Hellman key agreement scheme, and the lack of authentication allows an attacker to replay old messages and have them accepted. Moreover, if the ephemeral key used to compute a protocol message is ever compromised, then the key established using the replayed message will also be compromised. Fixing the problem is simple - there are many provably secure and standardised protocols which are just as efficient as the flawed scheme.
Authenticated key agreement protocol is a fundamental building block for ensuring private communications between two or more parties over an insecure network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In the recent work, Wang et al. proposed an efficient two-party certificateless authenticated key agreement protocol from pairings used to protect the Web client/server communication. However, we found the scheme cannot withstand key compromise impersonation attack, and also, is vulnerable to one form of the man-in-the-middle attack -- key replicating attack, thus it doesn't possess some desirable security attributes,such as key compromise impersonation resilience and key integrity. We analyze the key replicating attack against the protocol in the BR93 security model in detail, and demonstrate that the protocol is not secure if the adversary was allowed to send a reveal query to reveal non-partner players who had accepted the same session key.
Summary Successful and efficient key management plays a critical role toward secured computing and communication systems. Many authenticated key agreement protocols have been proposed to meet the great challenges of information security. The two‐party key agreement protocol can be classified into two categories: implicit and explicit key authentications. This paper investigates the issue on authenticated two‐party key agreement protocol over an insecure public network and extends the existing implicit authenticated key agreement protocol into the explicit one by introducing the authenticators. The advantage of this explicit protocol is that it does not need any fixed public key infrastructure. Furthermore, this explicit protocol is provably secure in the random oracle under the Computation Gap Diffie‐Hellman assumption. Concurrency and Computation: Practice and Experience, 2013.© 2013 Wiley Periodicals, Inc.
Abstract. Recently, He et al. (Computers and Mathematics with Applications, 2012, 64(6): 1914-1926) proposed a new efficient certificateless two-party authenticated key agreement protocol. They claimed their protocol was provably secure in the extended Canetti-Krawczyk (eCK) model. In this paper, we will show that their protocol is insecure. A type I adversary, who obtains one party’s ephemeral private key, can impersonate the party to cheat the other party and compute the shared session key successfully. For overcoming this weakness, we also propose a simple countermeasure.
Key agreement and digital signature are two significant and most useful contributions of modern cryptography. Such protocols and schemes allow two or more parties to establish a common session key securely in the presence of a malicious adversary and provide means of ensuring data origin authentication, data integrity and non-repudiation. Thus, secure key agreement protocols and signature schemes are fundamental building blocks for constructing complex higher-level protocols. In this thesis, we deal with security analysis of existing key agreement protocols and digital signature schemes. We examine ten authenticated key agreement protocols without key confirmation, out of which half are two-party and the other half are three-party, and one deterministic identity-based aggregate signature scheme. By giving concrete attacks, we show that these protocols and the scheme do not possess the desirable security attributes or security attributes claimed by their authors. We also present a secure deterministic identity-based signature scheme that supports partial aggregation. First, we show that Okamoto's and Chen et al.’s protocol cannot withstand the key-compromise impersonation attack and that Tan et al.’s, Lim et al.’s and two protocols of Holbl et al. are insecure against the impersonation attack and the man-in-the-middle attack. Next, we prove that one protocol of Holbl et al. is vulnerable to the insider attack, one to the unknown key-share attack, one protocol allows an adversary to compute the private key of any user and one protocol allows her to compute the shared session key. We also show that Selvi et. al.'s deterministic identity-based aggregate signature scheme is universally forgeable, i.e., anyone is able to easily generate valid signatures on any messages of his choice having on average twelve genuine digital signatures. In the end, we introduce a new deterministic identity-based signature scheme and formally prove its security in the random oracle model. The scheme is a major improvement of the signature scheme proposed by Selvi et. al. and offers the same tight security reduction to the underlying gap Diffie-Hellman problem. Because the newly proposed scheme is deterministic it allows partial aggregation, i.e., all the signatures from the same signer can be aggregated into one single short signature.
Authenticated key agreement protocol is crucial in providing data confidentiality and integrity to subsequent communications among two or more parties over a public network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In 2007, Y.J Shi and J.H Li proposed a two-party authenticated key agreement protocol based on the certificateless encryption scheme proposed by B. Libert and J.J. Quisquater. It is found that the scheme is vulnerable to the key replicating attack (one form of the man-in-the-middle attack), so it doesnpsilat possess the security attribute of implicit key authentication and key control. We analyze such an attack of this protocol in the BR93 model in detail, and demonstrate that the protocol is not secure if the adversary is allowed to send a reveal query to reveal non-partner players who had accepted the same session key.