Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

On The Indistinguishability-Based Security Model of Key Agreement Protocols-Simple Cases.

Zhaohui Cheng, Manos Nistazakis, Richard Comley, Luminita Vasiu

Published Jan 1, 2005• 87 citations
OpenAlex

Abstract

Since Bellare and Rogaway's work in 1994, the indistinguishability-based security models of authenticated key agreement protocols in simple cases have been evolving for more than ten years. In this paper, we review and organize the models under a unified framework with some new extensions. By providing a new ability (the Coin query) to adversaries and redefining two key security notions, the framework fully exploits an adversary's capacity and can be used to prove all the commonly required security attributes of key agreement protocols with key confirmation. At the same time, the Coin query is also used to define a model which can be used to heuristically evaluate the security of a large category of authenticated protocols without key confirmation. We use the models to analyze a few identity-based authenticated key agreement protocols with pairings.

Related papers

Cryptanalysis of ID-based Authenticated Key Agreement Protocol

Renwang Su

Authenticated key agreement is an important original language of cryptology.This paper analyzes an ID-based authenticated key agreement protocol,carries a proof of security in the Bellare-Rogaway-93 model,pointes out the protocol is insecure if the adversary is allowed to send a Reveal query.Researches show that the protocol can not resist the key compromise impersonation attack.

Jisuanji gongcheng•Jan 1, 2008•0 citations

On Security Proof of McCullagh-Barreto's Key Agreement Protocol and its Variants.

Zhaohui Cheng, Liqun Chen

McCullagh and Barreto presented an identity-based authenticated key agreement protocol in CT-RSA 2005. Their protocol was found to be vulnerable to a key-compromise impersonation attack. In order to recover the weakness, McCullagh and Barreto, and Xie proposed two variants of the protocol respectively. In each of these works, a security proof of the proposed protocol was presented. In this paper, we revisit these three security proofs and show that all the reductions in these proofs are invalid, because the property of indistinguishability between their simulation and the real world was not held. As a replacement, we slightly modify the McCullagh and Barreto’s second protocol and then formally analyse the security of the modified scheme in the Bellare-Rogaway key agreement model.

•Jan 1, 2005•12 citations

Strongly-Secure Identity-based Key Agreement and Anonymous Extension.

Sherman S. M. Chow, Kim‐Kwang Raymond Choo

Abstract. We study the provable security of identity-based (ID-based) key agreement protocols. Although several published protocols have been proven secure in the random oracle model, only a weak adversarial model is considered – the adversary is not allowed to ask Session-Key Reveal queries that will allow the adversary to learn previously established session keys. Recent research efforts devoted to providing a stronger level of security require strong assumptions, such as assuming that the simulator has access to a non-existential computational or decisional oracle. In this work, we propose an ID-based key agreement protocol and prove its security in the widely accepted indistinguishability-based model of Canetti and Krawczyk. In our proof, the simulator does not require access to any non-existential computational or decisional oracle. We then extend our basic protocol to support ad-hoc anonymous key agreement with bilateral privacy. To the best of our knowledge, this is the first protocol of its kind as previously published protocols are for fixed group and provide only unilateral privacy (i.e., only one of the protocol participants enjoy anonymity).

•Jan 1, 2007•0 citations

Pairing-Based Two-Party Authenticated Key Agreement Protocol.

Rongxing Lu, Zhenfu Cao, Renwang Su +1 more

Abstract. To achieve secure data communications, two parties should be authenticated by each other and agree on a secret session key by exchanging messages over an insecure channel. In this paper, based on the bilinear pairing, we present a new two-party authenticated key agreement protocol, and use the techniques from provable security to examine the security of our protocol within Bellare-Rogaway model. 1

•Jan 1, 2005•6 citations

Security analysis of authenticated key agreement protocols and digital signature schemes

Peter Nose

Key agreement and digital signature are two significant and most useful contributions of modern cryptography. Such protocols and schemes allow two or more parties to establish a common session key securely in the presence of a malicious adversary and provide means of ensuring data origin authentication, data integrity and non-repudiation. Thus, secure key agreement protocols and signature schemes are fundamental building blocks for constructing complex higher-level protocols. In this thesis, we deal with security analysis of existing key agreement protocols and digital signature schemes. We examine ten authenticated key agreement protocols without key confirmation, out of which half are two-party and the other half are three-party, and one deterministic identity-based aggregate signature scheme. By giving concrete attacks, we show that these protocols and the scheme do not possess the desirable security attributes or security attributes claimed by their authors. We also present a secure deterministic identity-based signature scheme that supports partial aggregation. First, we show that Okamoto's and Chen et al.’s protocol cannot withstand the key-compromise impersonation attack and that Tan et al.’s, Lim et al.’s and two protocols of Holbl et al. are insecure against the impersonation attack and the man-in-the-middle attack. Next, we prove that one protocol of Holbl et al. is vulnerable to the insider attack, one to the unknown key-share attack, one protocol allows an adversary to compute the private key of any user and one protocol allows her to compute the shared session key. We also show that Selvi et. al.'s deterministic identity-based aggregate signature scheme is universally forgeable, i.e., anyone is able to easily generate valid signatures on any messages of his choice having on average twelve genuine digital signatures. In the end, we introduce a new deterministic identity-based signature scheme and formally prove its security in the random oracle model. The scheme is a major improvement of the signature scheme proposed by Selvi et. al. and offers the same tight security reduction to the underlying gap Diffie-Hellman problem. Because the newly proposed scheme is deterministic it allows partial aggregation, i.e., all the signatures from the same signer can be aggregated into one single short signature.

•Mar 17, 2014•0 citations

Revisit Of McCullagh-Barreto Two-Party ID-Based Authenticated Key Agreement Protocols.

Kim‐Kwang Raymond Choo

The recently proposed two-party ID-based authenticated key agreement protocols (with and without escrow) and its variant resistant to key-compromise impersonation by McCullagh & Barreto are revisited. The protocol carries a proof of security in the Bellare & Rogaway (1993) model. In this paper, it is demonstrated that the protocols and its variant are not secure if the adversary is allowed to send a Reveal query to reveal non-partner players who had accepted the same session key.

•Jan 1, 2004•3 citations
Since Bellare and Rogaway's work in 1994, the indistinguishability-based security models of authenticated key agreement protocols in simple cases have been evolving for more than ten years. In this paper, we review and organize the models under a unified framework with some new extensions. By providing a new ability (the Coin query) to adversaries and redefining two key security notions, the framework fully exploits an adversary's capacity and can be used to prove all the commonly required security attributes of key agreement protocols with key confirmation. At the same time, the Coin query is also used to define a model which can be used to heuristically evaluate the security of a large category of authenticated protocols without key confirmation. We use the models to analyze a few identity-based authenticated key agreement protocols with pairings.
McCullagh and Barreto presented an identity-based authenticated key agreement protocol in CT-RSA 2005. Their protocol was found to be vulnerable to a key-compromise impersonation attack. In order to recover the weakness, McCullagh and Barreto, and Xie proposed two variants of the protocol respectively. In each of these works, a security proof of the proposed protocol was presented. In this paper, we revisit these three security proofs and show that all the reductions in these proofs are invalid, because the property of indistinguishability between their simulation and the real world was not held. As a replacement, we slightly modify the McCullagh and Barreto’s second protocol and then formally analyse the security of the modified scheme in the Bellare-Rogaway key agreement model.
Abstract. We study the provable security of identity-based (ID-based) key agreement protocols. Although several published protocols have been proven secure in the random oracle model, only a weak adversarial model is considered – the adversary is not allowed to ask Session-Key Reveal queries that will allow the adversary to learn previously established session keys. Recent research efforts devoted to providing a stronger level of security require strong assumptions, such as assuming that the simulator has access to a non-existential computational or decisional oracle. In this work, we propose an ID-based key agreement protocol and prove its security in the widely accepted indistinguishability-based model of Canetti and Krawczyk. In our proof, the simulator does not require access to any non-existential computational or decisional oracle. We then extend our basic protocol to support ad-hoc anonymous key agreement with bilateral privacy. To the best of our knowledge, this is the first protocol of its kind as previously published protocols are for fixed group and provide only unilateral privacy (i.e., only one of the protocol participants enjoy anonymity).
Key agreement and digital signature are two significant and most useful contributions of modern cryptography. Such protocols and schemes allow two or more parties to establish a common session key securely in the presence of a malicious adversary and provide means of ensuring data origin authentication, data integrity and non-repudiation. Thus, secure key agreement protocols and signature schemes are fundamental building blocks for constructing complex higher-level protocols. In this thesis, we deal with security analysis of existing key agreement protocols and digital signature schemes. We examine ten authenticated key agreement protocols without key confirmation, out of which half are two-party and the other half are three-party, and one deterministic identity-based aggregate signature scheme. By giving concrete attacks, we show that these protocols and the scheme do not possess the desirable security attributes or security attributes claimed by their authors. We also present a secure deterministic identity-based signature scheme that supports partial aggregation. First, we show that Okamoto's and Chen et al.’s protocol cannot withstand the key-compromise impersonation attack and that Tan et al.’s, Lim et al.’s and two protocols of Holbl et al. are insecure against the impersonation attack and the man-in-the-middle attack. Next, we prove that one protocol of Holbl et al. is vulnerable to the insider attack, one to the unknown key-share attack, one protocol allows an adversary to compute the private key of any user and one protocol allows her to compute the shared session key. We also show that Selvi et. al.'s deterministic identity-based aggregate signature scheme is universally forgeable, i.e., anyone is able to easily generate valid signatures on any messages of his choice having on average twelve genuine digital signatures. In the end, we introduce a new deterministic identity-based signature scheme and formally prove its security in the random oracle model. The scheme is a major improvement of the signature scheme proposed by Selvi et. al. and offers the same tight security reduction to the underlying gap Diffie-Hellman problem. Because the newly proposed scheme is deterministic it allows partial aggregation, i.e., all the signatures from the same signer can be aggregated into one single short signature.