Modelling and Security Analysis of Authenticated Group Key Agreement Protocols

Olivier Pereira

Published Jan 1, 2003• 19 citations

Abstract

Authenticated Group Key Agreement Protocols are protocols allowing\na group of principals to contributively generate a key by the\nexchange of messages on a network possibly controlled by an\nattacker. Furthermore, their execution also guarantees all group\nmembers that the key they obtained can only be known by the other\nintended protocol participants. These protocols can be exploited\nin many applications such as audio or videoconferencing,\nreplicated servers (such as database, web, time servers), chat or\nnetwork games for instance. \n AGKAP's present several particularities that make them interesting\ncase studies for research in the theory of security. At first, the\nconsideration of the number of protocol participants as a\nparameter raises several complexity problems that are not present\nin the classical two or three-party frameworks. Furthermore, up to\nnow, the security properties of group protocols have roughly been\nconsidered as direct extensions of two-party properties, what does\nnot capture several plausible attack scenarios. A second\ninteresting aspect of the analysis of AGKAP's is the consideration\nof Diffie-Hellman-type primitives, that present properties out\nof the scope of most classical models. \n We started our study with the construction of a simple model for\nthe analysis of a classical family of protocols: the Cliques\nAGKAP's. This allowed us to discover several attacks and define\ndifferent flavors of group security properties. We then tried to\nfix these protocols, what led us to extend our model in order to\nprove that it is in fact impossible to build a secure AGKAP based\non the same design assumptions as the Cliques protocols. Finally,\nwe designed a new AGKAP based on different cryptographic\nprimitives (signature and hash functions) for which we proved\nauthentication, freshness and secrecy properties. A comparison\nwith a similar AGKAP developed in parallel to ours is also\nproposed.

Related papers

On the impossibility of building secure Cliques-type authenticated group key agreement protocols

Olivier Pereira, Jean-Jacques Quisquater

The A-GDH.2 and SA-GDH.2 authenticated group key agreement protocols showed to be flawed in 2001. Even though the corresponding attacks (or some variants of them) have been rediscovered in several different frameworks, no fixed version of these protocols has been proposed until now. In this paper, we prove that it is in fact impossible to design a scalable authenticated group key agreement protocol based on the same design assumptions as the A-GDH ones. We proceed by providing a systematic way to derive an attack against any A-GDH-type protocol with at least four participants and exhibit protocols with two and three participants which we cannot break using our technique. As far as we know, this is the first generic insecurity result reported in the literature concerning authentication protocols.

Journal of Computer SecurityApr 20, 200612 citations

New authenticated key agreement protocols

Hassan M. A. Elkamchouchi, Yasmine A. Saleh, Aliaa M. Sary

Key agreement protocols are used to establish common keys between two or more entities. The established key can then be used to assure confidentiality of exchanged messages through encryption. Additionally, authenticated key agreement protocols offer implicit authentication. In this paper, new authenticated key agreement protocols are proposed and their security properties are investigated. We start by examining the two-party case and then develop extensions to three parties as well as extensions to any group of k parties. The proposed protocols try to keep exchanged messages and computations minimal, while offering adequate security guarantees. Finally, we develop a variant of our multi-party key agreement protocol tailored for secure group communications among mobile devices.

International Conference on Computer Engineering & Systems (ICCES)Nov 1, 201112 citations

Efficient Authenticated ID-Based Group Key Agreement Protocol

M Arifi, Mahmoud Gardeshi

Group key exchange protocols play main role in group applications such as computer networks, telecommunication and military systems. Given the wide range of usage of group applications, research and design of these protocols can play an important role in securing international exchanges, trade and military issues. Most existing group key exchange protocols establish multi-party or group key exchange protocols based on extending the two party well known Diffie- Hellman key exchanges. The security of these protocols is based on this assumption that difficulty of solving group Dif- fie-Hellman problem can be reduced to the difficulty of two party Diffie-Hellman problems. In spite of this assumption, Group key exchanges are not simply extension of two party protocols. In fact there are many differences and challenges that must be considered in design and implementation of these protocols. This difference is due to essential difference between peer to peer communication and group communication. In group communication in addition to considering the main goal e.g. obtaining group session key, consideration of group member changing is important too. In this paper, a Dynamic ID-based Group Key Agreement protocol based on Weil pairing is proposed. This complete ternary tree struc- ture is used and dynamic changes in group are considered too. Finally we show that the proposed protocol is more effi- cient than other protocols with similar structure and also satisfies all known security requirements .

Jan 1, 20111 citation

Security analysis of authenticated key agreement protocols and digital signature schemes

Peter Nose

Key agreement and digital signature are two significant and most useful contributions of modern cryptography. Such protocols and schemes allow two or more parties to establish a common session key securely in the presence of a malicious adversary and provide means of ensuring data origin authentication, data integrity and non-repudiation. Thus, secure key agreement protocols and signature schemes are fundamental building blocks for constructing complex higher-level protocols. In this thesis, we deal with security analysis of existing key agreement protocols and digital signature schemes. We examine ten authenticated key agreement protocols without key confirmation, out of which half are two-party and the other half are three-party, and one deterministic identity-based aggregate signature scheme. By giving concrete attacks, we show that these protocols and the scheme do not possess the desirable security attributes or security attributes claimed by their authors. We also present a secure deterministic identity-based signature scheme that supports partial aggregation. First, we show that Okamoto's and Chen et al.’s protocol cannot withstand the key-compromise impersonation attack and that Tan et al.’s, Lim et al.’s and two protocols of Holbl et al. are insecure against the impersonation attack and the man-in-the-middle attack. Next, we prove that one protocol of Holbl et al. is vulnerable to the insider attack, one to the unknown key-share attack, one protocol allows an adversary to compute the private key of any user and one protocol allows her to compute the shared session key. We also show that Selvi et. al.'s deterministic identity-based aggregate signature scheme is universally forgeable, i.e., anyone is able to easily generate valid signatures on any messages of his choice having on average twelve genuine digital signatures. In the end, we introduce a new deterministic identity-based signature scheme and formally prove its security in the random oracle model. The scheme is a major improvement of the signature scheme proposed by Selvi et. al. and offers the same tight security reduction to the underlying gap Diffie-Hellman problem. Because the newly proposed scheme is deterministic it allows partial aggregation, i.e., all the signatures from the same signer can be aggregated into one single short signature.

Mar 17, 20140 citations

Provably secure authenticated group Diffie-Hellman key exchange

Emmanuel Bresson, Olivier Chevassut, David Pointcheval

Authenticated key-exchange protocols allow two participants A and B , communicating over a public network and each holding an authentication means to exchange a shared secret value. Methods designed to deal with this cryptographic problem ensure A (resp. B ) that no other participants aside from B (resp. A ) can learn any information about the agreed value and often also ensure A and B that their respective partner has actually computed this value. A natural extension to this cryptographic method is to consider a pool of participants exchanging a shared secret value and to provide a formal treatment for it. Starting from the famous two-party Diffie--Hellman (DH) key-exchange protocol and from its authenticated variants, security experts have extended it to the multiparty setting for over a decade and, in the past few years, completed a formal analysis in the framework of modern cryptography. The present paper synthesizes this body of work on the provably-secure authenticated group DH key exchange.

ACM Transactions on Information and System SecurityJul 1, 200788 citations

Group Secret Handshakes or Affiliation-Hiding Authenticated Group Key Agreement

Stanisław Jarecki, Jihye Kim, Gene Tsudik

Abstract. Privacy concerns in many aspects of electronic communication trigger the need to re-examine – with privacy in mind – familiar security services, such as authentication and key agreement. An Affiliation-Hiding Group Key Agreement (AH-AGKA) protocol (also known as Group Secret Handshake) allows a set of participants, each with a certificate issued by the same authority, to establish a common authenticated secret key. In contrast to standard AGKA protocols, an AH-AGKA protocol has the following privacy feature: If Alice, who is a member of a group G, participates in an AH-AGKA protocol, none of the other protocol participants learn whether Alice is a member of G, unless these participants are themselves members of group G. Such protocols are useful in suspicious settings where a set of members of a (perhaps secret) group need to authenticate each other and agree on a common secret key, without revealing their affiliations to outsiders. In this paper we strengthen the prior definition of AH-AGKA so that the security and privacy properties are maintained under any composition of protocol instances. We also construct two novel AH-AGKA protocols secure in this new and stronger model under the RSA and Gap Diffie-Hellman assumptions, respectively. Each protocol involves only two communication rounds and few exponentiations per player (e.g., no bilinear map operations). Interestingly, these costs are essentially the same as those of the underlying (unauthenticated) group key agreement protocol. Finally, our protocols, unlike prior results, retain their security and privacy properties without the use of one-time certificates.

Jan 1, 20070 citations