IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences

Modeling Leakage of Ephemeral Secrets in Tripartite/Group Key Exchange

Mark Manulis, Koutarou Suzuki, Berkant Ustaoğlu

Published Dec 31, 2012• 6 citations

Abstract

We propose a security model, referred as g-eCK model, for group key exchange that captures essentially all non-trivial leakage of static and ephemeral secret keys of participants, i.e., group key exchange version of extended Canetti-Krawczyk (eCK) model. Moreover, we propose the first one-round tripartite key exchange (3KE) protocol secure in the g-eCK model under the gap Bilinear Diffie-Hellman (gap BDH) assumption and in the random oracle model.

DOI: 10.1587/transfun.e96.a.101

Related papers

Strongly Secure One-round Group Authenticated Key Exchange in the Standard Model.

Yong Li, Zheng Yang

One-round group authenticated key exchange (GAKE) protocols typically provide implicit authentication and appealing bandwidth efficiency. As a special case of GAKE – the pairing-based one-round tripartite authenticated key exchange (3AKE), recently gains much attention of research community due to its strong security. Several pairing-based one-round 3AKE protocols have recently been proposed to achieve provable security in the g-eCK model. In contrast to earlier GAKE models, the g-eCK model particularly formulates the security properties regarding resilience to the leakage of various combinations of long-term key and ephemeral session state, and provision of weak perfect forward secrecy in a single model. However, the g-eCK security proofs of previous protocols are only given under the random oracle model. In this work, we give a new construction for pairing-based one-round 3AKE protocol which is provably secure in the g-eCK model without random oracles. Security of proposed protocol is reduced to the hardness of Cube Bilinear Decisional Diffie-Hellman (CBDDH) problem for symmetric pairing. We also extend the proposed 3AKE scheme to a GAKE scheme with more than three group members, based on multilinear maps. We prove g-eCK security of our GAKE scheme in the standard model under the natural multilinear generalization of the CBDDH assumption.

Jan 1, 20130 citations

Strongly Secure Identity-based Authenticated Key Exchange Protocol

Jian Shu

Recently,LaMacchia et al.proposed the extended Canetti-Krawczyk(eCK) model,which captures all security properties of authenticated key enchange protocols.Most of existing identity-based authenticated key exchange protocols are not secure in the eCK model.This paper proposes an identity-based authenticated key exchange protocol,and the security of proposed protocol can be proved in the eCK model.When compaer with other schemes,the proposed protocol achieves efficiency in terms of computation and communication.The proposal achieve strong security,and can be proved under the random oracle assumption and the Gap Bilinear Diffie-Hellman assumption.

Journal of Chinese Computer SystemsJan 1, 20110 citations

Modeling Leakage of Ephemeral Secrets in Tripartite/Group Key Exchange (Full Version)

Mark Manulis, Koutarou Suzuki, Berkant Ustaoğlu

Recent advances in the design and analysis of secure two-party key exchange (2KE) such as the leakage of ephemeral secrets used during the attacked sessions remained unnoticed by the current models for group key exchange (GKE). Focusing on a special case of GKE | the tripartite key exchange (3KE) | that allows for ecient one-round protocols, we demonstrate how to incorporate these advances to the multi-party setting. From this perspective our work closes the most pronounced gap between provably secure 2KE and GKE protocols. The proposed 3KE protocol is an implicitly authenticated protocol with one communication round which remains secure even in the event of ephemeral secret leakage. It also signicantly improves upon currently known 3KE protocols, many of which are insecure. An optional key conrmation round can be added to our proposal to achieve the explicitly authenticated protocol variant.

Jan 1, 20090 citations

A New Efficient and Strongly Secure Authenticated Key Exchange Protocol

Qingfeng Cheng, Guangguo Han, Chuangui Ma

In 2007, LaMacchia et al.proposed the extended Canetti-Krawczyk (eCK) model for authenticated key exchange (AKE) protocols. In this paper, we first modify the eCK model by adding a new query to make the adversary can reveal all ephemeral secret information. Then we propose a new efficient and strongly secure AKE protocol in the asymmetric setting, called E-NETS (enhanced NETS) protocol, and prove its security in the modified eCK (meCK) model under the random oracle assumption and the gap Diffie-Hellman assumption.

International Conference on Information Assurance and Security (IAS)Jan 1, 20097 citations

Beyond eCK: Perfect Forward Secrecy Under Actor Compromise and Ephemeral-key Reveal

Cas J. F. Cremers, Michèle Feltz

Abstract. We show that it is possible to achieve perfect forward secrecy in two-message or one-round key exchange (KE) protocols even in the presence of very strong active adversaries that can reveal random values of sessions and compromise long-term secret keys of parties. We provide two new game-based security models for KE protocols with increasing security guarantees, namely, eCKw and eCK-PFS. The eCKw model is a slightly stronger variant of the extended Canetti-Krawczyk (eCK) security model. The eCK-PFS model captures perfect forward secrecy in the presence of eCKw adversaries. We propose a security-strengthening transformation (i. e., a compiler) from eCKw to eCK-PFS that can be applied to protocols that only achieve security in a weaker model than eCKw, which we call eCKpassive. We show that, given a two-message Diffie-Hellman type protocol secure in eCKpassive, our transformation yields a two-message protocol that is secure in eCK-PFS. We demonstrate how our transformation can be applied to concrete KE protocols. In particular, our methodology allows us to prove the security of the first known one-round protocol that achieves perfect forward secrecy under actor compromise and ephemeral-key reveal. 1

Jan 1, 20150 citations

Efficient eCK-secure Authenticated Key Exchange Protocols in the Standard Model.

Zheng Yang

The extended Canetti–Krawczyk (eCK) security models, are widely used to provide security arguments for authenticated key exchange protocols that capture leakage of various kinds of secret information like the long-term private key and session-specific secret state. In this paper, we study the open problem on constructing eCK secure AKE protocol without random oracles and NAXOS like trick. A generic construction GC-KKN satisfying those requirements is first given relying on standard cryptographic primitives following the guideline of efficiency. On the second a concrete protocol is proposed which is the first eCK secure protocol in the standard model under both standard assumptions and post-specified peer setting. Both proposed schemes can be more efficiently implemented with secure device than previous eCK secure protocols in the standard model, where the secure device might be normally used to store the long-term private key and implement algorithms of protocol which require to be resilience of state leakage.

Jan 1, 20130 citations