Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

ACM Transactions on Information and System Security

An unknown key-share attack on the MQV key agreement protocol

Burton S. Kaliski

Published Aug 1, 2001• 148 citations
Publisher

Abstract

The MQV key agreement protocol, a technique included in recent standards, is shown in its basic form to be vulnerable to an unknown key-share attack. Although the attack's practical impact on security is minimal---a key confirmation step easily prevents it---the attack is noteworthy in the principles it illustrates about protocol design. First, minor “efficiency improvements” can significantly alter the security properties of a protocol. Second, protocol analysis must consider potential interactions with all parties, not just those that are normally online. Finally, attacks must be assessed in terms of system requirements, not just in isolation.

DOI
10.1145/501978.501981

Related papers

On robust key agreement based on public key authentication

F Hao

This paper discusses public-key authenticated key agreement protocols. First, we critically analyze several authenticatedkey agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks onthe HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one shouldtake when interpreting theoretical results from a formal model. We further point out that many of the protocol failures inthe past are caused by sidestepping an important engineering principle, namely “Do not assume that a message you receivehas a particular form (such as g^r for known r) unless you can check this”. Constructions in the past generally resistedthis principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive.In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocoldesign and meanwhile achieve good efficiency. Our new key agreement protocol, YAK, has comparable computationalefficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, ourprotocol appears to be the simplest so far. We believe simplicity is also an important engineering principle.

•Jan 1, 2014•0 citations

On robust key agreement based on public key authentication

Feng Hao

This paper discusses public key-authenticated key agreement protocols. First, we critically analyze several authenticated key agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks on the Hashed Menezes-Qu-Vanstone HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one should take when interpreting theoretical results from a formal model. We further point out that many of the protocol failures in the past are caused by sidestepping an important engineering principle, namely, Do not assume that a message you receive has a particular form such as gr for known r unless you can check this. Constructions in the past generally resisted this principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive. In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocol design and, meanwhile, achieve good efficiency. Our new key agreement protocol, YAK, has comparable computational efficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, our protocol appears to be the simplest so far. We believe simplicity is also an important engineering principle. Copyright © 2012 John Wiley & Sons, Ltd.

Security and Communication Networks•Apr 18, 2012•7 citations

Bilateral Unknown Key-Share Attacks in Key Agreement Protocols

Liqun Chen, Qiang Tang

Abstract: Unknown Key-Share (UKS) resilience is a basic security attribute in authenticated key agreement protocols. In this paper we revisit the definitions of this attribute and the method of proving this attribute under the Bellare-Rogaway (BR) model in the literature. We propose a new type of UKS attack, which coerces two entities A and B into sharing a key with each other but in fact A thinks that he is sharing the key with another entity C and B thinks that he is sharing the key with another entity D, whereCand D might or might not be the same entity. We call this attack a Bilateral Unknown Key-Share (BUKS) attack. We demonstrate that a few well-known authenticated key agreement protocols are vulnerable to this attack. We then explore a gap between the conventional BR-type proof and a BUKS adversary’s behavior, and extend the BR model to cover the BUKS resilience attribute. At the end of the paper, we provide a general countermeasure and its security proof under the extended model and the assumption that a collision-resistance function exists.

•Apr 7, 2020•8 citations

Obtaining a secure and efficient key agreement protocol from (H)MQV and NAXOS.

Berkant Ustaoğlu

LaMacchia, Lauter and Mityagin recently presented a strong security definition for authenticated key agreement strengthening the well-known Canetti-Krawczyk definition. They also described a protocol, called NAXOS, that enjoys a simple security proof in the new model. Compared to MQV and HMQV, NAXOS is less efficient and cannot be readily modified to obtain a one-pass protocol. On the other hand MQV does not have a security proof, and the HMQV security proof is extremely complicated. This paper proposes a new authenticated key agreement protocol, called CMQV (‘Combined’ MQV), which incorporates design principles from MQV, HMQV and NAXOS. The new protocol achieves the efficiency of HMQV and admits a natural one-pass variant. Moreover, we present a simple and intuitive proof that CMQV is secure in the LaMacchia-Lauter-Mityagin model.

•Jan 1, 2007•1 citation

An Attack on the Identity-Based Key Agreement Protocols in Multiple PKG Environment

JoongHyo Oh

Lee et al. recently proposed the first identity-based key agreement protocols for a multiple PKG environment where each PKG has different domain parameters in ICCSA 2005. However, this letter demonstrates that Lee et al.'s scheme does not include the property of implicit key authentication which is the fundamental security requirement, making it vulnerable to an impersonation attack.

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Mar 1, 2006•2 citations

Authenticated Key Agreement Protocols: A Comparative Study

Areej Omar Baalghusun, Olfa Abusalem, Zahra Abbas Al Abbas +1 more

One of the most important and challenging cryptographic primitives in Public Key Cryptography is Key Agreement Protocol where two or more parties share secret values and establish the session key. Many authors have proposed key agreement protocols. In this article, we have viewed some authenticated Key Agreement Protocols and presented a comparative study. We have also described the design principle, security requirement and various attacks on Key Agreement Protocol.

Journal of Information Security•Jan 1, 2015•3 citations
The MQV key agreement protocol, a technique included in recent standards, is shown in its basic form to be vulnerable to an unknown key-share attack. Although the attack's practical impact on security is minimal---a key confirmation step easily prevents it---the attack is noteworthy in the principles it illustrates about protocol design. First, minor “efficiency improvements” can significantly alter the security properties of a protocol. Second, protocol analysis must consider potential interactions with all parties, not just those that are normally online. Finally, attacks must be assessed in terms of system requirements, not just in isolation.
This paper discusses public-key authenticated key agreement protocols. First, we critically analyze several authenticatedkey agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks onthe HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one shouldtake when interpreting theoretical results from a formal model. We further point out that many of the protocol failures inthe past are caused by sidestepping an important engineering principle, namely “Do not assume that a message you receivehas a particular form (such as g^r for known r) unless you can check this”. Constructions in the past generally resistedthis principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive.In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocoldesign and meanwhile achieve good efficiency. Our new key agreement protocol, YAK, has comparable computationalefficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, ourprotocol appears to be the simplest so far. We believe simplicity is also an important engineering principle.
This paper discusses public key-authenticated key agreement protocols. First, we critically analyze several authenticated key agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks on the Hashed Menezes-Qu-Vanstone HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one should take when interpreting theoretical results from a formal model. We further point out that many of the protocol failures in the past are caused by sidestepping an important engineering principle, namely, Do not assume that a message you receive has a particular form such as gr for known r unless you can check this. Constructions in the past generally resisted this principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive. In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocol design and, meanwhile, achieve good efficiency. Our new key agreement protocol, YAK, has comparable computational efficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, our protocol appears to be the simplest so far. We believe simplicity is also an important engineering principle. Copyright © 2012 John Wiley & Sons, Ltd.
Abstract: Unknown Key-Share (UKS) resilience is a basic security attribute in authenticated key agreement protocols. In this paper we revisit the definitions of this attribute and the method of proving this attribute under the Bellare-Rogaway (BR) model in the literature. We propose a new type of UKS attack, which coerces two entities A and B into sharing a key with each other but in fact A thinks that he is sharing the key with another entity C and B thinks that he is sharing the key with another entity D, whereCand D might or might not be the same entity. We call this attack a Bilateral Unknown Key-Share (BUKS) attack. We demonstrate that a few well-known authenticated key agreement protocols are vulnerable to this attack. We then explore a gap between the conventional BR-type proof and a BUKS adversary’s behavior, and extend the BR model to cover the BUKS resilience attribute. At the end of the paper, we provide a general countermeasure and its security proof under the extended model and the assumption that a collision-resistance function exists.
LaMacchia, Lauter and Mityagin recently presented a strong security definition for authenticated key agreement strengthening the well-known Canetti-Krawczyk definition. They also described a protocol, called NAXOS, that enjoys a simple security proof in the new model. Compared to MQV and HMQV, NAXOS is less efficient and cannot be readily modified to obtain a one-pass protocol. On the other hand MQV does not have a security proof, and the HMQV security proof is extremely complicated. This paper proposes a new authenticated key agreement protocol, called CMQV (‘Combined’ MQV), which incorporates design principles from MQV, HMQV and NAXOS. The new protocol achieves the efficiency of HMQV and admits a natural one-pass variant. Moreover, we present a simple and intuitive proof that CMQV is secure in the LaMacchia-Lauter-Mityagin model.