We present TOPAS (Transmission Optimal Protocol with Active Security), the first key agreement protocol with optimal communication complexity that provides security against fully active adversaries. This solves a longstanding open problem. The size of the protocol messages (approx. 160 bits for 80-bit security) and the computational costs to generate them are comparable to the basic Diffie-Hellman protocol over elliptic curves (which is well-known to only provide security against passive adversaries). Session keys are indistinguishable from random keys - even under reflection and key compromise impersonation attacks - under generalizations of TOPAS stand out is that it also features a security proof of full perfect forward secrecy (PFS), where the attacker can actively modify messages sent to or from the test-session. The proof of full PFS relies on two new extraction-based security assumptions. It is well-known that existing implicitly-authenticated 2-message protocols like HMQV cannot achieve this strong form of (full) security against active attackers (Krawczyk, Crypto'05). We also present a variant of our protocol, TOPAS+, which, under the Strong Diffie-Hellman assumption, provides better computational efficiency in the key derivation phase.
We present TOPAS (Transmission Optimal Protocol with Active Security), the first key agreement protocol with optimal communication complexity that provides security against fully active adversaries. This solves a longstanding open problem. The size of the protocol messages (approx. 160 bits for 80-bit security) and the computational costs to generate them are comparable to the basic Diffie-Hellman protocol over elliptic curves (which is well-known to only provide security against passive adversaries). Session keys are indistinguishable from random keys - even under reflection and key compromise impersonation attacks - under generalizations of TOPAS stand out is that it also features a security proof of full perfect forward secrecy (PFS), where the attacker can actively modify messages sent to or from the test-session. The proof of full PFS relies on two new extraction-based security assumptions. It is well-known that existing implicitly-authenticated 2-message protocols like HMQV cannot achieve this strong form of (full) security against active attackers (Krawczyk, Crypto'05). We also present a variant of our protocol, TOPAS+, which, under the Strong Diffie-Hellman assumption, provides better computational efficiency in the key derivation phase.
TOPAS2-pass key exchange with full perfect forward secrecy and optimal communication complexity
Abstract We present Transmission optimal protocol with active security ( TOPAS TOPAS ), the first key agreement protocol with optimal communication complexity (message size and number of rounds) that provides security against fully active adversaries. The size of the protocol messages and the computational costs to generate them are comparable to the basic Diffie-Hellman protocol over elliptic curves (which is well-known to only provide security against passive adversaries). Session keys are indistinguishable from random keys—even under reflection and key compromise impersonation attacks. What makes TOPAS TOPAS stand out is that it also features a security proof of full perfect forward secrecy (PFS), where the attacker can actively modify messages sent to or from the test-session. The proof of full PFS relies on two new extraction-based security assumptions. It is well-known that existing implicitly-authenticated 2-message protocols like HMQV HMQV cannot achieve this strong form of (full) security against active attackers (Krawczyk, Crypto’05). This makes TOPAS TOPAS the first key agreement protocol with full security against active attackers that works in prime-order groups while having optimal message size. We also present a variant of our protocol, TOPAS+ TOPAS + , which, under the Strong Diffie-Hellman assumption, provides better computational efficiency in the key derivation phase. Finally, we present a third protocol termed FACTAS FACTAS (for factoring-based protocol with active security) which has the same strong security properties as TOPAS TOPAS and TOPAS+ TOPAS + but whose security is solely based on the factoring assumption in groups of composite order (except for the proof of full PFS).
Abstract. There are several essential features in key agreement protocols such as key escrow (essential when confidentiality, audit trail and legal interception are required) and perfect forward secrecy (i.e., the security of a session key established between two or more entities is guaranteed even when the private keys of the entities are compromised). Majority of the existing escrowable identity-based key agreement protocols, however, only provide partial forward secrecy. Therefore, such protocols are unsuitable for real-word applications that require a stronger sense of forward secrecy — perfect forward secrecy. In this paper, we propose an efficient perfect forward secure identity-based key agreement protocol in the escrow mode. We prove the security of our protocol in the random oracle model, assuming the intractability of the Gap Bilinear Diffie-Hellman (GBDH) problem. Security proofs are invaluable tools in assuring protocol implementers about the security properties of protocols. We note, however, that many existing security proofs of previously published identity-based protocols entail lengthy and complicated mathematical proofs. In this paper, our proof adopts a modular approach and, hence, simpler to follow.
The last decade has witnessed a sharp spike in the popularity of group applications, such as multi-media conferencing, collaborative workspaces, as well as dynamic coalitions common in law enforcement and disaster rescue scenarios. Standard security services required in such group settings (such as confidentiality, integrity and authentication) can be efficiently achieved if all group members share a secret key. A group key agreement protocol (GKA) provide a technique for any set of participating players to collaboratively establish a shared key.
In this thesis, we tackle two challenging issues in GKA: robustness and privacy-preserving authentication. Robustness improves performance by guaranteeing completion of GKA protocols despite participating player or communication failures. Affiliation-hiding authenticated GKA prevents from man-in-the-middle-attacks by authenticating players in a privacy-preserving manner.
We propose a two-round group key agreement protocol, which offers a natural trade-off between message size and the desired level of fault-tolerance. We demonstrate that in a realistic setting of random player faults, the new protocol has logarithmic-sized messages and expected round complexity close to two. We generalize a robust group key agreement protocol to support heterogeneous players for a general environment. We prove the security of the proposed protocols under the standard cryptographic assumptions.
We present the formal definition of the affiliation-hiding GKA in a standard PKI model with re-usable certificates. The model includes strong security properties, called perfect forward secrecy (PFS) and linkable affiliation-hiding (LAH)—that an key agreement protocol might provide in the face of player corruptions and session compromises. We construct two variants of optimal-cost AH-AGKA protocols, which satisfy PFS and LAH notions under the standard cryptographic assumptions in the random oracle model. The protocol yields minimal costs: three rounds of interaction matches the round complexity of non-private PFS authenticated GKA and its computation costs are comparable to the cost of unauthenticated GKA.
Abstract. We show that it is possible to achieve perfect forward secrecy in two-message or one-round key exchange (KE) protocols even in the presence of very strong active adversaries that can reveal random values of sessions and compromise long-term secret keys of parties. We provide two new game-based security models for KE protocols with increasing security guarantees, namely, eCKw and eCK-PFS. The eCKw model is a slightly stronger variant of the extended Canetti-Krawczyk (eCK) security model. The eCK-PFS model captures perfect forward secrecy in the presence of eCKw adversaries. We propose a security-strengthening transformation (i. e., a compiler) from eCKw to eCK-PFS that can be applied to protocols that only achieve security in a weaker model than eCKw, which we call eCKpassive. We show that, given a two-message Diffie-Hellman type protocol secure in eCKpassive, our transformation yields a two-message protocol that is secure in eCK-PFS. We demonstrate how our transformation can be applied to concrete KE protocols. In particular, our methodology allows us to prove the security of the first known one-round protocol that achieves perfect forward secrecy under actor compromise and ephemeral-key reveal. 1
We present Protoss, a new balanced PAKE protocol with optimal communication efficiency. Messages are only 160 bits long and the computational complexity is lower than all previous approaches. Our protocol is proven secure in the random oracle model and features a security proof in a strong security model with multiple parties and multiple sessions while allowing for generous attack queries including multiple Test-queries. Moreover, the proof is in the practically relevant single-bit model (that is harder to achieve than the multiple-bit model) and tightly reduces to the Strong Square Diffie-Hellman assumption (SSQRDH). This allows for very efficient, theoretically-sound instantiations and tight compositions with symmetric primitives.
Two-Party Authenticated key agreement protocol is essential for setting up the common session key for parties to establish secure channel for network communication in the open environment. Most of proposed schemes require expensive bilinear pairing operation and only provide limited security attributes. So such protocols are unsuitable for real-world applications that require stronger sense of secrecy. In this paper, we first analysis two schemes recently proposed by Cao etc., and then present a one-round ID-based authenticated key agreement protocol with more desired security attributes, which need no pairing operations while still achieve nice computational efficiency. These security attributes include known-key secrecy, perfect forward secrecy, PKG forward secrecy, key-compromise impersonation resilience, unknown key-share resilience and no key control. Moreover, it captures the enhanced security attributes known session-specific temporary key information secrecy, which means that even the ephemeral secret key were compromised, the adversary can hardly acquire the agreed session key.