Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IEEE Transactions on Parallel and Distributed Systems

Flexible Robust Group Key Agreement

Stanisław Jarecki, Jihye Kim, Gene Tsudik

Published Jul 1, 2010• 40 citations
Publisher

Abstract

A robust group key agreement protocol (GKA) allows a set of players to establish a shared secret key, regardless of network/node failures. Current constant-round GKA protocols are either efficient and nonrobust or robust but not efficient; assuming a reliable broadcast communication medium, the standard encryption-based group key agreement protocol can be robust against arbitrary number of node faults, but the size of the messages broadcast by every player is proportional to the number of players. In contrast, nonrobust group key agreement can be achieved with each player broadcasting just constant-sized messages. We propose a novel 2-round group key agreement protocol, which tolerates up to T node failures, using O(T)-sized messages for any T. We show that the new protocol implies a fully-robust group key agreement with logarithmic-sized messages and expected round complexity close to 2, assuming random node faults. The protocol can be extended to withstand malicious insiders at small constant factor increases in bandwidth and computation. The proposed protocol is secure under the (standard) Decisional Square Diffie-Hellman assumption.

DOI
10.1109/tpds.2010.128

Related papers

Robust privacy-preserving group key agreement protocols

Gene Tsudik, Stanisław Jarecki, Jihye Kim

The last decade has witnessed a sharp spike in the popularity of group applications, such as multi-media conferencing, collaborative workspaces, as well as dynamic coalitions common in law enforcement and disaster rescue scenarios. Standard security services required in such group settings (such as confidentiality, integrity and authentication) can be efficiently achieved if all group members share a secret key. A group key agreement protocol (GKA) provide a technique for any set of participating players to collaboratively establish a shared key. In this thesis, we tackle two challenging issues in GKA: robustness and privacy-preserving authentication. Robustness improves performance by guaranteeing completion of GKA protocols despite participating player or communication failures. Affiliation-hiding authenticated GKA prevents from man-in-the-middle-attacks by authenticating players in a privacy-preserving manner. We propose a two-round group key agreement protocol, which offers a natural trade-off between message size and the desired level of fault-tolerance. We demonstrate that in a realistic setting of random player faults, the new protocol has logarithmic-sized messages and expected round complexity close to two. We generalize a robust group key agreement protocol to support heterogeneous players for a general environment. We prove the security of the proposed protocols under the standard cryptographic assumptions. We present the formal definition of the affiliation-hiding GKA in a standard PKI model with re-usable certificates. The model includes strong security properties, called perfect forward secrecy (PFS) and linkable affiliation-hiding (LAH)—that an key agreement protocol might provide in the face of player corruptions and session compromises. We construct two variants of optimal-cost AH-AGKA protocols, which satisfy PFS and LAH notions under the standard cryptographic assumptions in the random oracle model. The protocol yields minimal costs: three rounds of interaction matches the round complexity of non-private PFS authenticated GKA and its computation costs are comparable to the cost of unauthenticated GKA.

•Jan 1, 2008•0 citations

A Provable Secure Group Key Agreement Protocol with Fault-Tolerant

Lansheng Han

This paper indicates that Burmester et al.'s group key agreement protocol which based on the authenticated broadcast channel is unable to withstand the disruption attack and key-control attack of malicious participants in group.These two attacks lead that other honest participants will compute different session key and other honest participants compute the fixed session key which is determined previously by malicious participants,respectively.In this paper,a fault-tolerant group key agreement(FT-GKA) protocol is proposed.Even if there are malicious participants trying to attack the establishment of a session key,all other honest participants following the proposed protocol are still able to compute the correct session key using the digital signature technology.Paper proves the protocol can withstand the passive attack of adversary under the DDH assumption,and the protocol can withstand the interrupted attack and key-control attack from malicious participants under the DL assumption and the random oracle model.Furthermore,the proposed protocol possesses both constant number of rounds and lower computation overhead.

Dianzi xuebao•Jan 1, 2009•0 citations

DDH-based Group Key Agreement in a Mobile Environment.

Junghyun Nam, Jinwoo Lee, Seungjoo Kim +1 more

A group key agreement protocol is designed to efficiently implement secure multicast channels for a group of parties communicating over an untrusted, open network by allowing them to agree on a common secret key. In the past decade many problems related to group key agreement have been tackled and solved (diminished if not solved), and recently some constant-round protocols have been proven secure in concrete, realistic setting. However, all forward-secure protocols so far are still too expensive for small mobile devices. In this paper we propose a new constant-round protocol well suited for a mobile environment and prove its security under the Decisional Diffie-Hellman assumption. The protocol meets simplicity, efficiency, and all the desired security properties.

•Jan 1, 2004•0 citations

Round-Efficient and Sender-Unrestricted Dynamic Group Key Agreement Protocol for Secure Group Communications

Lei Zhang, Qianhong Wu, Josep Domingo‐Ferrer +2 more

Modern collaborative and group-oriented applications typically involve communications over open networks. Given the openness of today's networks, communications among group members must be secure and, at the same time, efficient. Group key agreement (GKA) is widely employed for secure group communications in modern collaborative and group-oriented applications. This paper studies the problem of GKA in identity-based cryptosystems with an emphasis on round-efficient, sender-unrestricted, member-dynamic, and provably secure key escrow freeness. The problem is resolved by proposing a one-round dynamic asymmetric GKA protocol which allows a group of members to dynamically establish a public group encryption key, while each member has a different secret decryption key in an identity-based cryptosystem. Knowing the group encryption key, any entity can encrypt to the group members so that only the members can decrypt. We construct this protocol with a strongly unforgeable stateful identity-based batch multisignature scheme. The proposed protocol is shown to be secure under the k -bilinear Diffie-Hellman exponent assumption.

IEEE Transactions on Information Forensics and Security•Jun 19, 2015•69 citations

Constant Round Group Key Exchange with Logarithmic Computational Complexity.

Junghyun Nam, Youngsook Lee, Dongho Won

Protocols for group key exchange (GKE) are cryptographic algorithms that describe how a group of parties communicating over a public network can come up with a common secret key. Due to their critical role in building secure multicast channels, a number of GKE protocols have been proposed over the years in a variety of settings. However despite many impressive achievements, it still remains a challenging problem to design a secure GKE protocol which scales very well for large groups. Our observation is that all provably-secure constant-round GKE protocols providing forward secrecy thus far are not fully scalable, but have a computational complexity that scales only linearly in group size. Motivated by this observation, we propose a new GKE protocol that not only offers full scalability in all directions but also attains provable security against active adversaries. Full scalability is achieved by using a complete binary tree structure where users are arranged on both internal and leaf nodes. Security is proved via reduction to the decisional Diffie-Hellman assumption in a well-defined formal model of communication and adversarial capabilities.

•Jan 1, 2006•1 citation

A Survey of Group Key Agreement Protocols with Constant Rounds

Hu Xiong, Yan Xuan Wu, Zhenyu Lu

Group key agreement (shorten as GKA) protocol enables a group of users to negotiate a one-time session key and protect the thereafter group-oriented communication with this session key across an unreliable network. The number of communication rounds is one of the main concern for practical applications where the cardinality of group participants involved is considerable. It is critical to have fixed constant rounds in GKA protocols to secure these applications. In light of overwhelming variety and multitude of constant-round GKA protocols, this article surveys these protocols from a series of perspectives to supply better comprehension for researchers and scholars. Concretely, this article captures the state of the art of constant-round GKA protocols by analyzing the design rationale, examining the framework and security model, and evaluating all discussed protocols in terms of efficiency and security properties. In addition, this article discusses the extension of constant-round GKA protocols including dynamic membership updating, password-based, affiliation-hiding, and fault-tolerance. In conclusion, this article also points out a number of interesting future directions.

ACM Computing Surveys•Jun 18, 2019•31 citations
A robust group key agreement protocol (GKA) allows a set of players to establish a shared secret key, regardless of network/node failures. Current constant-round GKA protocols are either efficient and nonrobust or robust but not efficient; assuming a reliable broadcast communication medium, the standard encryption-based group key agreement protocol can be robust against arbitrary number of node faults, but the size of the messages broadcast by every player is proportional to the number of players. In contrast, nonrobust group key agreement can be achieved with each player broadcasting just constant-sized messages. We propose a novel 2-round group key agreement protocol, which tolerates up to T node failures, using O(T)-sized messages for any T. We show that the new protocol implies a fully-robust group key agreement with logarithmic-sized messages and expected round complexity close to 2, assuming random node faults. The protocol can be extended to withstand malicious insiders at small constant factor increases in bandwidth and computation. The proposed protocol is secure under the (standard) Decisional Square Diffie-Hellman assumption.
The last decade has witnessed a sharp spike in the popularity of group applications, such as multi-media conferencing, collaborative workspaces, as well as dynamic coalitions common in law enforcement and disaster rescue scenarios. Standard security services required in such group settings (such as confidentiality, integrity and authentication) can be efficiently achieved if all group members share a secret key. A group key agreement protocol (GKA) provide a technique for any set of participating players to collaboratively establish a shared key. In this thesis, we tackle two challenging issues in GKA: robustness and privacy-preserving authentication. Robustness improves performance by guaranteeing completion of GKA protocols despite participating player or communication failures. Affiliation-hiding authenticated GKA prevents from man-in-the-middle-attacks by authenticating players in a privacy-preserving manner. We propose a two-round group key agreement protocol, which offers a natural trade-off between message size and the desired level of fault-tolerance. We demonstrate that in a realistic setting of random player faults, the new protocol has logarithmic-sized messages and expected round complexity close to two. We generalize a robust group key agreement protocol to support heterogeneous players for a general environment. We prove the security of the proposed protocols under the standard cryptographic assumptions. We present the formal definition of the affiliation-hiding GKA in a standard PKI model with re-usable certificates. The model includes strong security properties, called perfect forward secrecy (PFS) and linkable affiliation-hiding (LAH)—that an key agreement protocol might provide in the face of player corruptions and session compromises. We construct two variants of optimal-cost AH-AGKA protocols, which satisfy PFS and LAH notions under the standard cryptographic assumptions in the random oracle model. The protocol yields minimal costs: three rounds of interaction matches the round complexity of non-private PFS authenticated GKA and its computation costs are comparable to the cost of unauthenticated GKA.
This paper indicates that Burmester et al.'s group key agreement protocol which based on the authenticated broadcast channel is unable to withstand the disruption attack and key-control attack of malicious participants in group.These two attacks lead that other honest participants will compute different session key and other honest participants compute the fixed session key which is determined previously by malicious participants,respectively.In this paper,a fault-tolerant group key agreement(FT-GKA) protocol is proposed.Even if there are malicious participants trying to attack the establishment of a session key,all other honest participants following the proposed protocol are still able to compute the correct session key using the digital signature technology.Paper proves the protocol can withstand the passive attack of adversary under the DDH assumption,and the protocol can withstand the interrupted attack and key-control attack from malicious participants under the DL assumption and the random oracle model.Furthermore,the proposed protocol possesses both constant number of rounds and lower computation overhead.
A group key agreement protocol is designed to efficiently implement secure multicast channels for a group of parties communicating over an untrusted, open network by allowing them to agree on a common secret key. In the past decade many problems related to group key agreement have been tackled and solved (diminished if not solved), and recently some constant-round protocols have been proven secure in concrete, realistic setting. However, all forward-secure protocols so far are still too expensive for small mobile devices. In this paper we propose a new constant-round protocol well suited for a mobile environment and prove its security under the Decisional Diffie-Hellman assumption. The protocol meets simplicity, efficiency, and all the desired security properties.
Modern collaborative and group-oriented applications typically involve communications over open networks. Given the openness of today's networks, communications among group members must be secure and, at the same time, efficient. Group key agreement (GKA) is widely employed for secure group communications in modern collaborative and group-oriented applications. This paper studies the problem of GKA in identity-based cryptosystems with an emphasis on round-efficient, sender-unrestricted, member-dynamic, and provably secure key escrow freeness. The problem is resolved by proposing a one-round dynamic asymmetric GKA protocol which allows a group of members to dynamically establish a public group encryption key, while each member has a different secret decryption key in an identity-based cryptosystem. Knowing the group encryption key, any entity can encrypt to the group members so that only the members can decrypt. We construct this protocol with a strongly unforgeable stateful identity-based batch multisignature scheme. The proposed protocol is shown to be secure under the k -bilinear Diffie-Hellman exponent assumption.
Protocols for group key exchange (GKE) are cryptographic algorithms that describe how a group of parties communicating over a public network can come up with a common secret key. Due to their critical role in building secure multicast channels, a number of GKE protocols have been proposed over the years in a variety of settings. However despite many impressive achievements, it still remains a challenging problem to design a secure GKE protocol which scales very well for large groups. Our observation is that all provably-secure constant-round GKE protocols providing forward secrecy thus far are not fully scalable, but have a computational complexity that scales only linearly in group size. Motivated by this observation, we propose a new GKE protocol that not only offers full scalability in all directions but also attains provable security against active adversaries. Full scalability is achieved by using a complete binary tree structure where users are arranged on both internal and leaf nodes. Security is proved via reduction to the decisional Diffie-Hellman assumption in a well-defined formal model of communication and adversarial capabilities.
Group key agreement (shorten as GKA) protocol enables a group of users to negotiate a one-time session key and protect the thereafter group-oriented communication with this session key across an unreliable network. The number of communication rounds is one of the main concern for practical applications where the cardinality of group participants involved is considerable. It is critical to have fixed constant rounds in GKA protocols to secure these applications. In light of overwhelming variety and multitude of constant-round GKA protocols, this article surveys these protocols from a series of perspectives to supply better comprehension for researchers and scholars. Concretely, this article captures the state of the art of constant-round GKA protocols by analyzing the design rationale, examining the framework and security model, and evaluating all discussed protocols in terms of efficiency and security properties. In addition, this article discusses the extension of constant-round GKA protocols including dynamic membership updating, password-based, affiliation-hiding, and fault-tolerance. In conclusion, this article also points out a number of interesting future directions.