In certificateless cryptography, a user secret key is derived from two partial secrets: one is the identity-based secret key (corresponding to the user identity) generated by a Key Generation Center (KGC), and the other is the user self-generated secret key (corresponding to a user self-generated and uncertified public key). Two types of adversaries are considered for certificateless cryptography: a Type-I adversary who can replace the user self-generated public key (in transmission or in a public directory), and a Type-II adversary who is an honest-but-curious KGC. In this paper, we present a formal study on certificateless key exchange (CLKE). We show that the conventional definition of Type-I and Type-II security may not be suitable for certificateless key exchange when considering the notion of forward secrecy which is important for key exchange protocols. We then present a new security model in which a single adversary (instead of Type-I and Type-II adversaries) is considered. We also construct a strongly secure certificateless key exchange protocol without expensive pairing operations. As far as we know, our proposed protocol is the first proven secure CLKE protocol without pairing.
In certificateless cryptography, a user secret key is derived from two partial secrets: one is the identity-based secret key (corresponding to the user identity) generated by a Key Generation Center (KGC), and the other is the user self-generated secret key (corresponding to a user self-generated and uncertified public key). Two types of adversaries are considered for certificateless cryptography: a Type-I adversary who can replace the user self-generated public key (in transmission or in a public directory), and a Type-II adversary who is an honest-but-curious KGC. In this paper, we present a formal study on certificateless key exchange (CLKE). We show that the conventional definition of Type-I and Type-II security may not be suitable for certificateless key exchange when considering the notion of forward secrecy which is important for key exchange protocols. We then present a new security model in which a single adversary (instead of Type-I and Type-II adversaries) is considered. We also construct a strongly secure certificateless key exchange protocol without expensive pairing operations. As far as we know, our proposed protocol is the first proven secure CLKE protocol without pairing.
Recently, Yang and Tan proposed a certificateless key exchange protocol without pairing, and claimed their scheme satisfies forward secrecy, which means no adversary could derive an already-established session key unless the full user secret keys (including a private key and an ephemeral secret key) of both communication parties are compromised. However, in this paper, we point out their protocol is actually not secure as claimed by presenting an attack launched by an adversary who has learned the private key of one party and the ephemeral secret key of the other, but not the full user secret keys of both parties. Furthermore, to make up this flaw, we also provide an improved protocol in which the private key and the ephemeral secret key are closely intertwined with each other for generating the session key, thus above attack can be efficiently resisted.
Non-interactive key exchange (NIKE) allows two parties to establish a shared key without communications. In ID-based non-interactive key exchange (ID-NIKE) protocols, private key generator (PKG) knows user's private key, so it can calculate the shared key between two participants, and most constructions of ID-NIKE need expensive pairing operation. To overcome these disadvantages, a security model of certificateless non-interactive key exchange (CL-NIKE) is proposed in this paper. And a scheme without pairings is also given. The proposed protocol is proved secure in the Random Oracle Model (ROM) based on the gap Diffie-Hellman (GDH) and computational Diffie-Hellman (CDH) problem. In the new protocol, key generation center (KGC) only knows user's partial key and is not able to calculate the shared key. Moreover, the new protocol is more efficient than the existing ID-NIKE schemes because it is pairing-free.
Almostall the certificateless two-party authenticated key agreement (CTAKA) protocols found in the literature, suffer either serious security problems or inefficient performance that involves high computational costs.In this paper, we design a secure and efficient CTAKA protocol.Within the proposed CTAKA protocol, the KGC publishes the public keys of the users in a public directory (LDAP server) that has a certificate to prove its identity to the users.The LDAP certificate is the only existing certificate within the scheme.Both the two communicating parties are able to compute a common secret per session key using a secure generated random number.The protocol is fully secure against type 1 attack and fully secure against type 2 attacks under the assumptions that the KGC is an honest party and each party within the network has the full capability to keep its secret values safe.Moreover, the setup of the protocol does not include pairings and the whole key agreement process requires only four point scalar multiplications, two point additions, one hash function evaluation and one message exchange.
Authenticated key agreement (AK) protocol is crucial in providing data confidentiality and integrity for subsequent communications among two or more parties over a public network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional public key cryptography (PKC). Unfortunately, construction of CL-PKC and AK protocols has so far depended on the use of identity-based encryption, which results in the bilinear pairing-based schemes that need costly operations. We present a secure certificateless authenticated key agreement protocol without paring, based on the certificateless encryption scheme proposed by J. Baek et al. It shows that the newly proposed scheme is of nice efficiency and practical. Moreover, it provides perfect forward secrecy, PKG forward secrecy and almost all the other known security attributes, such as known-key secrecy, key-compromise impersonation resilience, unknown key-share resilience, known session-specific temporary information security, message independence and no key control.
Authenticated key agreement protocol is one of the important cryptographic primitives to ensure secure communication in an open network. Certificateless public key cryptography (CL-PKC) represents an interesting and potentially useful balance between public key cryptography based on certificates and identity-based cryptography. The topic of CL-PKC has undergone quite rapid development with schemes being proposed for encryption and signatures, while certificateless authenticated key agreement protocols are seldom discussed. In this paper, we present a secure two-party authenticated key agreement protocol based on an efficient certificateless public key encryption with pairing. Such a scheme achieves almost all of the security attributes, including known-key secrecy, perfect forward secrecy, PKG forward secrecy, key-compromise impersonation resilience, unknown key-share resilience, known session-specific temporary information security, message independence and no key control. Meanwhile, it is also practical with nice efficiency.
Certificateless public-key cryptography has conquered both the certificate management problem in the traditional public-key cryptography and the key escrow problem in the ID-based public-key cryptography. Certificateless authenticated key exchange (CLAKE) protocol is an important primitive of the certificateless public-key cryptography. A CLAKE protocol is employed to provide both mutual authentication and establishing a session key between two participators. Indeed, all conventional public-key cryptographies have encountered a new kind of attack, named “side-channel attacks”. Fortunately, leakage-resilient cryptography is a flexible approach to withstand such attacks. However, the design of leakage-resilient CLAKE (LR-CLAKE) protocols is not studied. In the article, by extending the well-known extended-Canetti-Krawczyk (eCK) model, we present the security notions (adversary model) of LR-CLAKE protocols, called continual-leakage-resilient eCK (CLReCK) model. The first LR-CLAKE protocol withstanding side-channel attacks is proposed. By employing the proof technique of the generic bilinear group (GBG) model, we formally prove the security of our protocol in the CLReCK model.