Security Models and Proofs for Key Establishment Protocols

Eddie M. Ng

Published Jan 1, 2005• 5 citations

Abstract

In this thesis we study the problem of secure key establishment, motivated by the construction of secure channels protocols to protect information transmitted over an open network. In the past, the purported security of a key establishment protocol was justified if it could be shown to withstand popular attack scenarios by heuristic analysis. Since this approach does not account for all possible attacks, the security guarantees are limited and often insufficient. \nThis thesis examines the provable security approach to the analysis of key establishment protocols. We present the security models and definitions developed in 2001 and 2002 by Canetti and Krawczyk, critique the appropriateness of the models, and provide several security proofs under the definitions. In addition, we consider the importance of the key compromise impersonation resilience property in the context of these models. We list some open problems that were encountered in the study.

Related papers

Key establishment : proofs and refutations

Kim‐Kwang Raymond Choo

We study the problem of secure key establishment. We critically examine the security models of Bellare and Rogaway (1993) and Canetti and Krawczyk (2001) in the computational complexity approach, as these models are central in the understanding of the provable security paradigm. We show that the partnership definition used in the three-party key distribution (3PKD) protocol of Bellare and Rogaway (1995) is flawed, which invalidates the proof for the 3PKD protocol. We present an improved protocol with a new proof of security. We identify several variants of the key sharing requirement (i.e., two entities who have completed matching sessions, partners, are required to accept the same session key). We then present a brief discussion about the key sharing requirement. We identify several variants of the Bellare and Rogaway (1993) model. We present a comparative study of the relative strengths of security notions between the several variants of the Bellare-Rogaway model and the Canetti-Krawczyk model. In our comparative study, we reveal a drawback in the Bellare, Pointcheval, and Rogaway (2000) model with the protocol of Abdalla and Pointcheval (2005) as a case study. We prove a revised protocol of Boyd (1996) secure in the Bellare-Rogaway model. We then extend the model in order to allow more realistic adversary capabilities by incorporating the notion of resetting the long-term compromised key of some entity. This allows us to detect a known weakness of the protocol that cannot be captured in the original model. We also present an alternative protocol that is efficient in both messages and rounds. We prove the protocol secure in the extended model. We point out previously unknown flaws in several published protocols and a message authenticator of Bellare, Canetti, and Krawczyk (1998) by refuting claimed proofs of security. We also point out corresponding flaws in their existing proofs. We propose fixes to these protocols and their proofs. In some cases, we present new protocols with full proofs of security. We examine the role of session key construction in key establishment protocols, and demonstrate that a small change to the way that session keys are constructed can have significant benefits. Protocols that were proven secure in a restricted Bellare-Rogaway model can then be proven secure in the full model. We present a brief discussion on ways to construct session keys in key establishment protocols and also prove the protocol of Chen and Kudla (2003) secure in a less restrictive Bellare-Rogaway model. To complement the computational complexity approach, we provide a formal specification and machine analysis of the Bellare-Pointcheval-Rogaway model using an automated model checker, Simple Homomorphism Verification Tool (SHVT). We demonstrate that structural flaws in protocols can be revealed using our framework. We reveal previously unknown flaws in the unpublished preproceedings version of the protocol due to Jakobsson and Pointcheval (2001) and several published protocols with only heuristic security arguments. We conclude this thesis with a listing of some open problems that were encountered in the study.

Jan 1, 200618 citations

Key exchange security in constructive cryptography

Christian Badertscher

Assessing the security of key exchange protocols is a crucial task and turned out to be highly non-trivial.Many protocols proposed in the past have subsequently been broken.In order to provide a formal framework for security proofs, various security models have been defined.In this thesis, we analyse several such security models for key exchange protocols using the paradigm of constructive cryptography.We examine the exact constructive security guarantees and semantics that these notions provide.In particular, we compare constructive security definitions with a model proposed by Bellare and Rogaway, SK-security by Canetti and Krawczyk and a formal model for secure key exchange proposed by Shoup.i

Jan 1, 20120 citations

Enhancing CK-Model for Key Compromise Impersonation Resilience and Identity-based Key Exchange.

Robert W. Zhu, Xiaojian Tian, Duncan S. Wong

Abstract. In 2001, Canetti and Krawczyk proposed a security model (CKmodel) for authentication protocols. They also gave an indistinguishabilitybased definition for key exchange protocols. Since then the model has almost exclusively been used for analyzing key exchange protocols, although it can be applied to authentication protocols in general. The model not only captures a large class of attacks but also provides a modular approach to the design of authentication protocols. However, the model does not capture the property of Key Compromise Impersonation (KCI) Resilience. Until now, analysis concerning this property has mostly been done heuristically and restricted to key exchange protocols only. Previous attempts on formalizing KCI have mostly been done in some ad hoc manner and additional proofs have to be given specifically for the security of KCI resilience. In this paper, we propose an extension to the CK-model, which allows, for the first time, the KCI attacks to be considered in authentication protocols in general, rather than restricted to key exchange protocols, and no more additional proofs are required specifically for KCI security. With the revival of interest in identity-based (ID-based) cryptography, there have been many new ID-based key exchange protocols proposed. Despite the fact that some of them have been proven in some restricted versions of a model proposed by Bellare and Rogaway in 1993 and some others have been proven in the original CK-model, there is no rigorous model specifically for ID-based key exchange security. In particular, forward secrecy against compromised Key Generation Server (KGS-FS) has never been captured even though this notion is more important and stronger than the perfect forward secrecy in ID-based key exchange. For this, we further extend our model to ID-based setting and capture the property of KGS-FS for ID-based key exchange security. 1

Jan 1, 20055 citations

Security in Key Agreement: Two-Party Certificateless Schemes

Colleen Marie Swanson

The main goal of cryptography is to enable secure communication over a public channel; often a secret shared among the communicating parties is used to achieve this. The process by which these parties agree on such a shared secret is called key agreement. In this thesis, we focus on two-party key agreement protocols in the public-key setting and study the various methods used to establish and validate public keys. We pay particular attention to certificateless key agreement schemes and attempt to formalize a relevant notion of security. To that end, we give a possible extension of the existing extended Canetti-Krawzcyk security model applicable to the certificateless setting. We observe that none of the certificateless protocols we have seen in the literature are secure in this model; it is an open question whether such schemes exist. We analyze several published certificateless key agreement protocols, demonstrating the existence of key compromise impersonation attacks and even a man-in-the-middle attack in one case, contrary to the claims of the authors. We also briefly describe weaknesses exhibited by these protocols in the context of our suggested security model.

Dec 22, 200848 citations

Key establishment --- security models, protocols and usage

Berkant Ustaoğlu

Key establishment is the process whereby two or more parties derive a shared \nsecret, typically used for subsequent confidential communication. However, \nidentifying the exact security requirements for key establishment protocols is \na non-trivial task. This thesis compares, extends and merges existing security \ndefinitions and models for key establishment protocols. \n \nThe primary focus is on two-party key agreement schemes in the public-key \nsetting. On one hand new protocols are proposed and analyzed in the existing \nCanetti-Krawzcyk model. On the other hand the thesis develops a security model \nand novel definition that capture the essential security attributes of the \nstandardized Unified Model key agreement protocol. These analyses lead to the \ndevelopment of a new security model and related definitions that combine and \nextend the Canetti-Krawzcyk pre- and post- specified peer models in terms of \nprovided security assurances. \n \nThe thesis also provides a complete analysis of a one-pass key establishment \nscheme. There are security goals that no one-pass key establishment scheme can \nachieve, and hence the two-pass security models and definitions need to be \nadapted for one-pass protocols. The analysis provided here includes \nthe description of the required modification to the underlying security model. \nFinally, a complete security argument meeting these altered conditions is \npresented as evidence supporting the security of the one-pass scheme. \n \nLastly, validation and reusing short lived key pairs are related to \nefficiency, which is a major objective in practice. The thesis considers the \nformal implication of omitting validation steps and reusing short lived key \npairs. The conclusions reached support the generally accepted cryptographic \nconventions that incoming messages should not be blindly trusted and extra \ncare should be taken when key pairs are reused.

Jul 30, 20083 citations

Secure multi-party key establishment

Chih-Hung Li

For a secure communication through the public network, cryptographic encryption must be applied. The key establishment issue is the most important part in cryptographic encryption. Only the legitimate principals who have the key can encrypt messages and decrypt cryptograms. A secure multi-party communication held through the public network can only take place after a multi-party key establishment protocol has been executed. The multi-party key establishment protocol is designed so that the principals can receive a common key and use it to securely exchange the messages.\nIn this thesis, the secure multi-party key establishment protocols are discussed. W e start from investigating properties of two-party key establishment protocols such as motivation of using session key, adversaries in the protocols, attacks of the protocol and security analysis of the protocol. Then we give the requirements of a multi-party key establishment protocol and summarize about what should be considered in designing a multi-party key establishment protocol. After that we review some of the previous proposed multi-party key establishment protocol. The existing multi-party key establishment protocols are either impractical ( not efficient enough) or missing some important security goals such as authentication of principals. Three new protocols are proposed in this thesis. The first protocol addresses how to hold a conference for members of two hierarchical groups in an efficient way. The message broadcasting is used to reduce the cost of secure message transport.\nThe second and the third protocols manage the authentication problem by using a secret sharing scheme. We replace the principal authentication with the group authentication so that the computational overhead and communication overhead will be reduced especially in reuse of the protocol for new communication. Again, message broadcasting is used for replacing the expansive secure communication channel.\nPart of this thesis appeared in ACSC'99(Australian Computer Science Conference) and ACISP'99(Australian Conference of Information Security and Privacy).

Jan 1, 20000 citations