International Conference on Network Computing and Information Security

Key Replicating Attack on an Identity-Based Three-Party Authenticated Key Agreement Protocol

Wei Yuan, Liang Qing Hu, Hongtu Li, Kuo Zhao, Jiang-feng Chu, Yuyu Sun

Published May 1, 2011• 2 citations

Abstract

In 2009, Mengbo Hou and Qiuliang Xu found the key replicating attack in the BR93 security model on a Certificateless two-party authenticated key agreement protocol proposed by Y.J Shi and J.H Li. In 2010, Marko Hölbl, Tatjana Welzer and Boštjan Brumen proposed a one-round identity-based three-party authenticated key agreement protocol using pairings called IDAK3-P1 and declared that the protocol had the attributes of known-key security, forward secrecy, key-compromise impersonation resilience, unknown key-share resilience and key control. In this paper, we make a systematic analysis on IDAK3-P1 and find it has similar structure as the Y.J Shi and J.H Li's protocol. We introduce Mengbo Hou and Qiuliang Xu's attack method in identifying the vulnerability of IDAK3-P1. Our analysis shows that the IDAK3-P1 is vulnerable to the key replicating attack in the BR model. Therefore, it doesn't possess the security attributes of implicit key authentication and key control as declared.

DOI: 10.1109/ncis.2011.147

Related papers

On the security of certificateless authenticated key agreement protocol

Mengbo Hou, Qiuliang Xu

Authenticated key agreement protocol is a fundamental building block for ensuring private communications between two or more parties over an insecure network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In the recent work, Wang et al. proposed an efficient two-party certificateless authenticated key agreement protocol from pairings used to protect the Web client/server communication. However, we found the scheme cannot withstand key compromise impersonation attack, and also, is vulnerable to one form of the man-in-the-middle attack -- key replicating attack, thus it doesn't possess some desirable security attributes,such as key compromise impersonation resilience and key integrity. We analyze the key replicating attack against the protocol in the BR93 security model in detail, and demonstrate that the protocol is not secure if the adversary was allowed to send a reveal query to reveal non-partner players who had accepted the same session key.

International Conference on Information Technology in Medicine and EducationAug 1, 20092 citations

Key Replicating Attack on Certificateless Authenticated Key Agreement Protocol

Mengbo Hou, Qiuliang Xu

Authenticated key agreement protocol is crucial in providing data confidentiality and integrity to subsequent communications among two or more parties over a public network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In 2007, Y.J Shi and J.H Li proposed a two-party authenticated key agreement protocol based on the certificateless encryption scheme proposed by B. Libert and J.J. Quisquater. It is found that the scheme is vulnerable to the key replicating attack (one form of the man-in-the-middle attack), so it doesnpsilat possess the security attribute of implicit key authentication and key control. We analyze such an attack of this protocol in the BR93 model in detail, and demonstrate that the protocol is not secure if the adversary is allowed to send a reveal query to reveal non-partner players who had accepted the same session key.

Asia-Pacific Conference on Information ProcessingJul 1, 20096 citations

Cryptanalysis on Identity-based Authenticated Key Agreement Protocols from Pairings

Mengbo Hou, Qiuliang Xu, Shanqing Guo +1 more

Abstract—Two-party authenticated key agreement protocol is used to authenticate entities and establish session keys in an open network in order to provide secure communications between two parties. Several security attributes are highly desired for such protocols, such as perfect forward secrecy (the corruption of long-term keys of all the entities should not compromise any session key), PKG forward secrecy (the corruption of the PKG's master key in the ID-based system should not compromise the established session keys), and known session-key specific temporary information secrecy (The exposure of private temporary information should not compromise the secrecy of generated session keys). In 2005, Choie et al. proposed three identity-based authenticated key agreement protocols from pairings. Our analysis shows that they all didn't provide protection against known session-key specific temporary information attack and some of them are vulnerable against man-in-the-middle attack, such as the key replicating attack. We analyze some of the attacks under the BR93 security model. Index Terms—key agreement protocol, known session-key specific temporary information secrecy, key replicating attack, security model I.

Journal of NetworksJun 16, 20108 citations

Secure and Efficient Two-Party Authenticated Key Agreement Protocol from Certificateless Public Key Encryption Scheme

Mengbo Hou, Qiuliang Xu

As the fundamental building block for secure communication in the open network, authenticated key agreement protocols are usually constructed in the public key setting. Certificateless public key cryptography combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In this paper, we present a secure and efficient two-party authenticated key agreement protocol based on the efficient certificateless public key encryption scheme due to Cheng and Comley. Security analysis shows that it achieves perfect forward secrecy, PKG forward secrecy and almost all the other known security attributes for authenticated key agreement protocol, such as known-key secrecy, key-compromise impersonation resilience, unknown key-share resilience, known session-specific temporary information security, message independence and no key control. Compared to other comparable schemes, it is more secure and has nice efficiency.

International Joint Conference on INC, IMS and IDC (NCM)Jan 1, 20094 citations

A one-round ID-based authenticated key agreement protocol with enhanced security

Mengbo Hou, Qiuliang Xu

Authenticated key agreement protocol is used to set up the session key and establish secure channel for network communication in the open environment. So far, great deals of identity-based protocols have been proposed to provide robust mutual authentication and key establishment in the two-party setting. Majority of the existing identity-based key agreement protocols require expensive bilinear pairing operation and only provide limited security attributes. Therefore, such protocols are unsuitable for real-world applications that require stronger sense of secrecy. In this paper, we first analysis some of the schemes proposed recently, and then present a one-round ID-based authenticated key agreement protocol with enhanced security attributes, which doesn't need pairing operation and achieves most of the required security attributes, such as known-key secrecy, perfect forward secrecy, PKG Forward Secrecy, key-compromise impersonation resilience, unknown key-share resilience and no key control. In addition, it captures the enhanced security attributes-Known session-specific temporary key information secrecy.

International Conference on Intelligent Control and Information ProcessingJul 1, 20112 citations

Cryptanalysis and improvement of two certificateless three-party authenticated key agreement protocols

Haiyan Sun, Qiaoyan Wen, Hua Zhang +2 more

Recently, two certificateless three-party authenticated key agreement protocols were proposed, and both protocols were claimed they can meet the desirable security properties including forward security, key compromise impersonation resistance and so on. Through cryptanalysis, we show that one neither meets forward security and key compromise impersonation resistance nor resists an attack by an adversary who knows all users' secret values, and the other cannot resist key compromise impersonation attack. Finally, we propose improved protocols to make up two original protocols' security weaknesses, respectively. Further security analysis shows that our improved protocols can remove such security weaknesses.

arXiv:1301.5091Jan 22, 20132 citations