Security and Communication Networks

Authenticated key exchange with synchronized state

Zheng Yang, Fei Guo

Published Mar 10, 2014• 3 citations

Abstract

ABSTRACT We study the problem on how to either prevent identity impersonation (IDI) attacks or limit its consequences by on‐line detecting previously unidentified IDI attacks, where IDI attacks are normally caused by the leakage of identity related long‐term key. Such problem has, up until now, lacked a provably good solution. We deal with this problem through the scenario on authenticated key exchange with synchronized state (AKESS). This work provides a security model for AKESS, in which we particularly formalize the security of synchronized state based on indistinguishability. We propose a two party execution state synchronization framework for symmetric case, based on which we propose a generic compiler for AKESS protocols. Our goal is to transform any existing passively secure KE protocols to AKESS protocols using synchronized state, without any modification on those KE protocols. The new generic compiler is probably secure in the standard model under standard assumptions. Copyright © 2014 John Wiley & Sons, Ltd.

DOI: 10.1002/sec.948

Related papers

Authenticated Key Exchange with Synchronized States.

Zheng Yang

Abstract. Nowadays, most of sensitive applications over insecure network are protected by some authenticated secure channel which is highly relies on specific authenticated key exchange (AKE) protocol. Nevertheless, the leakage of authentication credential used in AKE protocol somehow result in unauthorized exploitation of credential information via identity impersonation (IDI) attack. To address the problem of IDI, we introduce a new dynamic authentication factor for AKE protocols, i.e., the secret execution states, to either prevent IDI attack by detecting attempts thereof, or limit its consequences by on-line detecting situations of previously unidentified IDI. In this paper, we model the security for authenticated key exchange with synchronized states (AKESS) based on Bellare-Rogaway model, and we particularly formalize the IDI and IDI detection. We propose a generic execution states synchronization framework for AKE, in which we utilize the session key to generate the secret execution states on both sides, and present a new AKESS protocol which is provably secure in the standard model. Our goal is to enhance the security of existing authenticated key exchange with long-lived key (AKELL) protocols by equipping them with the capabilities of both IDI prevention and detection without modifications on those protocols.

Jan 1, 20110 citations

Strongly Secure Authenticated Key Exchange in the Standard Model

Zheng Yang

Nowadays many crucial network applications rely on the existence of a confidential channel established by authenticated key exchange (AKE) protocols over public networks.With the rapid development of cyber technology, novel attacks to cryptosystem emerge in an endless stream.This has also led to the development of AKE solutions to provide increasingly stronger security guarantees.In this thesis we focus on provision of practical constructions for AKE protocols which are provably secure in a strong sense without resorting to random oracles.We first we present three new efficient compilers to generically turn passively secure key exchange protocols (KE) into authenticated key exchange protocols (AKE) where security also holds in the presence of active adversaries.Our compilers are not only a useful tool for the design of new AKE systems with many additional security properties in a modular and less error-prone fashion, but they also help to relax the assumptions on existing, practical key exchange mechanisms which are not known to be provably secure AKE protocols.Security of our compilers is shown in a strong modified CK model where the adversary is allowed to reveal either long-term secret key or state information of the protocol participants.On the second, we study the open problem on constructing eCK secure two party AKE protocol without random oracles and NAXOS trick.A generic construction satisfying those requirements is given based on well-known cryptographic primitives following the guideline of efficiency.Then a concrete protocol is proposed which is the first eCK secure protocol in the standard model under both standard assumptions and post-specified peer setting (i.e.without knowing any cryptographic information about its communication peer).Both proposed schemes can be more efficiently implemented with secure device than previous works which are eCK secure in the standard model, where the secure device might be normally used to store the long-term private key and to implement codes of protocol which need to be resilience of state leakage.Finally, we generalize our one-round two party AKE construction to group case that yields an efficient tripartite AKE protocol based on bilinear maps and a candidate group AKE protocol (with more than three members) based on multilinear maps.Up to now they are the first solutions which can be proved secure in the g-eCK model without random oracles.Meanwhile we make first step to show how to simplify the security proof for one-round group AKE under g-eCK model.i

Jan 1, 20130 citations

An RSA-Based Leakage-Resilient Authenticated Key Exchange Protocol Secure against Replacement Attacks, and Its Extensions

SeongHan Shin, Kazukuni Kobara, Hideki Imai

Secure channels can be realized by an authenticated key exchange (AKE) protocol that generates authenticated session keys between the involving parties. In [32], Shin et al., proposed a new kind of AKE (RSA-AKE) protocol whose goal is to provide high efficiency and security against leakage of stored secrets as much as possible. Let us consider more powerful attacks where an adversary completely controls the communications and the stored secrets (the latter is denoted by “replacement” attacks). In this paper, we first show that the RSA-AKE protocol [32] is no longer secure against such an adversary. The main contributions of this paper are as follows: (1) we propose an RSA-based leakage-resilient AKE (RSA-AKE2) protocol that is secure against active attacks as well as replacement attacks; (2) we prove that the RSA-AKE2 protocol is secure against replacement attacks based on the number theory results; (3) we show that it is provably secure in the random oracle model, by showing the reduction to the RSA one-wayness, under an extended model that covers active attacks and replacement attacks; (4) in terms of efficiency, the RSA-AKE2 protocol is comparable to [32] in the sense that the client needs to compute only one modular multiplication with pre-computation; and (5) we also discuss about extensions of the RSA-AKE2 protocol for several security properties (i.e., synchronization of stored secrets, privacy of client and solution to server compromise-impersonation attacks).

IEICE Transactions on Fundamentals of Electronics Communications and Computer SciencesJan 1, 20106 citations

Authenticated key exchange protocol with enhanced freshness properties

Hai Huang, Zhenfu Cao

Abstract This paper investigates the security model for authenticated key exchange protocols. We further enhance the enhanced Canetti‐Krawczyk (eCK) model by introducing a notion called strong key compromise impersonation (SKCI) resilience which is first identified in this paper. SKCI resilience guarantees that the adversary cannot masquerade as another party B to communicate with party A even if the static private key and the ephemeral private key of party A are compromised. We point out that the three‐pass authenticated key exchange protocol generically transformed from the two‐pass one secure in the eCK model cannot resist the SKCI attack. Finally, we introduce a new authenticated key exchange protocol SIG‐DH+ and prove that it satisfies our new definition. Copyright © 2010 John Wiley & Sons, Ltd.

Security and Communication NetworksAug 28, 20102 citations

IDOAKE: strongly secure ID‐based one‐pass authenticated key exchange protocol

Hai Huang, Zhenfu Cao

Abstract ID‐based one‐pass authenticated key exchange protocol allows the sender Alice to generate a session key without interacting with receiver Bob. As a result, it is better suitable for some application scenarios than the two‐pass counterpart. However, currently there are few ID‐based one‐pass authenticated key exchange protocols with a security proof in a formal model. The paper investigates the ID‐based one‐pass authenticated key exchange protocol in the enhanced Canetti–Krawczyk (eCK) model. We propose a new ID‐based one‐pass authenticated key exchange protocol IDOAKE, which is shown secure under Bilinear Diffie–Hellman (BDH) assumption in the eCK model. To the best of our knowledge, our protocol is the first provably secure ID‐based one‐pass authenticated key exchange in the eCK model. Copyright © 2010 John Wiley & Sons, Ltd.

Security and Communication NetworksDec 3, 20105 citations

A resilient identity-based authenticated key exchange protocol

Ibrahim F. Elashry, Yi Mu, Willy Susilo

This paper presents a new security notion for key exchange (KE) protocols called resiliency. That is, if a shared secret between a group of parties is compromised or leaked, they can generate another completely new shared secret without the need to set up a new KE session. We present an identity-based authenticated KE protocol that satisfies the resiliency security property. We prove that if an l-bit shared secret key (SSK) is leaked, then two parties P1 and P2 can safely generate another shared secret SSK1 without the need to establish a new session. We adjust the unauthenticated adversarial model of the Canetti–Krawczyk to meet this security property and prove the security of the proposed protocol using the Canetti–Krawczyk model based on the quadratic residuosity assumption. Copyright © 2015 John Wiley & Sons, Ltd.

Security and Communication NetworksJan 23, 201511 citations