Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International Conference on Next Generation Web Services Practices

Insider Impersonation Attack on a Tripartite ID-Based Authenticated Key Agreement Protocol with Bilinear Pairings

Meng-Hui Lim, Sang-Gon Lee, Hoon Jae Lee

Published Oct 1, 2008• 1 citation
Publisher

Abstract

A key agreement protocol is designed for two or more entities to agree upon a shared secret key, which can subsequently be used to preserve confidentiality and data integrity over an open network. Since Joux has pioneered the notion of pairing-based tripartite key agreement protocol, various group key agreement schemes have been proposed after then. In 2003, Liu et al. proposed a tripartite identity-based authenticated key agreement protocol using bilinear pairings. Although the scheme is claimed to be efficient and secure, we discover that it is in fact breakable. In this paper, we highlight the flaw by demonstrating an insider impersonation attack on the scheme and suggest a few enhancements to conquer the defect.

DOI
10.1109/nwesp.2008.9

Related papers

An Improved One-Round ID-Based Tripartite Authenticated Key Agreement Protocol.

Meng-Hui Lim, Sang-Gon Lee

Abstract. A tripartite authenticated key agreement protocol is generally designed to accommodate the need of three speci c entities in communicating over an open network with a shared secret key, which is used to preserve con dentiality and data integrity. Since Joux initiates the development of tripartite key agreement protocol, many prominent tripartite schemes have been proposed subsequently. In 2005, Tso et al. have proposed an ID-based non-interactive tripartite key agreement scheme with k-resilience. Based on this scheme, they have further proposed another one-round tripartite application scheme. Although they claimed that both schemes are e cient and secure, we discover that both schemes are in fact breakable. In this paper, we impose several impersonation attacks on Tso et al.s schemes in order to highlight their aws. Subsequently, we propose an enhanced scheme which will not only conquer their defects, but also preserve the desired security attributes of a key agreement protocol. 1

•Jan 1, 2007•6 citations

An Insider Attack Resistant Group Key Agreement Protocol from Pairings

Yongzhong He, Xiaoyong Li, Zhen Han

Authenticated group key agreement allows a group of users to generate a shared key which satisfies various security requirements. Several identity-based authenticated group key agreement schemes are proposed. However, these schemes are shown to be vulnerable to insider impersonation attacks that any two malicious group members can impersonate other user to agree some session keys in a new group. In this paper, a simple two round authenticated group agreement scheme based on Burmester and Desmedt's scheme is proposed. Compared to previous protocols, our protocol is efficient while secure against various known attacks, including key exposure attacks and insider impersonation attacks.

International Conference on Innovative Computing, Information and Control•Sep 1, 2007•4 citations

An Improvement of Certification-based One-Round Tripartite Key Agreement Protocols

Kambombo Mtong, Eun‐Jun Yoon

Key agreement protocols allow multi-parties exchanging public information to create a common secret key that is known only to those entities over an insecure network. Since Joux first published the pairing-based one round tripartite key agreement protocol, many authenticated protocols have been proposed. Unfortunately, many of them have been broken while others have been shown to be deficient in some desirable security attributes. In 2004, Cheng et al. presented two protocols aimed at strengthening Shim’s certificate-based and Zhang et al.’s tripartite identitybased protocols. This paper reports that 1) In Cheng et al.’s identity-based protocol, an adversary can extract long-term private keys of all the parties involved; and 2) Cheng et al.’s certificationbased protocol is weak against key integrity attacks. This paper suggests possible remedies for the security flaws in both protocols and then presents a modified Cheng et al.’s identity-based, oneround tripartite protocol that is more secure than the original protocol.

IEIE Transactions on Smart Processing and Computing•Oct 1, 2013•0 citations

Comments on an ID-Based Authenticated Group Key Agreement Protocol with Withstanding Insider Attacks

Tsu‐Yang Wu, Yuh‐Min Tseng

In PKC 2004, Choi et al. proposed an ID-based authenticated group key agreement (AGKA) protocol using bilinear pairings. Unfortunately, their protocol suffered from an impersonation attack and an insider colluding attack. In 2008, Choi et al. presented an improvement to resist insider attacks. In their modified protocol, they used an ID-based signature scheme on transcripts for binding them in a session to prevent replay of transcripts. In particular, they smartly used the batch verification technique to reduce the computational cost. In this paper, we first show that Choi et al.'s modified AGKA protocol still suffers from an insider colluding attack. Then, we prove that the batch verification of the adopted ID-based signature scheme in their modified protocol suffers from a forgery attack.

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Jan 1, 2009•9 citations

Tripartite Key Agreement Protocols and Insider Impersonation Attack

Hung‐Yu Chien, Ru-Yu Lin

Even though several certificate-based tripartite key agreement protocols with pairings have been proposed, the insider impersonation attack was not noticed. This specific threat applies to those key agreement protocols where there are more than two communicating parties. This paper re-examines the previous protocols. We find that both Shim's scheme and the LHL scheme are not secure. The Shim scheme is weak in key-compromise impersonation attack, insider impersonation attack, and replay attack. The LHL tripartite key scheme is vulnerable to insider attack, outsider impersonation attack, and key-compromise impersonation attack. Furthemore, we propose two approaches to improve the security. Our schemes are more efficient than Al-Riyami-Paterson's tripartite key confirmation protocol, which is the most secure one among the referenced works.

朝陽學報•Jun 1, 2005•0 citations

Cryptanalysis of Improved One-round Lin-Li's Tripartite Key Agreement Protocol

Meng-Hui Lim, Sang-Gon Lee, Hoon Jae Lee

A tripartite authenticated key agreement protocol is designed for three entities to communicate securely over an open network particularly with a shared key. Recently, we have improved a one-round tripartite authenticated key agreement protocol proposed by Lin-Li due to its vulnerability to the forging attack in our previous report. However, we have later discovered that both the original Lin-Li's scheme and our previous enhanced protocol are vulnerable to the insider replay attack. Moreover, we have also realized that both protocols have falsely claimed the forward secrecy attribute. In this paper, we will revise our improvements and again secure this protocol against these cryptanalytic attacks while recovering the precious perfect forward secrecy property.

International Conference on Advanced Communication Technology•Feb 1, 2008•5 citations
A key agreement protocol is designed for two or more entities to agree upon a shared secret key, which can subsequently be used to preserve confidentiality and data integrity over an open network. Since Joux has pioneered the notion of pairing-based tripartite key agreement protocol, various group key agreement schemes have been proposed after then. In 2003, Liu et al. proposed a tripartite identity-based authenticated key agreement protocol using bilinear pairings. Although the scheme is claimed to be efficient and secure, we discover that it is in fact breakable. In this paper, we highlight the flaw by demonstrating an insider impersonation attack on the scheme and suggest a few enhancements to conquer the defect.
Abstract. A tripartite authenticated key agreement protocol is generally designed to accommodate the need of three speci c entities in communicating over an open network with a shared secret key, which is used to preserve con dentiality and data integrity. Since Joux initiates the development of tripartite key agreement protocol, many prominent tripartite schemes have been proposed subsequently. In 2005, Tso et al. have proposed an ID-based non-interactive tripartite key agreement scheme with k-resilience. Based on this scheme, they have further proposed another one-round tripartite application scheme. Although they claimed that both schemes are e cient and secure, we discover that both schemes are in fact breakable. In this paper, we impose several impersonation attacks on Tso et al.s schemes in order to highlight their aws. Subsequently, we propose an enhanced scheme which will not only conquer their defects, but also preserve the desired security attributes of a key agreement protocol. 1
Authenticated group key agreement allows a group of users to generate a shared key which satisfies various security requirements. Several identity-based authenticated group key agreement schemes are proposed. However, these schemes are shown to be vulnerable to insider impersonation attacks that any two malicious group members can impersonate other user to agree some session keys in a new group. In this paper, a simple two round authenticated group agreement scheme based on Burmester and Desmedt's scheme is proposed. Compared to previous protocols, our protocol is efficient while secure against various known attacks, including key exposure attacks and insider impersonation attacks.
Key agreement protocols allow multi-parties exchanging public information to create a common secret key that is known only to those entities over an insecure network. Since Joux first published the pairing-based one round tripartite key agreement protocol, many authenticated protocols have been proposed. Unfortunately, many of them have been broken while others have been shown to be deficient in some desirable security attributes. In 2004, Cheng et al. presented two protocols aimed at strengthening Shim’s certificate-based and Zhang et al.’s tripartite identitybased protocols. This paper reports that 1) In Cheng et al.’s identity-based protocol, an adversary can extract long-term private keys of all the parties involved; and 2) Cheng et al.’s certificationbased protocol is weak against key integrity attacks. This paper suggests possible remedies for the security flaws in both protocols and then presents a modified Cheng et al.’s identity-based, oneround tripartite protocol that is more secure than the original protocol.
In PKC 2004, Choi et al. proposed an ID-based authenticated group key agreement (AGKA) protocol using bilinear pairings. Unfortunately, their protocol suffered from an impersonation attack and an insider colluding attack. In 2008, Choi et al. presented an improvement to resist insider attacks. In their modified protocol, they used an ID-based signature scheme on transcripts for binding them in a session to prevent replay of transcripts. In particular, they smartly used the batch verification technique to reduce the computational cost. In this paper, we first show that Choi et al.'s modified AGKA protocol still suffers from an insider colluding attack. Then, we prove that the batch verification of the adopted ID-based signature scheme in their modified protocol suffers from a forgery attack.
Even though several certificate-based tripartite key agreement protocols with pairings have been proposed, the insider impersonation attack was not noticed. This specific threat applies to those key agreement protocols where there are more than two communicating parties. This paper re-examines the previous protocols. We find that both Shim's scheme and the LHL scheme are not secure. The Shim scheme is weak in key-compromise impersonation attack, insider impersonation attack, and replay attack. The LHL tripartite key scheme is vulnerable to insider attack, outsider impersonation attack, and key-compromise impersonation attack. Furthemore, we propose two approaches to improve the security. Our schemes are more efficient than Al-Riyami-Paterson's tripartite key confirmation protocol, which is the most secure one among the referenced works.
A tripartite authenticated key agreement protocol is designed for three entities to communicate securely over an open network particularly with a shared key. Recently, we have improved a one-round tripartite authenticated key agreement protocol proposed by Lin-Li due to its vulnerability to the forging attack in our previous report. However, we have later discovered that both the original Lin-Li's scheme and our previous enhanced protocol are vulnerable to the insider replay attack. Moreover, we have also realized that both protocols have falsely claimed the forward secrecy attribute. In this paper, we will revise our improvements and again secure this protocol against these cryptanalytic attacks while recovering the precious perfect forward secrecy property.