Secure Deniable Authenticated Key Establishment for Internet Protocols

Meng-Hui Lim, Sang-Gon Lee, Youngho Park, SangJae Moon

Published Apr 1, 2008• 4 citations

Abstract

In 2003, Boyd et al. have proposed two deniable authenticated key establishment protocols for Internet key exchange (IKE). However, both schemes have been broken by Chou et al. in 2005 due to their susceptibility to key-compromise impersonation (KCI) attack. In this paper, we put forward the improved variants of both Boyd et al.'s schemes in order to defeat the KCI attack. On top of justifying our improvements, we further present a detailed security analysis to ensure that the desired security attributes: deniability and authenticity remain preserved.

DOI: 10.1109/isa.2008.9

Related papers

Authenticated Deniable Internet KeyExchange

R.Pitch, S. Saranya

We propose two public-key schemes to achieve deniable authentication for the Internet Key Exchange (IKE). Authentication in security had is the essential factor in the key establishment over Internet. The Deniable Internet key exchange protocol gives more value to the IKE standard. Our schemes can in some situations be more efficient than existing IKE protocols as well as having stronger deniability properties. Key-exchange, in particular Diffie–Hellman key exchange (DHKE), is among the core cryptographic mechanisms for ensuring network security. For key-exchange over the Internet, both security and privacy are desired. In this paper, we develop a family of privacy-preserving authenticated DHKE protocols named deniable Internet key-exchange (DIKE), both in the traditional PKI setting and in the identity-based setting. The newly developed DIKE protocols are of conceptual clarity and practical (online) efficiency. They provide useful privacy protection to both protocol participants, and add novelty and new value to the IKE standard.

International Journal of Innovative Research in Computer and Communication EngineeringJan 1, 20150 citations

Enhancing CK-Model for Key Compromise Impersonation Resilience and Identity-based Key Exchange.

Robert W. Zhu, Xiaojian Tian, Duncan S. Wong

Abstract. In 2001, Canetti and Krawczyk proposed a security model (CKmodel) for authentication protocols. They also gave an indistinguishabilitybased definition for key exchange protocols. Since then the model has almost exclusively been used for analyzing key exchange protocols, although it can be applied to authentication protocols in general. The model not only captures a large class of attacks but also provides a modular approach to the design of authentication protocols. However, the model does not capture the property of Key Compromise Impersonation (KCI) Resilience. Until now, analysis concerning this property has mostly been done heuristically and restricted to key exchange protocols only. Previous attempts on formalizing KCI have mostly been done in some ad hoc manner and additional proofs have to be given specifically for the security of KCI resilience. In this paper, we propose an extension to the CK-model, which allows, for the first time, the KCI attacks to be considered in authentication protocols in general, rather than restricted to key exchange protocols, and no more additional proofs are required specifically for KCI security. With the revival of interest in identity-based (ID-based) cryptography, there have been many new ID-based key exchange protocols proposed. Despite the fact that some of them have been proven in some restricted versions of a model proposed by Bellare and Rogaway in 1993 and some others have been proven in the original CK-model, there is no rigorous model specifically for ID-based key exchange security. In particular, forward secrecy against compromised Key Generation Server (KGS-FS) has never been captured even though this notion is more important and stronger than the perfect forward secrecy in ID-based key exchange. For this, we further extend our model to ID-based setting and capture the property of KGS-FS for ID-based key exchange security. 1

Jan 1, 20055 citations

Impersonation Attack on Two Identity-Based Authenticated Key Exchange Protocols

Shiwu Zhang, Qingfeng Cheng, Xuekui Wang

In 2009, Holbl et al. proposed two new identity-based authenticated key exchange protocols and claimed that their protocols can withstand various attacks. In this paper, we will show that Holbl et al.'s protocols cannot resist basic impersonation attack. It also means that their protocols are vulnerable to key compromise impersonation (KCI) attacks. Furthermore, we propose improvements of their protocols with impersonation attack resilience and KCI resilience.

WASE International Conference on Information EngineeringAug 1, 20107 citations

Breaking the provably secure SAKE-C authenticated key exchange protocol with Extended Key Compromise Impersonation (E-KCI) Attack.

Ali Mackvandi, Maryam Saeed, Mansour Naddafiun

Jan 1, 20120 citations

Deniable Internet Key-Exchange.

Andrew Chi-Chih Yao, Frances Yao, Yunlei Zhao +1 more

In this work, we develop a family of protocols for deniable Internet Key-Exchange (IKE) with the following properties: • Highly practical efficiency, and conceptual simplicity and clarity. • Forward and concurrent (non-malleable) deniability against adversaries with arbitrary auxiliary inputs, and better privacy protection of players ’ roles. • Provable security in the Canetti-Krawczyk post-specified-peer model, and maintenance of essential security properties not captured by the Canetti-Krawczyk security model. • Compatibility with the widely deployed and standardized SIGMA (i.e., the basis of IKEv2) and (H)MQV protocols, when parties possess DL public-keys. Our protocols could potentially serve, in part, as either the underlying basis or a useful alternative for the next generation of IKE (i.e., IKEv3) of IPsec (in particular, when deniability is desired). In view of the wide deployment and use of IKE and increasing awareness of privacy protection (especially for E-commerce over Internet), this work is naturally of practical interest.

Jan 1, 20079 citations

Modeling Key Compromise Impersonation Attacks on Group Key Exchange Protocols.

M. Choudary Gorantla, Colin Boyd, Juan Manuel González Nieto

Two-party key exchange (2PKE) protocols have been rigorously analyzed under various models considering different adversarial actions. However, the analysis of group key exchange (GKE) protocols has not been as extensive as that of 2PKE protocols. Particularly, an important security attribute called key compromise impersonation (KCI) resilience has been completely ignored for the case of GKE protocols. Informally, a protocol is said to provide KCI resilience if the compromise of the long-term secret key of a protocol participant A does not allow the adversary to impersonate an honest participant B to A. In this paper, we argue that KCI resilience for GKE protocols is at least as important as it is for 2PKE protocols. Our first contribution is revised definitions of security for GKE protocols considering KCI attacks by both outsider and insider adversaries. We also give a new proof of security for an existing two-round GKE protocol under the revised security definitions assuming random oracles. We then show how to achieve insider KCIR in a generic way using a known compiler in the literature. As one may expect, this additional security assurance comes at the cost of an extra round of communication. Finally, we show that a few existing protocols are not secure against outsider KCI attacks. The attacks on these protocols illustrate the necessity of considering KCI resilience for GKE protocols.

Jan 1, 20090 citations