We introduce the concept of Affiliation-Hiding Authenticated Asymmetric Group Key Agreement (AH-AAGKA) and construct a concrete one-round AH-AAGKA protocol. An AH-AAGKA protocol allows the participants of a group to establish a common encryption key associated with several decryption keys; each of which can only be computed by the corresponding legitimate group member. An AH-AAGKA protocol has the following privacy feature. For a member 𝒰i of a group G, if 𝒰i participates in an AH-AAGKA protocol, any protocol participant 𝒰j cannot learn whether 𝒰i is a member of G, unless 𝒰j himself is a member of group G. Our scheme demonstrates new features in comparison with other existing AH-AGKA protocols. If non-group members participate in our protocol, honest parties can identify these non-group members. Our scheme also captures Unlinkability and Perfect Forward Secrecy (PFS), which are missing in other existing schemes. We propose a novel security model to prove that our protocol holds PFS and present a new privacy model to prove that our scheme meets Affiliation-Hiding property.
We introduce the concept of Affiliation-Hiding Authenticated Asymmetric Group Key Agreement (AH-AAGKA) and construct a concrete one-round AH-AAGKA protocol. An AH-AAGKA protocol allows the participants of a group to establish a common encryption key associated with several decryption keys; each of which can only be computed by the corresponding legitimate group member. An AH-AAGKA protocol has the following privacy feature. For a member 𝒰i of a group G, if 𝒰i participates in an AH-AAGKA protocol, any protocol participant 𝒰j cannot learn whether 𝒰i is a member of G, unless 𝒰j himself is a member of group G. Our scheme demonstrates new features in comparison with other existing AH-AGKA protocols. If non-group members participate in our protocol, honest parties can identify these non-group members. Our scheme also captures Unlinkability and Perfect Forward Secrecy (PFS), which are missing in other existing schemes. We propose a novel security model to prove that our protocol holds PFS and present a new privacy model to prove that our scheme meets Affiliation-Hiding property.
Affiliation-Hiding Authenticated Asymmetric Group Key Agreement (AH-AAGKA) protocol can be utilized by the members of a group to authenticate each other secretly. The participants affiliated to the group can execute the AH-AAGKA protocol to establish a common encryption key. Any legitimate participant can compute its own decryption key corresponding to the encryption key. Particularly, every legitimate player's affiliation information is only revealed to other legitimate players. In this paper, we present a one-round AH-AAGKA protocol. Compared with previous work, in our protocol, Group Authority (GA) does not need to be fully trusted (we call it semi-trusted). Therefore, GA cannot impersonate any honest user to execute the protocol. Meanwhile, GA can trace group members through analyzing the communication flows. Our protocol holds the affiliation-hiding property and detectability. Additionally, our scheme exhibits Perfect Forward Secrecy for both GA and outside attackers.
The notion of Affiliation-Hiding Authenticated Group Key Agreement (AH-AGKA) protocols was first introduced by Jarecki et al. in CT-RSA 2007, where they presented two concrete AH-AGKA protocols. In this paper, we show that Jarecki et al.'s second protocol has some drawbacks. We propose a new affiliation-hiding protocol. Differing from Jarecki et al.'s protocol, our protocol is asymmetric. Compared with existing AH-AGKA protocols, our scheme not only exhibits the affiliation-hiding property, but also holds the properties of detectability and perfect forward secrecy.
Abstract. Privacy concerns in many aspects of electronic communication trigger the need to re-examine – with privacy in mind – familiar security services, such as authentication and key agreement. An Affiliation-Hiding Group Key Agreement (AH-AGKA) protocol (also known as Group Secret Handshake) allows a set of participants, each with a certificate issued by the same authority, to establish a common authenticated secret key. In contrast to standard AGKA protocols, an AH-AGKA protocol has the following privacy feature: If Alice, who is a member of a group G, participates in an AH-AGKA protocol, none of the other protocol participants learn whether Alice is a member of G, unless these participants are themselves members of group G. Such protocols are useful in suspicious settings where a set of members of a (perhaps secret) group need to authenticate each other and agree on a common secret key, without revealing their affiliations to outsiders. In this paper we strengthen the prior definition of AH-AGKA so that the security and privacy properties are maintained under any composition of protocol instances. We also construct two novel AH-AGKA protocols secure in this new and stronger model under the RSA and Gap Diffie-Hellman assumptions, respectively. Each protocol involves only two communication rounds and few exponentiations per player (e.g., no bilinear map operations). Interestingly, these costs are essentially the same as those of the underlying (unauthenticated) group key agreement protocol. Finally, our protocols, unlike prior results, retain their security and privacy properties without the use of one-time certificates.
The last decade has witnessed a sharp spike in the popularity of group applications, such as multi-media conferencing, collaborative workspaces, as well as dynamic coalitions common in law enforcement and disaster rescue scenarios. Standard security services required in such group settings (such as confidentiality, integrity and authentication) can be efficiently achieved if all group members share a secret key. A group key agreement protocol (GKA) provide a technique for any set of participating players to collaboratively establish a shared key.
In this thesis, we tackle two challenging issues in GKA: robustness and privacy-preserving authentication. Robustness improves performance by guaranteeing completion of GKA protocols despite participating player or communication failures. Affiliation-hiding authenticated GKA prevents from man-in-the-middle-attacks by authenticating players in a privacy-preserving manner.
We propose a two-round group key agreement protocol, which offers a natural trade-off between message size and the desired level of fault-tolerance. We demonstrate that in a realistic setting of random player faults, the new protocol has logarithmic-sized messages and expected round complexity close to two. We generalize a robust group key agreement protocol to support heterogeneous players for a general environment. We prove the security of the proposed protocols under the standard cryptographic assumptions.
We present the formal definition of the affiliation-hiding GKA in a standard PKI model with re-usable certificates. The model includes strong security properties, called perfect forward secrecy (PFS) and linkable affiliation-hiding (LAH)—that an key agreement protocol might provide in the face of player corruptions and session compromises. We construct two variants of optimal-cost AH-AGKA protocols, which satisfy PFS and LAH notions under the standard cryptographic assumptions in the random oracle model. The protocol yields minimal costs: three rounds of interaction matches the round complexity of non-private PFS authenticated GKA and its computation costs are comparable to the cost of unauthenticated GKA.
Abstract. In identity-based public-key cryptography, an entity’s public key can be easily derived from its identity. The direct derivation of public keys in identity-based public-key cryptography eliminates the need for certificates and solves certain public key management problems in traditional public-key cryptosystems. Recently, the notion of asymmetric group key agreement was introduced, in which the group members merely negotiate a common encryption key which is accessible to any entity, but they hold respective secret decryption keys. In this paper, we first propose a security model for identity-based authenticated asymmetric group key agreement (IB-AAGKA) protocols. We then propose an IB-AAGKA protocol which is proven secure under the Bilinear Diffie-Hellman Exponent assumption. Our protocol is also efficient, and readily adaptable to provide broadcast encryption.