More realistic analyses of cryptographic protocols

Samuel M. Scott

Mhlambululi Mafu, Makhamisa Senekane

Quantum key distribution (QKD), another name for quantum cryptography, is the most advanced subfield of quantum information and communication technology (QICT). The first QKD protocol was proposed in 1984, and since then, more protocols have been proposed. It uses quantum mechanics to enable secure exchange of cryptographic keys. In order to have high confidence in the security of the QKD protocols, such protocols must be proven to be secure against any arbitrary attacks. In this chapter, we discuss and demonstrate security proofs for QKD protocols. Security analysis of QKD protocols can be categorised into two techniques, namely infinite-key and finite-key analyses. Finite-key analysis offers more realistic results than the infinite-key one, while infinite-key analysis provides more simplicity. We briefly provide the background of QKD and also define the basic notion of security in QKD protocols. The cryptographic key is shared between Alice and Bob. Since the key is random and unknown to an eavesdropper, Eve, she is unable to learn anything about the message simply by intercepting the ciphertext. This phenomenon is beyond the ability of classical information processing. We then study some tools that are used in the derivation of security proofs for the infinite- and finite-length key limits.

Richard A. DeMillo, Nancy Ann Lynch, Michael Merritt

Klaas Ole Kürtz

Cryptographic protocols are an integral part of today’s communication infrastructure, where information has to be secured on various levels. The security of cryptographic protocols has been studied for decades with numerous methods, focuses, and levels of abstraction. However, no model has been developed so far that captures the specifics of message exchange protocols that only consist of two rounds, a single client request and a subsequent server response. In this thesis, we define and analyze three protocols that offer security guarantees for two-round message exchange protocols, including authenticated message exchange (using digital signatures or passwords) as well as confidentiality (using hybrid encryption). Our protocols are generic in the sense that they can be used to securely implement any service based on two-round message exchange, because request and response can carry arbitrary payloads. Our modelings and analyses include realistic aspects characteristic to secure two-round protocols like timestamps and long-lived, but bounded server memory. All three protocols are uniformly modeled and analyzed in a simulation-based security framework, allowing us to modularize the security analyses and allowing others to build upon our protocols while utilizing the strong composability results offered by the simulation-based security notion. In addition, one of the protocols is analyzed in a concrete computational model; for this we extend the Bellare–Rogaway framework by, e. g., timestamps and payloads with signed parts. Analyzing one of the protocols in both a simulation-based and a concrete computational framework gives insights into the relation between both frameworks; we show a connection for mutual authentication protocols and point out differences for the case of secure two-round message exchange. In addition, we discuss how our goal of authenticated message exchange is related to the common security notions of message and entity authentication.

Keith M. Martin

This chapter is concerned with cryptographic protocols. We begin with an explanation of what components a cryptographic protocol consists of. We then illustrate the complexity of designing a secure cryptographic protocol by considering an artificially simple scenario, for which we propose and analyse seven candidate protocols. For each of these protocols, we comment on whether, or under which conditions, they meet the required specification. We go on to look at the important class of authentication and key establishment protocols. We identify typical goals and examine some important protocols in this class, including the Diffie–Hellman protocol.

Ling Dong, Kefei Chen