Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Malicious Participants in Group Key Exchange: Key Control and Contributiveness in the Shadow of Trust (Extended Abstract)

Emmanuel Bresson, Mark Manulis

Published Jan 1, 2007• 0 citations
OpenAlex

Abstract

Group key exchange protocols allow their participants to compute a secret key which can be used to ensure security and privacy for various multi- party applications. The resulting group key should be computed through coop- eration of all protocol participants such that none of them is trusted to have any advantage concerning the protocol's output. This trust relationship states the main difference between group key exchange and group key transport protocols. Obvi- ously, misbehaving participants in group key exchange protocols may try to influ- ence the resulting group key, thereby disrupting this trust relationship, and also causing further security threats. This paper analyzes the currently known secu- rity models for group key exchange protocols with respect to this kind of attacks by malicious participants and proposes an extended model to remove the identi- fied limitations. Additionally, it proposes an efficient and provably secure generic solution, a compiler, to guarantee these additional security goals for group keys exchanged in the presence of malicious participants.

Related papers

Contributory group key exchange in the presence of malicious participants

Emmanuel Bresson, Mark Manulis

In a group key exchange (GKE) protocol, the resulting group key should be computed by all participants such that none of them can gain any advantage concerning the protocol's output: misbehaving participants might have personal advantage in influencing the value of the group key. In fact, the absence of trust relationship is the main feature of GKE (when compared with group key transport) protocols. The existing notions of security are enlarged by identifying limitations in some previously proposed security models while taking into account different types of corruptions (weak and strong). To illustrate these notions, two efficient and provably secure generic solutions, compilers, are presented.

IET Information Security•Aug 30, 2008•23 citations

Modeling insider attacks on group key-exchange protocols

Jonathan I. Katz, Ji Sun Shin

Protocols for authenticated key exchange (AKE) allow parties within an insecure network to establish a common session key which can then be used to secure their future communication. It is fair to say that group AKE is currently less well understood than the case of two-party AKE; in particular, attacks by malicious insiders --- a concern specific to the group setting --- have so far been considered only in a relatively "ad-hoc" fashion. The main contribution of this work is to address this deficiency by providing a formal, comprehensive model and definition of security for group AKE which automatically encompasses insider attacks. We do so by defining an appropriate ideal functionality for group AKE within the universal composability (UC) framework. As a side benefit, any protocol secure with respect to our definition is secure even when run concurrently with other protocols, and the key generated by any such protocol may be used securely in any subsequent application.In addition to proposing this definition, we show that the resulting notion of security is strictly stronger than the one proposed by Bresson, et al. (termed "AKE-security"), and that our definition implies all previously-suggested notions of security against insider attacks. We also show a simple technique for converting any AKE-secure protocol into one secure with respect to our definition.

ACM SIGSAC Conference on Computer and Communications Security (CCS)•Nov 7, 2005•184 citations

Provably Secure Group Key Exchange

Mark Manulis

The rapid and promising development of applications and communication systems designed for groups of participants like groupware, computer supported collaborative work systems, or digital conference systems implies exigence of mechanisms providing adequate security properties. These mechanisms can be designed based on the foundations of cryptography. Group key exchange protocols are multi-party cryptographic protocols those participants compute a shared secret key that can then be used in conjunction with other cryptographic constructions like encryption schemes and message authentication codes for the purpose of privacy, confidentiality and authentication. Security confidence of modern cryptographic constructions can be increased via adequate security proofs. The paradigm of provable security gains in importance for all kinds of cryptographic constructions, including group key exchange protocols those security issues represent the scope of this dissertation. We give an analytical overview of the state-of-the-art research in this area and identify strengths and weaknesses of many previous approaches. We suggest a new approach in form of a security model those stronger definitions provide background for more confident security analyzes and proofs. Additionally, we present a number of generic solutions (compilers) that can be applied to independently designed group key exchange protocols in order to enhance security thereof with respect to various goals considered by our security model. Finally, we present a concrete group key exchange protocol that provably satisfies the apparently strongest currently available formally specified security requirements. Abstract (in German)in German) Die schnelle und vielversprechende Entwicklung der fur Gruppen von Teilnehmern konzipierten Anwendungen und Kommunikationssysteme, wie z.B. Groupware, Systeme fur die computergestutzte Gruppenarbeit oder digitale Konferenzsysteme, schafft die Notwendigkeit von Mechanismen zur Gewahrleistung ausreichender Sicherheitseigenschaften. Der Entwurf dieser Mechanismen basiert grostenteils auf den Grundlagen der Kryptografie. Gruppen-SchlusselAustauschprotokolle (engl. group key exchange protocols) sind kryptografische MehrparteienProtokolle, die es den Teilnehmern ermoglichen, sich auf einen gemeinsamen geheimen Schlussel zu einigen, der in Verbindung mit weiteren kryptografischen Verfahren, wie z.B. Verschlusselungsund Nachrichtenauthentisierungsverfahren, fur die Geheimhaltung, Vertraulichkeit und Authentisierung eingesetzt werden kann. Das Vertrauen in die Sicherheit der modernen kryptografischen Verfahren kann heutzutage nur mittels eines ausreichenden Sicherheitsbeweises erzielt werden. Das Paradigma der beweisbaren Sicherheit gewinnt immer mehr an Bedeutung fur alle kryptografischen Verfahren, einschlieslich der Gruppen-Schlussel-Austauschprotokollen, deren Sicherheitsaspekte den Hauptbestandteil dieser Dissertation darstellen. Wir geben einen analytischen Uberblick uber den aktuellen Stand der Forschung in diesem Bereich und heben Starken und Schwachen vieler bekannter Ansatze hervor. Ausgehend von den durchgefuhrten Analysen und gefundenen Mangeln der vorhandenen Ansatze und Verfahren schlagen wir einen neuen Ansatz vor, in Form eines Sicherheitsmodells fur Gruppen-SchlusselAustauschprotokolle, das weitaus starkere Sicherheitsanforderungen umfasst und die Basis fur tiefere Sicherheitsanalysen und Beweise bereit stellt. Zusatzlich, stellen wir eine Reihe von allgemeinen Losungen zur Verbesserung der Sicherheit (im Rahmen unseres Modells) von unabhangig konzipierten Gruppen-Schlussel-Austauschprotokollen vor. Abschliesend beschreiben wir ein neues Gruppen-Schlussel-Austauschprotokoll, dessen beweisbare Sicherheit den derzeit starksten formalen Anforderungen entspricht.

Open Research (University of Surrey)•Aug 1, 2007•17 citations

On Security Models and Compilers for Group Key Exchange Protocols.

Emmanuel Bresson, Mark Manulis, Jörg Schwenk

Abstract. Group key exchange (GKE) protocols can be used to guarantee confidentiality and group authentication formalization (security model) that considers the environment of the protocol and identifies its security goals. The first security model for GKE protocols was proposed by Bresson, Chevassut, Pointcheval, and Quisquater in 2001, and has been subsequently applied in many security proofs. Their definitions of AKE- and MA-security became meanwhile standard. In this paper we analyze the BCPQ model and some of its later appeared modifications and identify several security risks resulting from the technical construction of this model – the notion of partnering. Consequently, we propose a revised model with extended definitions for AKE- and MA-security capturing, in addition, attacks of malicious protocol participants. Further, we analyze some well-known generic solutions (compilers) for AKE- and MA-security of GKE protocols proposed based on the definitions of the BCPQ model and its variants and identify several limitations resulting from the underlying assumptions. In order to remove these limitations and at the same time to show that our revised security model is in fact practical enough for the construction of reductionist security proofs we describe a modified compiler which provides AKE- and MA-security for any GKE protocol, under standard cryptographic assumptions. Key words: Group key exchange, extended security model, malicious participants, compiler for AKE- and

Open Research (University of Surrey)•Jan 1, 2006•0 citations

Malicious Participants in Group Key Exchange: Key Control and Contributiveness in the Shadow of Trust

Emmanuel Bresson, Mark Manulis

Lecture notes in computer science•Aug 11, 2007•31 citations

Provably secure authenticated group Diffie-Hellman key exchange

Emmanuel Bresson, Olivier Chevassut, David Pointcheval

Authenticated key-exchange protocols allow two participants A and B , communicating over a public network and each holding an authentication means to exchange a shared secret value. Methods designed to deal with this cryptographic problem ensure A (resp. B ) that no other participants aside from B (resp. A ) can learn any information about the agreed value and often also ensure A and B that their respective partner has actually computed this value. A natural extension to this cryptographic method is to consider a pool of participants exchanging a shared secret value and to provide a formal treatment for it. Starting from the famous two-party Diffie--Hellman (DH) key-exchange protocol and from its authenticated variants, security experts have extended it to the multiparty setting for over a decade and, in the past few years, completed a formal analysis in the framework of modern cryptography. The present paper synthesizes this body of work on the provably-secure authenticated group DH key exchange.

ACM Transactions on Information and System Security•Jul 1, 2007•88 citations
Group key exchange protocols allow their participants to compute a secret key which can be used to ensure security and privacy for various multi- party applications. The resulting group key should be computed through coop- eration of all protocol participants such that none of them is trusted to have any advantage concerning the protocol's output. This trust relationship states the main difference between group key exchange and group key transport protocols. Obvi- ously, misbehaving participants in group key exchange protocols may try to influ- ence the resulting group key, thereby disrupting this trust relationship, and also causing further security threats. This paper analyzes the currently known secu- rity models for group key exchange protocols with respect to this kind of attacks by malicious participants and proposes an extended model to remove the identi- fied limitations. Additionally, it proposes an efficient and provably secure generic solution, a compiler, to guarantee these additional security goals for group keys exchanged in the presence of malicious participants.
In a group key exchange (GKE) protocol, the resulting group key should be computed by all participants such that none of them can gain any advantage concerning the protocol's output: misbehaving participants might have personal advantage in influencing the value of the group key. In fact, the absence of trust relationship is the main feature of GKE (when compared with group key transport) protocols. The existing notions of security are enlarged by identifying limitations in some previously proposed security models while taking into account different types of corruptions (weak and strong). To illustrate these notions, two efficient and provably secure generic solutions, compilers, are presented.
Protocols for authenticated key exchange (AKE) allow parties within an insecure network to establish a common session key which can then be used to secure their future communication. It is fair to say that group AKE is currently less well understood than the case of two-party AKE; in particular, attacks by malicious insiders --- a concern specific to the group setting --- have so far been considered only in a relatively "ad-hoc" fashion. The main contribution of this work is to address this deficiency by providing a formal, comprehensive model and definition of security for group AKE which automatically encompasses insider attacks. We do so by defining an appropriate ideal functionality for group AKE within the universal composability (UC) framework. As a side benefit, any protocol secure with respect to our definition is secure even when run concurrently with other protocols, and the key generated by any such protocol may be used securely in any subsequent application.In addition to proposing this definition, we show that the resulting notion of security is strictly stronger than the one proposed by Bresson, et al. (termed "AKE-security"), and that our definition implies all previously-suggested notions of security against insider attacks. We also show a simple technique for converting any AKE-secure protocol into one secure with respect to our definition.
The rapid and promising development of applications and communication systems designed for groups of participants like groupware, computer supported collaborative work systems, or digital conference systems implies exigence of mechanisms providing adequate security properties. These mechanisms can be designed based on the foundations of cryptography. Group key exchange protocols are multi-party cryptographic protocols those participants compute a shared secret key that can then be used in conjunction with other cryptographic constructions like encryption schemes and message authentication codes for the purpose of privacy, confidentiality and authentication. Security confidence of modern cryptographic constructions can be increased via adequate security proofs. The paradigm of provable security gains in importance for all kinds of cryptographic constructions, including group key exchange protocols those security issues represent the scope of this dissertation. We give an analytical overview of the state-of-the-art research in this area and identify strengths and weaknesses of many previous approaches. We suggest a new approach in form of a security model those stronger definitions provide background for more confident security analyzes and proofs. Additionally, we present a number of generic solutions (compilers) that can be applied to independently designed group key exchange protocols in order to enhance security thereof with respect to various goals considered by our security model. Finally, we present a concrete group key exchange protocol that provably satisfies the apparently strongest currently available formally specified security requirements. Abstract (in German)in German) Die schnelle und vielversprechende Entwicklung der fur Gruppen von Teilnehmern konzipierten Anwendungen und Kommunikationssysteme, wie z.B. Groupware, Systeme fur die computergestutzte Gruppenarbeit oder digitale Konferenzsysteme, schafft die Notwendigkeit von Mechanismen zur Gewahrleistung ausreichender Sicherheitseigenschaften. Der Entwurf dieser Mechanismen basiert grostenteils auf den Grundlagen der Kryptografie. Gruppen-SchlusselAustauschprotokolle (engl. group key exchange protocols) sind kryptografische MehrparteienProtokolle, die es den Teilnehmern ermoglichen, sich auf einen gemeinsamen geheimen Schlussel zu einigen, der in Verbindung mit weiteren kryptografischen Verfahren, wie z.B. Verschlusselungsund Nachrichtenauthentisierungsverfahren, fur die Geheimhaltung, Vertraulichkeit und Authentisierung eingesetzt werden kann. Das Vertrauen in die Sicherheit der modernen kryptografischen Verfahren kann heutzutage nur mittels eines ausreichenden Sicherheitsbeweises erzielt werden. Das Paradigma der beweisbaren Sicherheit gewinnt immer mehr an Bedeutung fur alle kryptografischen Verfahren, einschlieslich der Gruppen-Schlussel-Austauschprotokollen, deren Sicherheitsaspekte den Hauptbestandteil dieser Dissertation darstellen. Wir geben einen analytischen Uberblick uber den aktuellen Stand der Forschung in diesem Bereich und heben Starken und Schwachen vieler bekannter Ansatze hervor. Ausgehend von den durchgefuhrten Analysen und gefundenen Mangeln der vorhandenen Ansatze und Verfahren schlagen wir einen neuen Ansatz vor, in Form eines Sicherheitsmodells fur Gruppen-SchlusselAustauschprotokolle, das weitaus starkere Sicherheitsanforderungen umfasst und die Basis fur tiefere Sicherheitsanalysen und Beweise bereit stellt. Zusatzlich, stellen wir eine Reihe von allgemeinen Losungen zur Verbesserung der Sicherheit (im Rahmen unseres Modells) von unabhangig konzipierten Gruppen-Schlussel-Austauschprotokollen vor. Abschliesend beschreiben wir ein neues Gruppen-Schlussel-Austauschprotokoll, dessen beweisbare Sicherheit den derzeit starksten formalen Anforderungen entspricht.
Abstract. Group key exchange (GKE) protocols can be used to guarantee confidentiality and group authentication formalization (security model) that considers the environment of the protocol and identifies its security goals. The first security model for GKE protocols was proposed by Bresson, Chevassut, Pointcheval, and Quisquater in 2001, and has been subsequently applied in many security proofs. Their definitions of AKE- and MA-security became meanwhile standard. In this paper we analyze the BCPQ model and some of its later appeared modifications and identify several security risks resulting from the technical construction of this model – the notion of partnering. Consequently, we propose a revised model with extended definitions for AKE- and MA-security capturing, in addition, attacks of malicious protocol participants. Further, we analyze some well-known generic solutions (compilers) for AKE- and MA-security of GKE protocols proposed based on the definitions of the BCPQ model and its variants and identify several limitations resulting from the underlying assumptions. In order to remove these limitations and at the same time to show that our revised security model is in fact practical enough for the construction of reductionist security proofs we describe a modified compiler which provides AKE- and MA-security for any GKE protocol, under standard cryptographic assumptions. Key words: Group key exchange, extended security model, malicious participants, compiler for AKE- and
Authenticated key-exchange protocols allow two participants A and B , communicating over a public network and each holding an authentication means to exchange a shared secret value. Methods designed to deal with this cryptographic problem ensure A (resp. B ) that no other participants aside from B (resp. A ) can learn any information about the agreed value and often also ensure A and B that their respective partner has actually computed this value. A natural extension to this cryptographic method is to consider a pool of participants exchanging a shared secret value and to provide a formal treatment for it. Starting from the famous two-party Diffie--Hellman (DH) key-exchange protocol and from its authenticated variants, security experts have extended it to the multiparty setting for over a decade and, in the past few years, completed a formal analysis in the framework of modern cryptography. The present paper synthesizes this body of work on the provably-secure authenticated group DH key exchange.