Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Journal of Communications

Correcting the security definition of the Bellare-Rogaway 3PKD model

Chun Wang

Published Jan 1, 2007• 0 citations
OpenAlex

Abstract

A flaw lied in the security definition of the Bellare-Rogaway 3PKD model,which was proposed by Bellare and Rogaway for three-party key distribution in 1995,was discovered.To reveal it,a new three-party key distribution proto-col P-Flaw was proposed.The protocol was provably secure under the Bellare-Rogaway 3PKD model.However the pro-tocol was not secure enough to withstand the server spoofing attack,known session key attack,and replay attack.The absence of the origin recognition for the distributed session key accounts for the flaw.Accordingly,the security definition of the Bellare-Rogaway 3PKD model was corrected based on matching conversation.

Related papers

Key establishment : proofs and refutations

Kim‐Kwang Raymond Choo

We study the problem of secure key establishment. We critically examine the security models of Bellare and Rogaway (1993) and Canetti and Krawczyk (2001) in the computational complexity approach, as these models are central in the understanding of the provable security paradigm. We show that the partnership definition used in the three-party key distribution (3PKD) protocol of Bellare and Rogaway (1995) is flawed, which invalidates the proof for the 3PKD protocol. We present an improved protocol with a new proof of security. We identify several variants of the key sharing requirement (i.e., two entities who have completed matching sessions, partners, are required to accept the same session key). We then present a brief discussion about the key sharing requirement. We identify several variants of the Bellare and Rogaway (1993) model. We present a comparative study of the relative strengths of security notions between the several variants of the Bellare-Rogaway model and the Canetti-Krawczyk model. In our comparative study, we reveal a drawback in the Bellare, Pointcheval, and Rogaway (2000) model with the protocol of Abdalla and Pointcheval (2005) as a case study. We prove a revised protocol of Boyd (1996) secure in the Bellare-Rogaway model. We then extend the model in order to allow more realistic adversary capabilities by incorporating the notion of resetting the long-term compromised key of some entity. This allows us to detect a known weakness of the protocol that cannot be captured in the original model. We also present an alternative protocol that is efficient in both messages and rounds. We prove the protocol secure in the extended model. We point out previously unknown flaws in several published protocols and a message authenticator of Bellare, Canetti, and Krawczyk (1998) by refuting claimed proofs of security. We also point out corresponding flaws in their existing proofs. We propose fixes to these protocols and their proofs. In some cases, we present new protocols with full proofs of security. We examine the role of session key construction in key establishment protocols, and demonstrate that a small change to the way that session keys are constructed can have significant benefits. Protocols that were proven secure in a restricted Bellare-Rogaway model can then be proven secure in the full model. We present a brief discussion on ways to construct session keys in key establishment protocols and also prove the protocol of Chen and Kudla (2003) secure in a less restrictive Bellare-Rogaway model. To complement the computational complexity approach, we provide a formal specification and machine analysis of the Bellare-Pointcheval-Rogaway model using an automated model checker, Simple Homomorphism Verification Tool (SHVT). We demonstrate that structural flaws in protocols can be revealed using our framework. We reveal previously unknown flaws in the unpublished preproceedings version of the protocol due to Jakobsson and Pointcheval (2001) and several published protocols with only heuristic security arguments. We conclude this thesis with a listing of some open problems that were encountered in the study.

•Jan 1, 2006•18 citations

On Session Identifiers in Provably Secure Protocols

Raymond Choo, Colin Boyd, Yvonne Hitchcock +1 more

We examine the role of session identifiers (SIDs) in security proofs for key establishment protocols. After reviewing the practical importance of SIDs we use as a case study the three-party server-based key distribution (3PKD) protocol of Bellare and Rogaway, proven secure in 1995. We show incidentally that the partnership function used in the existing security proof is flawed. There seems to be no way to define a SID for the 3PKD protocol that will preserve the proof of security. A small change to the protocol allows a natural definition for a SID and we prove that the new protocol is secure using this SID to define partnering.

•Jan 1, 2004•14 citations

On Session Identifiers in Provably Secure Protocols: The Bellare-Rogaway Three-Party Key Distribution Protocol Revisited

Kim‐Kwang Raymond Choo, Colin Boyd, Yvonne Hitchcock +1 more

Lecture notes in computer science•Jan 1, 2004•12 citations

An Analysis of Group Key Agreement Schemes based on the Bellare-Rogaway Model in Multi-party Setting

Meng-Hui Lim, Bok‐Min Goi, Sang Gon Lee

Group key agreement protocols derive a shared secret key for a group of users to ensure data confidentiality or/and integrity among the users in the subsequent communications.In this paper, we inspect two group key agreement schemes which have been proposed by Shi et al. and Zheng et al. in 2005 and 2007 respectively.Although both schemes were claimed to be secure in a heuristic way, we reveal several flaws using the Bellare-Rogaway security model extended to multi-party setting by Bresson et al.These flaws are found to be originated from inappropriate selection of key derivation function, inadvertent exclusion of partners' identities from the protocol specification and insufficient consideration in preserving known temporary information security and key freshness properties.Furthermore, we suggest and discuss proper countermeasures to address such flaws.

KSII Transactions on Internet and Information Systems•Jan 1, 2011•11 citations

Authenticated Session Key Distribution Protocol with Zero-Knowledge

Chungen Xu, Yan Yang, Bennian Dou

Authenticated session key distribution protocol is an important cryptographic technique in the secure communication areas. We present a new method for the authenticated exchange of messages in the three-party case, and abandon the idea of authentication which was finished with encryption and decryption in the Bellare-Rogaway model. Instead, the non-interactive zero-knowledge is applied to our protocol. We give an illumination for some important properties of security and depict a feasible idea of provably security with zero-knowledge.

Applied Mechanics and Materials•Dec 6, 2010•0 citations

Pairing-Based Two-Party Authenticated Key Agreement Protocol.

Rongxing Lu, Zhenfu Cao, Renwang Su +1 more

Abstract. To achieve secure data communications, two parties should be authenticated by each other and agree on a secret session key by exchanging messages over an insecure channel. In this paper, based on the bilinear pairing, we present a new two-party authenticated key agreement protocol, and use the techniques from provable security to examine the security of our protocol within Bellare-Rogaway model. 1

•Jan 1, 2005•6 citations
A flaw lied in the security definition of the Bellare-Rogaway 3PKD model,which was proposed by Bellare and Rogaway for three-party key distribution in 1995,was discovered.To reveal it,a new three-party key distribution proto-col P-Flaw was proposed.The protocol was provably secure under the Bellare-Rogaway 3PKD model.However the pro-tocol was not secure enough to withstand the server spoofing attack,known session key attack,and replay attack.The absence of the origin recognition for the distributed session key accounts for the flaw.Accordingly,the security definition of the Bellare-Rogaway 3PKD model was corrected based on matching conversation.
We study the problem of secure key establishment. We critically examine the security models of Bellare and Rogaway (1993) and Canetti and Krawczyk (2001) in the computational complexity approach, as these models are central in the understanding of the provable security paradigm. We show that the partnership definition used in the three-party key distribution (3PKD) protocol of Bellare and Rogaway (1995) is flawed, which invalidates the proof for the 3PKD protocol. We present an improved protocol with a new proof of security. We identify several variants of the key sharing requirement (i.e., two entities who have completed matching sessions, partners, are required to accept the same session key). We then present a brief discussion about the key sharing requirement. We identify several variants of the Bellare and Rogaway (1993) model. We present a comparative study of the relative strengths of security notions between the several variants of the Bellare-Rogaway model and the Canetti-Krawczyk model. In our comparative study, we reveal a drawback in the Bellare, Pointcheval, and Rogaway (2000) model with the protocol of Abdalla and Pointcheval (2005) as a case study. We prove a revised protocol of Boyd (1996) secure in the Bellare-Rogaway model. We then extend the model in order to allow more realistic adversary capabilities by incorporating the notion of resetting the long-term compromised key of some entity. This allows us to detect a known weakness of the protocol that cannot be captured in the original model. We also present an alternative protocol that is efficient in both messages and rounds. We prove the protocol secure in the extended model. We point out previously unknown flaws in several published protocols and a message authenticator of Bellare, Canetti, and Krawczyk (1998) by refuting claimed proofs of security. We also point out corresponding flaws in their existing proofs. We propose fixes to these protocols and their proofs. In some cases, we present new protocols with full proofs of security. We examine the role of session key construction in key establishment protocols, and demonstrate that a small change to the way that session keys are constructed can have significant benefits. Protocols that were proven secure in a restricted Bellare-Rogaway model can then be proven secure in the full model. We present a brief discussion on ways to construct session keys in key establishment protocols and also prove the protocol of Chen and Kudla (2003) secure in a less restrictive Bellare-Rogaway model. To complement the computational complexity approach, we provide a formal specification and machine analysis of the Bellare-Pointcheval-Rogaway model using an automated model checker, Simple Homomorphism Verification Tool (SHVT). We demonstrate that structural flaws in protocols can be revealed using our framework. We reveal previously unknown flaws in the unpublished preproceedings version of the protocol due to Jakobsson and Pointcheval (2001) and several published protocols with only heuristic security arguments. We conclude this thesis with a listing of some open problems that were encountered in the study.
We examine the role of session identifiers (SIDs) in security proofs for key establishment protocols. After reviewing the practical importance of SIDs we use as a case study the three-party server-based key distribution (3PKD) protocol of Bellare and Rogaway, proven secure in 1995. We show incidentally that the partnership function used in the existing security proof is flawed. There seems to be no way to define a SID for the 3PKD protocol that will preserve the proof of security. A small change to the protocol allows a natural definition for a SID and we prove that the new protocol is secure using this SID to define partnering.
Group key agreement protocols derive a shared secret key for a group of users to ensure data confidentiality or/and integrity among the users in the subsequent communications.In this paper, we inspect two group key agreement schemes which have been proposed by Shi et al. and Zheng et al. in 2005 and 2007 respectively.Although both schemes were claimed to be secure in a heuristic way, we reveal several flaws using the Bellare-Rogaway security model extended to multi-party setting by Bresson et al.These flaws are found to be originated from inappropriate selection of key derivation function, inadvertent exclusion of partners' identities from the protocol specification and insufficient consideration in preserving known temporary information security and key freshness properties.Furthermore, we suggest and discuss proper countermeasures to address such flaws.
Authenticated session key distribution protocol is an important cryptographic technique in the secure communication areas. We present a new method for the authenticated exchange of messages in the three-party case, and abandon the idea of authentication which was finished with encryption and decryption in the Bellare-Rogaway model. Instead, the non-interactive zero-knowledge is applied to our protocol. We give an illumination for some important properties of security and depict a feasible idea of provably security with zero-knowledge.