© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

Bilateral Unknown Key-Share Attacks in Key Agreement Protocols

Liqun Chen, Qiang Tang

Published Apr 7, 2020• 8 citations

Abstract

Abstract: Unknown Key-Share (UKS) resilience is a basic security attribute in authenticated key agreement protocols. In this paper we revisit the definitions of this attribute and the method of proving this attribute under the Bellare-Rogaway (BR) model in the literature. We propose a new type of UKS attack, which coerces two entities A and B into sharing a key with each other but in fact A thinks that he is sharing the key with another entity C and B thinks that he is sharing the key with another entity D, whereCand D might or might not be the same entity. We call this attack a Bilateral Unknown Key-Share (BUKS) attack. We demonstrate that a few well-known authenticated key agreement protocols are vulnerable to this attack. We then explore a gap between the conventional BR-type proof and a BUKS adversary’s behavior, and extend the BR model to cover the BUKS resilience attribute. At the end of the paper, we provide a general countermeasure and its security proof under the extended model and the assumption that a collision-resistance function exists.

DOI: 10.3217/jucs-014-03-0416

Related papers

Revisit of McCullagh-Barreto Two-Party ID-Based Authenticated Key Agreement Protocols

Kim‐Kwang Raymond Choo

We revisit the two-party identity-based authenticated key agreement protocol (2P-IDAKA) and its variant resistant to key-compromise impersonation due to McCullagh & Barreto (2005). Protocol 2P-IDAKA carries a proof of security in the Bellare & Rogaway (1993) model. In this paper, we demonstrated why both the protocol and its variant are not secure if the adversary is allowed to send a Reveal query to reveal non-partner players who had accepted the same session key (i.e., termed key-replicating attack in recent work of Krawczyk (2005)). We also demonstrate that both protocols do not achieve the key integrity property, first discussed by Janson & Tsudik (1995).

International journal of network security•Nov 1, 2005•29 citations

Revisit Of McCullagh-Barreto Two-Party ID-Based Authenticated Key Agreement Protocols.

Kim‐Kwang Raymond Choo

The recently proposed two-party ID-based authenticated key agreement protocols (with and without escrow) and its variant resistant to key-compromise impersonation by McCullagh & Barreto are revisited. The protocol carries a proof of security in the Bellare & Rogaway (1993) model. In this paper, it is demonstrated that the protocols and its variant are not secure if the adversary is allowed to send a Reveal query to reveal non-partner players who had accepted the same session key.

•Jan 1, 2004•3 citations

Cryptanalysis of ID-based Authenticated Key Agreement Protocol

Renwang Su

Authenticated key agreement is an important original language of cryptology.This paper analyzes an ID-based authenticated key agreement protocol,carries a proof of security in the Bellare-Rogaway-93 model,pointes out the protocol is insecure if the adversary is allowed to send a Reveal query.Researches show that the protocol can not resist the key compromise impersonation attack.

Jisuanji gongcheng•Jan 1, 2008•0 citations

On Security Proof of McCullagh-Barreto's Key Agreement Protocol and its Variants.

Zhaohui Cheng, Liqun Chen

McCullagh and Barreto presented an identity-based authenticated key agreement protocol in CT-RSA 2005. Their protocol was found to be vulnerable to a key-compromise impersonation attack. In order to recover the weakness, McCullagh and Barreto, and Xie proposed two variants of the protocol respectively. In each of these works, a security proof of the proposed protocol was presented. In this paper, we revisit these three security proofs and show that all the reductions in these proofs are invalid, because the property of indistinguishability between their simulation and the real world was not held. As a replacement, we slightly modify the McCullagh and Barreto’s second protocol and then formally analyse the security of the modified scheme in the Bellare-Rogaway key agreement model.

•Jan 1, 2005•12 citations

Key Replicating Attack on an Identity-Based Three-Party Authenticated Key Agreement Protocol

Wei Yuan, Liang Qing Hu, Hongtu Li +3 more

In 2009, Mengbo Hou and Qiuliang Xu found the key replicating attack in the BR93 security model on a Certificateless two-party authenticated key agreement protocol proposed by Y.J Shi and J.H Li. In 2010, Marko Hölbl, Tatjana Welzer and Boštjan Brumen proposed a one-round identity-based three-party authenticated key agreement protocol using pairings called IDAK3-P1 and declared that the protocol had the attributes of known-key security, forward secrecy, key-compromise impersonation resilience, unknown key-share resilience and key control. In this paper, we make a systematic analysis on IDAK3-P1 and find it has similar structure as the Y.J Shi and J.H Li's protocol. We introduce Mengbo Hou and Qiuliang Xu's attack method in identifying the vulnerability of IDAK3-P1. Our analysis shows that the IDAK3-P1 is vulnerable to the key replicating attack in the BR model. Therefore, it doesn't possess the security attributes of implicit key authentication and key control as declared.

International Conference on Network Computing and Information Security•May 1, 2011•2 citations

On The Indistinguishability-Based Security Model of Key Agreement Protocols-Simple Cases.

Zhaohui Cheng, Manos Nistazakis, Richard Comley +1 more

Since Bellare and Rogaway's work in 1994, the indistinguishability-based security models of authenticated key agreement protocols in simple cases have been evolving for more than ten years. In this paper, we review and organize the models under a unified framework with some new extensions. By providing a new ability (the Coin query) to adversaries and redefining two key security notions, the framework fully exploits an adversary's capacity and can be used to prove all the commonly required security attributes of key agreement protocols with key confirmation. At the same time, the Coin query is also used to define a model which can be used to heuristically evaluate the security of a large category of authenticated protocols without key confirmation. We use the models to analyze a few identity-based authenticated key agreement protocols with pairings.

•Jan 1, 2005•87 citations

Abstract: Unknown Key-Share (UKS) resilience is a basic security attribute in authenticated key agreement protocols. In this paper we revisit the definitions of this attribute and the method of proving this attribute under the Bellare-Rogaway (BR) model in the literature. We propose a new type of UKS attack, which coerces two entities A and B into sharing a key with each other but in fact A thinks that he is sharing the key with another entity C and B thinks that he is sharing the key with another entity D, whereCand D might or might not be the same entity. We call this attack a Bilateral Unknown Key-Share (BUKS) attack. We demonstrate that a few well-known authenticated key agreement protocols are vulnerable to this attack. We then explore a gap between the conventional BR-type proof and a BUKS adversary’s behavior, and extend the BR model to cover the BUKS resilience attribute. At the end of the paper, we provide a general countermeasure and its security proof under the extended model and the assumption that a collision-resistance function exists.

We revisit the two-party identity-based authenticated key agreement protocol (2P-IDAKA) and its variant resistant to key-compromise impersonation due to McCullagh & Barreto (2005). Protocol 2P-IDAKA carries a proof of security in the Bellare & Rogaway (1993) model. In this paper, we demonstrated why both the protocol and its variant are not secure if the adversary is allowed to send a Reveal query to reveal non-partner players who had accepted the same session key (i.e., termed key-replicating attack in recent work of Krawczyk (2005)). We also demonstrate that both protocols do not achieve the key integrity property, first discussed by Janson & Tsudik (1995).

McCullagh and Barreto presented an identity-based authenticated key agreement protocol in CT-RSA 2005. Their protocol was found to be vulnerable to a key-compromise impersonation attack. In order to recover the weakness, McCullagh and Barreto, and Xie proposed two variants of the protocol respectively. In each of these works, a security proof of the proposed protocol was presented. In this paper, we revisit these three security proofs and show that all the reductions in these proofs are invalid, because the property of indistinguishability between their simulation and the real world was not held. As a replacement, we slightly modify the McCullagh and Barreto’s second protocol and then formally analyse the security of the modified scheme in the Bellare-Rogaway key agreement model.

In 2009, Mengbo Hou and Qiuliang Xu found the key replicating attack in the BR93 security model on a Certificateless two-party authenticated key agreement protocol proposed by Y.J Shi and J.H Li. In 2010, Marko Hölbl, Tatjana Welzer and Boštjan Brumen proposed a one-round identity-based three-party authenticated key agreement protocol using pairings called IDAK3-P1 and declared that the protocol had the attributes of known-key security, forward secrecy, key-compromise impersonation resilience, unknown key-share resilience and key control. In this paper, we make a systematic analysis on IDAK3-P1 and find it has similar structure as the Y.J Shi and J.H Li's protocol. We introduce Mengbo Hou and Qiuliang Xu's attack method in identifying the vulnerability of IDAK3-P1. Our analysis shows that the IDAK3-P1 is vulnerable to the key replicating attack in the BR model. Therefore, it doesn't possess the security attributes of implicit key authentication and key control as declared.

Since Bellare and Rogaway's work in 1994, the indistinguishability-based security models of authenticated key agreement protocols in simple cases have been evolving for more than ten years. In this paper, we review and organize the models under a unified framework with some new extensions. By providing a new ability (the Coin query) to adversaries and redefining two key security notions, the framework fully exploits an adversary's capacity and can be used to prove all the commonly required security attributes of key agreement protocols with key confirmation. At the same time, the Coin query is also used to define a model which can be used to heuristically evaluate the security of a large category of authenticated protocols without key confirmation. We use the models to analyze a few identity-based authenticated key agreement protocols with pairings.