Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Ephemeral key compromise attack on the IB-KA protocol.

Qingfeng Cheng, Chuangui Ma

Published Jan 1, 2009• 8 citations
OpenAlex

Abstract

Abstract. Recently, Dario Fiore and Rosario Gennaro proposed the IB-KA protocol, which was inspired by MQV protocol. They provide a full proof of security of IB-KA protocol using techniques developed by Krawczyk in the Canetti-Krawczyk model. They designed the IB-KA protocol with some security properties such as perfect forward secrecy, reflection attack resilience, and key compromise impersonation resilience. But they didn’t consider ephemeral key compromise problem in the design of IB-KA protocol, and made no analysis whether the IB-KA protocol can resist ephemeral key compromise attacks. In this paper, we present ephemeral key compromise attack on the the IB-KA protocol. Our work shows that the IB-KA protocol is designed without ephemeral key compromise resilience. Key words: Ephemeral key compromise attack; Authenticated key exchange;

Related papers

Analysis of Two Provably Secure Authenticated Key Exchange Protocols in the eCK Model

Xuexian Hu

The extended Canetti-Krawczyk(eCK) model proposed by LaMacchia et al.is currently regarded as the strongest security model for authenticated key exchange(AKE) protocols.In the eCK model,the adversary can make queries on the test session,and reveal both ephemeral private keys,both long-term keys,or one of each from the two different parties.In this paper,we analyze two AKE protocols designed in the eCK model based on the definition of eCK model.We propose ephemeral keys compromised attacks and long-term keys compromised attacks on one of them,and also propose ephemeral keys compromised attacks on the other one.The results of analysis show that both of them are insecure in the eCK model.

Journal of Wuhan University•Jan 1, 2010•0 citations

Enhancing CK-Model for Key Compromise Impersonation Resilience and Identity-based Key Exchange.

Robert W. Zhu, Xiaojian Tian, Duncan S. Wong

Abstract. In 2001, Canetti and Krawczyk proposed a security model (CKmodel) for authentication protocols. They also gave an indistinguishabilitybased definition for key exchange protocols. Since then the model has almost exclusively been used for analyzing key exchange protocols, although it can be applied to authentication protocols in general. The model not only captures a large class of attacks but also provides a modular approach to the design of authentication protocols. However, the model does not capture the property of Key Compromise Impersonation (KCI) Resilience. Until now, analysis concerning this property has mostly been done heuristically and restricted to key exchange protocols only. Previous attempts on formalizing KCI have mostly been done in some ad hoc manner and additional proofs have to be given specifically for the security of KCI resilience. In this paper, we propose an extension to the CK-model, which allows, for the first time, the KCI attacks to be considered in authentication protocols in general, rather than restricted to key exchange protocols, and no more additional proofs are required specifically for KCI security. With the revival of interest in identity-based (ID-based) cryptography, there have been many new ID-based key exchange protocols proposed. Despite the fact that some of them have been proven in some restricted versions of a model proposed by Bellare and Rogaway in 1993 and some others have been proven in the original CK-model, there is no rigorous model specifically for ID-based key exchange security. In particular, forward secrecy against compromised Key Generation Server (KGS-FS) has never been captured even though this notion is more important and stronger than the perfect forward secrecy in ID-based key exchange. For this, we further extend our model to ID-based setting and capture the property of KGS-FS for ID-based key exchange security. 1

•Jan 1, 2005•5 citations

One-round Secure Key Exchange Protocol With Strong Forward Secrecy

Xiaowei Li, Dengqi Yang, Benhui Chen +1 more

Security models for key exchange protocols have been researched for years, however, lots of them only focus on what secret can be compromised but they do not differentiate the timing of secrets compromise, such as the extended Canetti-Krawczyk (eCK) model. In this paper, we propose a new security model for key exchange protocols which can not only consider what keys can be compromised as well as when they are compromised. The proposed security model is important to the security proof of the key exchange protocols with forward secrecy (either weak forward secrecy (wFS) or strong forward secrecy (sFS)). In addition, a new kind of key compromise impersonation (KCI) attacks which is called strong key compromise impersonation (sKCI) attack is proposed. Finally, we provide a new one-round key exchange protocol called mOT+ based on mOT protocol. The security of the mOT+ is given in the new model. It can provide the properties of sKCI-resilience and sFS and it is secure even if the ephemeral key reveal query is considered.

KSII Transactions on Internet and Information Systems•Nov 30, 2016•2 citations

A strongly secure identity-based authenticated key agreement protocol without pairings under the GDH assumption

Haiyan Sun, Qiaoyan Wen, Hua Zhang +1 more

Among the existing identity-based authenticated key agreement ID-AKA protocols, there are only a few of them that can resist to leakage of ephemeral secret keys, which is about the protection of the session secret key after the ephemeral secret keys of users are compromised. However, all these ID-AKA protocols with leakage of ephemeral secret keys resistance require expensive bilinear pairing operations. In this paper, we present a pairing-free ID-AKA protocol with ephemeral secrets leakage resistance. We also provide a full proof of its security in the extended Canetti-Krawczyk model, which not only can capture resistance to leakage of ephemeral secret keys but also can capture other basic security properties such as master key forward security and key compromise impersonation resistance. Compared with the existing ID-AKA protocols, our scheme is a good trade-off between security and efficiency. Copyright © 2015 John Wiley & Sons, Ltd.

Security and Communication Networks•Mar 23, 2015•19 citations

Analysis of Two Authenticated Key Exchange Protocols

Qingfeng Cheng, Guangguo Han, Chuangui Ma

The design of secure authenticated key exchange (AKE) protocols has always been a notorious hard problem. Many famous AKE protocols have been found flaws since they were finished. In this paper, we analyze two AKE protocols, which were proposed by Hassan et al. in 2007 and 2008. Then we present key compromise impersonation attack and ephemeral key compromise attack to their two AKE protocols.

International Conference on Multimedia Information Networking and Security•Jan 1, 2009•2 citations

Identity-Based One Round Key Agreement Protocol without Bilinear Pairings

Wenhao Liu, Shengbao Wang, Xiao Tan +2 more

Almost all the existing identity-based key agreement (ID-KA) protocols cannot achieve both ephemeral secret reveal resilience and pairing-free. In this paper, a pairing-free ID-KA protocol is proposed, which captures all basic desirable security properties including key generation center forward secrecy, key compromise impersonation resilience and ephemeral secrets reveal resistance. On the other hand, the proposed scheme only needs one round communication between the two parties. Compared with the previous ID-KA protocols, the proposed scheme is more secure and efficient.

International Conference on P2P, Parallel, Grid, Cloud and Internet Computing (3PGCIC)•Nov 1, 2015•2 citations
Abstract. Recently, Dario Fiore and Rosario Gennaro proposed the IB-KA protocol, which was inspired by MQV protocol. They provide a full proof of security of IB-KA protocol using techniques developed by Krawczyk in the Canetti-Krawczyk model. They designed the IB-KA protocol with some security properties such as perfect forward secrecy, reflection attack resilience, and key compromise impersonation resilience. But they didn’t consider ephemeral key compromise problem in the design of IB-KA protocol, and made no analysis whether the IB-KA protocol can resist ephemeral key compromise attacks. In this paper, we present ephemeral key compromise attack on the the IB-KA protocol. Our work shows that the IB-KA protocol is designed without ephemeral key compromise resilience. Key words: Ephemeral key compromise attack; Authenticated key exchange;
The extended Canetti-Krawczyk(eCK) model proposed by LaMacchia et al.is currently regarded as the strongest security model for authenticated key exchange(AKE) protocols.In the eCK model,the adversary can make queries on the test session,and reveal both ephemeral private keys,both long-term keys,or one of each from the two different parties.In this paper,we analyze two AKE protocols designed in the eCK model based on the definition of eCK model.We propose ephemeral keys compromised attacks and long-term keys compromised attacks on one of them,and also propose ephemeral keys compromised attacks on the other one.The results of analysis show that both of them are insecure in the eCK model.
Abstract. In 2001, Canetti and Krawczyk proposed a security model (CKmodel) for authentication protocols. They also gave an indistinguishabilitybased definition for key exchange protocols. Since then the model has almost exclusively been used for analyzing key exchange protocols, although it can be applied to authentication protocols in general. The model not only captures a large class of attacks but also provides a modular approach to the design of authentication protocols. However, the model does not capture the property of Key Compromise Impersonation (KCI) Resilience. Until now, analysis concerning this property has mostly been done heuristically and restricted to key exchange protocols only. Previous attempts on formalizing KCI have mostly been done in some ad hoc manner and additional proofs have to be given specifically for the security of KCI resilience. In this paper, we propose an extension to the CK-model, which allows, for the first time, the KCI attacks to be considered in authentication protocols in general, rather than restricted to key exchange protocols, and no more additional proofs are required specifically for KCI security. With the revival of interest in identity-based (ID-based) cryptography, there have been many new ID-based key exchange protocols proposed. Despite the fact that some of them have been proven in some restricted versions of a model proposed by Bellare and Rogaway in 1993 and some others have been proven in the original CK-model, there is no rigorous model specifically for ID-based key exchange security. In particular, forward secrecy against compromised Key Generation Server (KGS-FS) has never been captured even though this notion is more important and stronger than the perfect forward secrecy in ID-based key exchange. For this, we further extend our model to ID-based setting and capture the property of KGS-FS for ID-based key exchange security. 1
Security models for key exchange protocols have been researched for years, however, lots of them only focus on what secret can be compromised but they do not differentiate the timing of secrets compromise, such as the extended Canetti-Krawczyk (eCK) model. In this paper, we propose a new security model for key exchange protocols which can not only consider what keys can be compromised as well as when they are compromised. The proposed security model is important to the security proof of the key exchange protocols with forward secrecy (either weak forward secrecy (wFS) or strong forward secrecy (sFS)). In addition, a new kind of key compromise impersonation (KCI) attacks which is called strong key compromise impersonation (sKCI) attack is proposed. Finally, we provide a new one-round key exchange protocol called mOT+ based on mOT protocol. The security of the mOT+ is given in the new model. It can provide the properties of sKCI-resilience and sFS and it is secure even if the ephemeral key reveal query is considered.
Among the existing identity-based authenticated key agreement ID-AKA protocols, there are only a few of them that can resist to leakage of ephemeral secret keys, which is about the protection of the session secret key after the ephemeral secret keys of users are compromised. However, all these ID-AKA protocols with leakage of ephemeral secret keys resistance require expensive bilinear pairing operations. In this paper, we present a pairing-free ID-AKA protocol with ephemeral secrets leakage resistance. We also provide a full proof of its security in the extended Canetti-Krawczyk model, which not only can capture resistance to leakage of ephemeral secret keys but also can capture other basic security properties such as master key forward security and key compromise impersonation resistance. Compared with the existing ID-AKA protocols, our scheme is a good trade-off between security and efficiency. Copyright © 2015 John Wiley & Sons, Ltd.
Almost all the existing identity-based key agreement (ID-KA) protocols cannot achieve both ephemeral secret reveal resilience and pairing-free. In this paper, a pairing-free ID-KA protocol is proposed, which captures all basic desirable security properties including key generation center forward secrecy, key compromise impersonation resilience and ephemeral secrets reveal resistance. On the other hand, the proposed scheme only needs one round communication between the two parties. Compared with the previous ID-KA protocols, the proposed scheme is more secure and efficient.