Obtaining a secure and efficient key agreement protocol from (H)MQV and NAXOS.

Berkant Ustaoğlu

Published Jan 1, 2007• 1 citation

Abstract

LaMacchia, Lauter and Mityagin recently presented a strong security definition for authenticated key agreement strengthening the well-known Canetti-Krawczyk definition. They also described a protocol, called NAXOS, that enjoys a simple security proof in the new model. Compared to MQV and HMQV, NAXOS is less efficient and cannot be readily modified to obtain a one-pass protocol. On the other hand MQV does not have a security proof, and the HMQV security proof is extremely complicated. This paper proposes a new authenticated key agreement protocol, called CMQV (‘Combined’ MQV), which incorporates design principles from MQV, HMQV and NAXOS. The new protocol achieves the efficiency of HMQV and admits a natural one-pass variant. Moreover, we present a simple and intuitive proof that CMQV is secure in the LaMacchia-Lauter-Mityagin model.

Related papers

Efficient and Secure Authenticated Key Exchange Protocols in the eCK Model

Jooyoung Lee, Je Hong Park

In this paper, we propose two authenticated key exchange (AKE) protocols and prove their security in the extended Canetti-Krawczyk model. The first protocol, called NAXOS+, is obtained by slightly modifying the NAXOS protocol proposed by LaMacchia, Lauter and Mityagin [15]. We prove its security under the Computational Diffie-Hellman (CDH) assumption by using the trapdoor test introduced in [6]. To the authors' knowledge, this is the first AKE protocol which is secure under the CDH assumption in the eCK model. The second protocol, called NETS, enjoys a simple and tight security reduction compared to existing schemes including HMQV and CMQV without using the Forking Lemma. Since each session of the NETS protocol requires only three exponentiations per party, its efficiency is also comparable to MQV, HMQV and CMQV.

IEICE Transactions on Fundamentals of Electronics Communications and Computer SciencesJan 1, 20110 citations

Generic Transformation of a CCA2-Secure Public-Key Encryption Scheme to an eCK-Secure Key Exchange Protocol in the Standard Model.

Janaka Alawatugoda

LaMacchia, Lauter and Mityagin presented a strong security model for authenticated key agreement, namely the eCK model. They also constructed a protocol, namely the NAXOS protocol, that enjoys a simple security proof in the eCK model. However, the NAXOS protocol uses a random-oracle-based technique to combine the long-term secret key and the per-session-randomness; so-called NAXOStrick, in order to achieve the eCK security definition. For NAXOS-trick-based protocols, the leakage of per-session-randomness modelled in the eCK model is somewhat unnatural, because the eCK model leaks per-session-randomness, while the output of the NAXOS-trick computation remains safe. In this work, we present a standard model eCK-secure protocol construction, eliminating the NAXOS-trick. Moreover, our protocol is a generic constructions, which can be instantiated with arbitrary suitable cryptographic primitives. Thus, we present a generic eCK-secure, NAXOS-free, standard model key exchange protocol. To the best of our knowledge this is the first paper on generic transformation of a CCA2-secure public key encryption scheme to an eCK-secure key exchange protocol in the standard model.

Jan 1, 20151 citation

On robust key agreement based on public key authentication

F Hao

This paper discusses public-key authenticated key agreement protocols. First, we critically analyze several authenticatedkey agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks onthe HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one shouldtake when interpreting theoretical results from a formal model. We further point out that many of the protocol failures inthe past are caused by sidestepping an important engineering principle, namely “Do not assume that a message you receivehas a particular form (such as g^r for known r) unless you can check this”. Constructions in the past generally resistedthis principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive.In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocoldesign and meanwhile achieve good efficiency. Our new key agreement protocol, YAK, has comparable computationalefficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, ourprotocol appears to be the simplest so far. We believe simplicity is also an important engineering principle.

Jan 1, 20140 citations

On robust key agreement based on public key authentication

Feng Hao

This paper discusses public key-authenticated key agreement protocols. First, we critically analyze several authenticated key agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks on the Hashed Menezes-Qu-Vanstone HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one should take when interpreting theoretical results from a formal model. We further point out that many of the protocol failures in the past are caused by sidestepping an important engineering principle, namely, Do not assume that a message you receive has a particular form such as gr for known r unless you can check this. Constructions in the past generally resisted this principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive. In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocol design and, meanwhile, achieve good efficiency. Our new key agreement protocol, YAK, has comparable computational efficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, our protocol appears to be the simplest so far. We believe simplicity is also an important engineering principle. Copyright © 2012 John Wiley & Sons, Ltd.

Security and Communication NetworksApr 18, 20127 citations

An Efficient Authenticated Key Exchange Protocol with a Tight Security Reduction.

Jooyoung Lee, Choon‐Sik Park

In this paper, we present a new authenticated key exchange(AKE) protocol, called NETS, and prove its security in the extended Canetti-Krawczyk model under the random oracle assumption and the gap Diffie-Hellman(GDH) assumption. Our protocol enjoys a simple and tight security reduction compared to those of HMQV and CMQV without using the Forking Lemma. Each session of the NETS protocol requires only three exponentiations per party, which is comparable to the efficiency of MQV, HMQV and CMQV.

Jan 1, 200829 citations

An eCK-secure Authenticated Key Exchange Protocol Without Random Oracles

Daisuke Moriyama, Tatsuaki Okamoto

Two-party key exchange protocol is a mechanism in which two parties communicate with each other over an insecure channel and output the same session key.A key exchange protocol that is secure against an active adversary who can control and modify the exchanged messages is called authenticated key exchange (AKE) protocol.LaMacchia, Lauter and Mityagin presented a strong security definition for public key infrastructure (PKI) based two-pass protocol, which we call the extended Canetti-Krawczyk (eCK) security model, and some researchers have provided eCK-secure AKE protocols in recent years.However, almost all protocols are provably secure in the random oracle model or rely on a special implementation technique so-called the NAXOS trick.In this paper, we present a PKI-based two-pass AKE protocol that is secure in the eCK security model.The security of the proposed protocol is proven without random oracles (under three assumptions), and does not rely on implementation techniques such as the NAXOS trick.

KSII Transactions on Internet and Information SystemsJan 1, 201111 citations