Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

A.: Security analysis of KEA authenticated key exchange protocol

Kristin Lauter, Anton Mityagin

Published Jan 1, 2005• 0 citations
OpenAlex

Abstract

Abstract. KEA is a Diffie-Hellman based key-exchange protocol developed by NSA which provides mutual authentication for the parties. It became publicly available in 1998 and since then it was neither attacked nor proved to be secure. We analyze the security of KEA and find that the original protocol is susceptible to a class of attacks. On the positive side, we present a simple modification of the protocol which makes KEA secure. We prove that the modified protocol, called KEA+, satisfies the strongest security requirements for authenticated key-exchange and that it retains some security even if a secret key of a party is leaked. Our security proof is in the random oracle model and uses the Gap Diffie-Hellman assumption. Finally, we show how to add a key confirmation feature to KEA+ (we call the version with key confirmation KEA+C) and discuss the security properties of KEA+C. 1

Related papers

Authenticated Key Exchange Secure under the Computational Diffie-Hellman Assumption.

Jooyoung Lee, Je Hong Park

Abstract. In this paper, we present a new authenticated key exchange(AKE) protocol and prove its security under the random oracle assumption and the computational Diffie-Hellman(CDH) assumption. In the extended Canetti-Krawczyk model, there has been no known AKE protocol based on the CDH assumption. Our protocol, called NAXOS+, is obtained by slightly modifying the NAXOS protocol proposed by LaMacchia, Lauter and Mityagin. We establish a formal security proof of NAXOS+ in the extended Canetti-Krawczyk model using as a main tool the trapdoor test presented by Cash, Kiltz and Shoup. Key words: authenticated key exchange, trapdoor test, computational Diffie-Hellman assumption, extended Canetti-Krawzcyk model 1

•Jan 1, 2008•46 citations

Authenticated Key Exchange Protocol in the Standard Model under Weaker Assumptions

Janaka Alawatugoda

A two-party authenticated key exchange (AKE) protocol allows each of the two parties to share a common secret key over insecure channels, even in the presence of active adversaries who can actively control and modify the exchanged messages. To capture the malicious behaviors of the adversaries, there have been many efforts to define security models. Amongst them, the extended Canetti–Krawczyk (eCK) security model is considered one of the strongest security models and has been widely adopted. In this paper, we present a simple construction of a pairing-based eCK-secure AKE protocol in the standard model. Our protocol can be instantiated with a suitable signature scheme (i.e., an existentially unforgeable signature scheme against adaptive chosen message attacks). The underlying assumptions of our construction are the decisional bilinear Diffie–Hellman assumption and the existence of a pseudorandom function. Note that the previous eCK-secure protocol constructions either relied on random oracles for their security or used somewhat strong assumptions, such as the existence of strong-pseudorandom functions, target collision-resistant functions, etc., while our protocol construction uses fewer and more-standard assumptions in the standard model. Furthermore, preserving the same security argument, our protocol can be instantiated with any appropriate signature scheme that comes in the future with better efficiency.

Cryptography•Jan 5, 2023•2 citations

An Efficient Authenticated Key Exchange Protocol with a Tight Security Reduction.

Jooyoung Lee, Choon‐Sik Park

In this paper, we present a new authenticated key exchange(AKE) protocol, called NETS, and prove its security in the extended Canetti-Krawczyk model under the random oracle assumption and the gap Diffie-Hellman(GDH) assumption. Our protocol enjoys a simple and tight security reduction compared to those of HMQV and CMQV without using the Forking Lemma. Each session of the NETS protocol requires only three exponentiations per party, which is comparable to the efficiency of MQV, HMQV and CMQV.

•Jan 1, 2008•29 citations

Strongly Secure Identity-based Authenticated Key Exchange Protocol

Jian Shu

Recently,LaMacchia et al.proposed the extended Canetti-Krawczyk(eCK) model,which captures all security properties of authenticated key enchange protocols.Most of existing identity-based authenticated key exchange protocols are not secure in the eCK model.This paper proposes an identity-based authenticated key exchange protocol,and the security of proposed protocol can be proved in the eCK model.When compaer with other schemes,the proposed protocol achieves efficiency in terms of computation and communication.The proposal achieve strong security,and can be proved under the random oracle assumption and the Gap Bilinear Diffie-Hellman assumption.

Journal of Chinese Computer Systems•Jan 1, 2011•0 citations

Signed (Group) Diffie–Hellman Key Exchange with Tight Security

Jiaxin Pan, Chen Qian, Magnus Ringerud

Abstract We propose the first tight security proof for the ordinary two-message signed Diffie–Hellman key exchange protocol in the random oracle model. Our proof is based on the strong computational Diffie–Hellman assumption and the multiuser security of a digital signature scheme. With our security proof, the signed DH protocol can be deployed with optimal parameters, independent of the number of users or sessions, without the need to compensate any security loss. We abstract our approach with a new notion called verifiable key exchange. In contrast to a known tight three-message variant of the signed Diffie–Hellman protocol (Gjøsteen and Jager, in: Shacham, Boldyreva (eds) CRYPTO 2018, Part II. LNCS, Springer, Heidelberg, 2018), we do not require any modification to the original protocol, and our tightness result is proven in the “Single-Bit-Guess” model which we know can be tightly composed with symmetric cryptographic primitives to establish a secure channel. Finally, we extend our approach to the group setting and construct the first tightly secure group authenticated key exchange protocol.

Journal of Cryptology•Sep 27, 2022•23 citations

A New AKE Protocol with Stronger Security in the eCK Model

Xuexian Hu, Qingfeng Cheng, Wenfen Liu +1 more

In this paper, we present a new authenticated key exchange (AKE) protocol, called NS+, which allows the adversary to reveal all the ephemeral secret information, especially including the Diffie-Hellman exponets, used for building one party's outputting message. We also prove the security of this protocol in the eCK model, under the random oracle assumption and the gap Diffie-Hellman (GDH) assumption. Our protocol is based on the NAXOS+ protocol proposed by Lee and Park and is of the same efficiency with it in terms of exponentiations.

WASE International Conference on Information Engineering•Aug 1, 2010•1 citation
Abstract. KEA is a Diffie-Hellman based key-exchange protocol developed by NSA which provides mutual authentication for the parties. It became publicly available in 1998 and since then it was neither attacked nor proved to be secure. We analyze the security of KEA and find that the original protocol is susceptible to a class of attacks. On the positive side, we present a simple modification of the protocol which makes KEA secure. We prove that the modified protocol, called KEA+, satisfies the strongest security requirements for authenticated key-exchange and that it retains some security even if a secret key of a party is leaked. Our security proof is in the random oracle model and uses the Gap Diffie-Hellman assumption. Finally, we show how to add a key confirmation feature to KEA+ (we call the version with key confirmation KEA+C) and discuss the security properties of KEA+C. 1
Abstract. In this paper, we present a new authenticated key exchange(AKE) protocol and prove its security under the random oracle assumption and the computational Diffie-Hellman(CDH) assumption. In the extended Canetti-Krawczyk model, there has been no known AKE protocol based on the CDH assumption. Our protocol, called NAXOS+, is obtained by slightly modifying the NAXOS protocol proposed by LaMacchia, Lauter and Mityagin. We establish a formal security proof of NAXOS+ in the extended Canetti-Krawczyk model using as a main tool the trapdoor test presented by Cash, Kiltz and Shoup. Key words: authenticated key exchange, trapdoor test, computational Diffie-Hellman assumption, extended Canetti-Krawzcyk model 1
A two-party authenticated key exchange (AKE) protocol allows each of the two parties to share a common secret key over insecure channels, even in the presence of active adversaries who can actively control and modify the exchanged messages. To capture the malicious behaviors of the adversaries, there have been many efforts to define security models. Amongst them, the extended Canetti–Krawczyk (eCK) security model is considered one of the strongest security models and has been widely adopted. In this paper, we present a simple construction of a pairing-based eCK-secure AKE protocol in the standard model. Our protocol can be instantiated with a suitable signature scheme (i.e., an existentially unforgeable signature scheme against adaptive chosen message attacks). The underlying assumptions of our construction are the decisional bilinear Diffie–Hellman assumption and the existence of a pseudorandom function. Note that the previous eCK-secure protocol constructions either relied on random oracles for their security or used somewhat strong assumptions, such as the existence of strong-pseudorandom functions, target collision-resistant functions, etc., while our protocol construction uses fewer and more-standard assumptions in the standard model. Furthermore, preserving the same security argument, our protocol can be instantiated with any appropriate signature scheme that comes in the future with better efficiency.
Recently,LaMacchia et al.proposed the extended Canetti-Krawczyk(eCK) model,which captures all security properties of authenticated key enchange protocols.Most of existing identity-based authenticated key exchange protocols are not secure in the eCK model.This paper proposes an identity-based authenticated key exchange protocol,and the security of proposed protocol can be proved in the eCK model.When compaer with other schemes,the proposed protocol achieves efficiency in terms of computation and communication.The proposal achieve strong security,and can be proved under the random oracle assumption and the Gap Bilinear Diffie-Hellman assumption.
Abstract We propose the first tight security proof for the ordinary two-message signed Diffie–Hellman key exchange protocol in the random oracle model. Our proof is based on the strong computational Diffie–Hellman assumption and the multiuser security of a digital signature scheme. With our security proof, the signed DH protocol can be deployed with optimal parameters, independent of the number of users or sessions, without the need to compensate any security loss. We abstract our approach with a new notion called verifiable key exchange. In contrast to a known tight three-message variant of the signed Diffie–Hellman protocol (Gjøsteen and Jager, in: Shacham, Boldyreva (eds) CRYPTO 2018, Part II. LNCS, Springer, Heidelberg, 2018), we do not require any modification to the original protocol, and our tightness result is proven in the “Single-Bit-Guess” model which we know can be tightly composed with symmetric cryptographic primitives to establish a secure channel. Finally, we extend our approach to the group setting and construct the first tightly secure group authenticated key exchange protocol.
In this paper, we present a new authenticated key exchange (AKE) protocol, called NS+, which allows the adversary to reveal all the ephemeral secret information, especially including the Diffie-Hellman exponets, used for building one party's outputting message. We also prove the security of this protocol in the eCK model, under the random oracle assumption and the gap Diffie-Hellman (GDH) assumption. Our protocol is based on the NAXOS+ protocol proposed by Lee and Park and is of the same efficiency with it in terms of exponentiations.