Abstract. In the paper “Stronger Security of Authenticated Key Ex-change ” [1,2], a new security model for authenticated key exchange pro-tocols (eCK) is proposed. The new model is suggested to be at least as strong as previous models for key exchange protocols. The model in-cludes a new notion of an Ephemeral Key Reveal adversary query, which is claimed in e. g. [2–4] to be at least as strong as the Session-state Reveal query. We show that Session-state Reveal is stronger than Ephemeral Key Reveal, implying that the eCK security model is incomparable to the CK model [5, 6]. In particular we show that the proposed NAXOS protocol from [1, 2] does not meet its security requirements if the Session-state Reveal query is allowed in the eCK model. We discuss the implications of our result for some related protocols proven correct in the eCK model, and discuss the interaction between Session-state Reveal and protocol transformations.
Abstract. In the paper “Stronger Security of Authenticated Key Ex-change ” [1,2], a new security model for authenticated key exchange pro-tocols (eCK) is proposed. The new model is suggested to be at least as strong as previous models for key exchange protocols. The model in-cludes a new notion of an Ephemeral Key Reveal adversary query, which is claimed in e. g. [2–4] to be at least as strong as the Session-state Reveal query. We show that Session-state Reveal is stronger than Ephemeral Key Reveal, implying that the eCK security model is incomparable to the CK model [5, 6]. In particular we show that the proposed NAXOS protocol from [1, 2] does not meet its security requirements if the Session-state Reveal query is allowed in the eCK model. We discuss the implications of our result for some related protocols proven correct in the eCK model, and discuss the interaction between Session-state Reveal and protocol transformations.
In the paper, 'stronger security of authenticated key exchange' (LaMacchia et al., 2006, 2007), a new security model for authenticated key exchange protocols (eCK) is proposed. The new model is suggested to be at least as strong as previous models for key exchange protocols, such as the CK model (Canetti and Krawczyk, 2001; Krawczyk, 2005). The model includes a new notion of an EphemeralKeyReveal adversary query, which is claimed in e.g., LaMacchia et al. (2006), Okamoto (2007), and Ustaoglu (2008), to be at least as strong as the Session-StateReveal query. We investigate the relation between the two models by focusing on the difference in adversary queries. We formally model the NAXOS protocol and a variant of the eCK model, called eCK', in which the EphemeralKeyReveal query is replaced by the Session-StateReveal query. Using Scyther, a formal protocol analysis tool, we automatically find attacks on the protocol, showing that the protocol is insecure in the eCK' model. Our attacks prove that the Session-StateReveal query is stronger than the EphemeralKeyReveal query and that the eCK security model is incomparable to the CK model, disproving several claims made in the literature.
LaMacchia, Lauter and Mityagin [19] proposed a novel security definition for authenticate key exchange (AKE) that gives an adversary the power to obtain ephemeral information regarding a target test session. To demonstrate feasibility of secure protocols in the new definition, henceforth called eCK, the authors described a protocol called NAXOS. NAXOS combines an ephemeral private key x with a static private key a to generate an ephemeral public key X (more precisely in what we call the NAXOS' approach X=gH(x,a)). Thus no one is able to query the discrete logarithm of X without knowing both the ephemeral and static private keys. This idea is crucial in the security argument to guard against leaked ephemeral secrets belonging to the test session. Another important assumption is the gap assumption that allows the protocol to remain secure even in the presence of malicious insiders. Both ideas have been successfully used in creating various protocols secure in the eCK model. In this paper, we construct two eCK-secure protocols without the above mentioned ideas. KFU1 is secure under the GDH assumption without using the NAXOS' approach. KFU2 builds upon KFU1 and drops the gap requirement, thus it is secure under the CDH assumption. Efficiency and security of the proposed protocols are comparable to the well-known HMQV [15] protocol. Furthermore, unlike HMQV and NAXOS the use of the random oracle in KFU1 and KFU2 is restricted to the key derivation function making them more suitable for practical applications.
Since Bellare and Rogaway presented the first formal security model for authenticated key exchange (AKE) protocols in 1993, many formal security models have been proposed. The extended Canetti-Krawczyk (eCK) model proposed by LaMacchia et al. is currently regarded as the strongest security model for two-party AKE protocols. In this paper, we first generalize the eCK model for tripartite AKE protocols, called teCK model, and enhance the security of the new model by adding a new reveal query. In the teCK model, the adversary has stronger powers, and can learn more secret information. Then we present a new tripartite AKE protocol based on the NAXOS protocol, called T-NAXOS protocol, and analyze its security in the teCK model under the random oracle assumption.
The extended Canetti-Krawczyk(eCK) model proposed by LaMacchia et al.is currently regarded as the strongest security model for authenticated key exchange(AKE) protocols.In the eCK model,the adversary can make queries on the test session,and reveal both ephemeral private keys,both long-term keys,or one of each from the two different parties.In this paper,we analyze two AKE protocols designed in the eCK model based on the definition of eCK model.We propose ephemeral keys compromised attacks and long-term keys compromised attacks on one of them,and also propose ephemeral keys compromised attacks on the other one.The results of analysis show that both of them are insecure in the eCK model.
In this paper, we present a new authenticated key exchange (AKE) protocol, called NS+, which allows the adversary to reveal all the ephemeral secret information, especially including the Diffie-Hellman exponets, used for building one party's outputting message. We also prove the security of this protocol in the eCK model, under the random oracle assumption and the gap Diffie-Hellman (GDH) assumption. Our protocol is based on the NAXOS+ protocol proposed by Lee and Park and is of the same efficiency with it in terms of exponentiations.
Two-party key exchange protocol is a mechanism in which two parties communicate with each other over an insecure channel and output the same session key.A key exchange protocol that is secure against an active adversary who can control and modify the exchanged messages is called authenticated key exchange (AKE) protocol.LaMacchia, Lauter and Mityagin presented a strong security definition for public key infrastructure (PKI) based two-pass protocol, which we call the extended Canetti-Krawczyk (eCK) security model, and some researchers have provided eCK-secure AKE protocols in recent years.However, almost all protocols are provably secure in the random oracle model or rely on a special implementation technique so-called the NAXOS trick.In this paper, we present a PKI-based two-pass AKE protocol that is secure in the eCK security model.The security of the proposed protocol is proven without random oracles (under three assumptions), and does not rely on implementation techniques such as the NAXOS trick.