A Diffie-Hellman quantum session key establishment protocol without entanglement.

小女孩, HSIANG CHANG

[[abstract]] 在2016到2017年間Shi等人發表了三篇量子可否認簽章，其中一篇為在對方公鑰上使用量子邏輯門運算，其餘兩篇則是雙方利用己方私鑰旋轉對方公鑰的方式獲得通訊金鑰。然而，在前者的研究中，在金鑰產生後該通訊金鑰在通訊的過程中皆無改變。但是，從資訊安全的角度來說，該通訊金鑰應在每次使用後改變。因此，難以說明上述三篇通訊金鑰建立方式有符合資訊安全要求。基此，本文透過迪菲-赫爾曼金鑰交換協議，產生每次使用過後皆能改變通訊金鑰的協議。並且在我們分析過後，確認本次提出的協議是安全的，可以抵擋多種惡意的攻擊方式。

Dirk Fischer

Sofia Zebboudj, Hizia Djoudi, Dalila Lalaoui +1 more

Jian Shu

The key establishment protocol called LLH can not resist impersonation attack.Aiming at this problem,an improved protocol based on signcryption is proposed.It uses elliptic curve cryptosystem technology under the computational Diffie-Hellman assumption,combines authentication and session key and implements the functions of mutual authentication and key confirmation,so that the security is enhanced.Theoretical analysis results show that the proposed protocol has strong security features and can be resistant to impersonation attack.

Berkant Ustaoğlu

Both the “eCK” model, by LaMacchia, Lauter and Mityagin, and the “CK01” model, by Canetti and Krawczyk, address the effect of leaking session specific ephemeral data on the security of key establishment schemes. The CK01-adversary is given a SessionStateReveal query to learn session specific private data defined by the protocol specification, whereas the eCK-adversary is equipped with an EphemeralKeyReveal query to access all ephemeral private input required to carry session computations. SessionStateReveal cannot be issued against the test session; by contrast EphemeralKeyReveal can be used against the test session under certain conditions. On the other hand, it is not obvious how EphemeralKeyReveal compares to SessionStateReveal. Thus it is natural to ask which model is more useful and practically relevant. While formally the models are not comparable, we show that recent analysis utilizing SessionStateReveal and EphemeralKeyReveal have a similar approach to ephemeral data leakage. First we pinpoint the features that determine the approach. Then by examining common motives for ephemeral data leakage we conclude that the approach is meaningful, but does not take into account timing, which turns out to be critical for security. Lastly, for Diffie-Hellman protocols we argue that it is important to consider security when discrete logarithm values of the outgoing ephemeral public keys are leaked and offer a method to achieve security even if the values are exposed.

F. J. Duarte