Strongly Secure One-round Group Authenticated Key Exchange in the Standard Model.

Yong Li, Zheng Yang

Published Jan 1, 2013• 0 citations

Abstract

One-round group authenticated key exchange (GAKE) protocols typically provide implicit authentication and appealing bandwidth efficiency. As a special case of GAKE – the pairing-based one-round tripartite authenticated key exchange (3AKE), recently gains much attention of research community due to its strong security. Several pairing-based one-round 3AKE protocols have recently been proposed to achieve provable security in the g-eCK model. In contrast to earlier GAKE models, the g-eCK model particularly formulates the security properties regarding resilience to the leakage of various combinations of long-term key and ephemeral session state, and provision of weak perfect forward secrecy in a single model. However, the g-eCK security proofs of previous protocols are only given under the random oracle model. In this work, we give a new construction for pairing-based one-round 3AKE protocol which is provably secure in the g-eCK model without random oracles. Security of proposed protocol is reduced to the hardness of Cube Bilinear Decisional Diffie-Hellman (CBDDH) problem for symmetric pairing. We also extend the proposed 3AKE scheme to a GAKE scheme with more than three group members, based on multilinear maps. We prove g-eCK security of our GAKE scheme in the standard model under the natural multilinear generalization of the CBDDH assumption.

Related papers

Strongly Secure Authenticated Key Exchange in the Standard Model

Zheng Yang

Nowadays many crucial network applications rely on the existence of a confidential channel established by authenticated key exchange (AKE) protocols over public networks.With the rapid development of cyber technology, novel attacks to cryptosystem emerge in an endless stream.This has also led to the development of AKE solutions to provide increasingly stronger security guarantees.In this thesis we focus on provision of practical constructions for AKE protocols which are provably secure in a strong sense without resorting to random oracles.We first we present three new efficient compilers to generically turn passively secure key exchange protocols (KE) into authenticated key exchange protocols (AKE) where security also holds in the presence of active adversaries.Our compilers are not only a useful tool for the design of new AKE systems with many additional security properties in a modular and less error-prone fashion, but they also help to relax the assumptions on existing, practical key exchange mechanisms which are not known to be provably secure AKE protocols.Security of our compilers is shown in a strong modified CK model where the adversary is allowed to reveal either long-term secret key or state information of the protocol participants.On the second, we study the open problem on constructing eCK secure two party AKE protocol without random oracles and NAXOS trick.A generic construction satisfying those requirements is given based on well-known cryptographic primitives following the guideline of efficiency.Then a concrete protocol is proposed which is the first eCK secure protocol in the standard model under both standard assumptions and post-specified peer setting (i.e.without knowing any cryptographic information about its communication peer).Both proposed schemes can be more efficiently implemented with secure device than previous works which are eCK secure in the standard model, where the secure device might be normally used to store the long-term private key and to implement codes of protocol which need to be resilience of state leakage.Finally, we generalize our one-round two party AKE construction to group case that yields an efficient tripartite AKE protocol based on bilinear maps and a candidate group AKE protocol (with more than three members) based on multilinear maps.Up to now they are the first solutions which can be proved secure in the g-eCK model without random oracles.Meanwhile we make first step to show how to simplify the security proof for one-round group AKE under g-eCK model.i

Jan 1, 20130 citations

Towards Modelling Perfect Forward Secrecy for One-round Group Key Exchange.

Zheng Yang, Daigu Zhang

We propose two security models for one-round group key exchange (ORGKE), which are called as g-eCKw and g-eCK-PFS. The g-eCK-PFS is a stronger variant of g- eCKw, which particularly formulates perfect forward se- crecy for ORGKE. A new tripartite ORGKE is proposed to provide g-eCKw security without random oracles under standard assumptions, that is also more e_cient than its predecessor by Li and Yang on CANS'13. We also show how to transform (compile) a g-eCKw secure protocol to achieve g-eCK-PFS security. In particular, our result enables us to prove the security of the first ORGKE protocol that achieves perfect forward secrecy without random oracles in a strong security model allowing adversary to compromise critical information of session participants such as long-term or ephemeral private key.

International journal of network securityMar 1, 20168 citations

A practical strongly secure one‐round authenticated key exchange protocol without random oracles

Zheng Yang, Yang Wu

Abstract Most recently, a variant of extended Canetti–Krawczyk model called aseCKwis introduced to provide stronger security than previous eCK models. NamelyeCKwmodels formulate a stronger notion regarding weak perfect forward secrecy than other eCK models. In particular, anyeCKwsecure protocols can be generally transformed to achieve full provide perfect forward secrecy without requiring additional round. So far, there is no protocol which has been proven secure in theeCKwmodel without random oracles. In this paper, we study the open problem on constructingeCKwsecure AKE protocol in the standard model. A new one‐round AKE protocol is introduced relying on standard cryptographic primitives and a variant of bilinear decisional Diffie–Hellman assumption. The main advantage of our proposal is its high efficiency in key exchange in contrast to the previous eCK secure protocols without random oracles and under post‐specified peer setting. Copyright © 2014 John Wiley & Sons, Ltd.

Security and Communication NetworksSep 9, 20143 citations

Modeling Leakage of Ephemeral Secrets in Tripartite/Group Key Exchange

Mark Manulis, Koutarou Suzuki, Berkant Ustaoğlu

We propose a security model, referred as g-eCK model, for group key exchange that captures essentially all non-trivial leakage of static and ephemeral secret keys of participants, i.e., group key exchange version of extended Canetti-Krawczyk (eCK) model. Moreover, we propose the first one-round tripartite key exchange (3KE) protocol secure in the g-eCK model under the gap Bilinear Diffie-Hellman (gap BDH) assumption and in the random oracle model.

IEICE Transactions on Fundamentals of Electronics Communications and Computer SciencesDec 31, 20126 citations

eCK Secure Single Round ID-based Authenticated Key Exchange Protocols with Master Perfect Forward Secrecy (Extended Version)

Tapas Pandit, Rana Barua, Somanath Tripathy

Recently, LaMacchia, Lauter and Mityagin proposed the extended Canetti-Krawczyk (eCK) model for Authenticated Key Exchange (AKE) protocols that covers many attacks on existing models. An ID-based AKE protocol with Perfect Forward Secrecy (PFS) (respectively Master Perfect Forward Secrecy (MPFS)) ensures that revelation of the static keys of the parties (respectively the master secret key of the private key generator), must not compromise even a single bit of the session keys of the past sessions between the parties. Currently, to the best of our knowledge, there is no ID-based eCK secure single round AKE protocol with either PFS or MPFS. In our preliminary version [18] we have proposed, without proofs, ID-based eCK secure single round AKE protocols with PFS and MPFS in the random oracle model. To achieve this, we also have constructed ID-based eCK secure single round AKE protocols, one without Master Forward Secrecy (MFS) and one with MFS, almost at the same computational cost as the existing efficient ID-based eCK Secure Single Round AKE protocols. In this full version, we provide proofs to show that all of our protocols are secure under the Gap Bilinear Diffie-Hellman (GBDH) problem.

Journal of Wireless Mobile Networks Ubiquitous Computing and Dependable ApplicationsJan 1, 20141 citation

Strongly Secure One Round Authenticated Key Exchange Protocol with Perfect Forward Security.

Hai Huang

Abstract. This paper investigates the two-pass authenticated key exchange protocol in the enhanced Canetti-Krawczyk (eCK) with perfect forward security. Currently, there exist no authenticated key exchange protocols which are provably secure in eCK model and meanwhile achieve perfect forward security against active adversary in one round. We propose a new two-pass authenticated key exchange protocol which enjoys following desirable properties. First, our protocol is shown secure in the eCK model under the gap Diffie-Hellman (GDH) assumption. Moreover, our protocol does not use the NAXOS transformation, the drawback of which will be discussed in the introduction. Second, under the same assumption, we prove that our protocol achieves perfect forward security against active adversary in one round. To the best of our knowledge, our proposal is first two-pass (one round) AKE protocol provably secure in the eCK model and achieving perfect forward security against active adversary.

Jan 1, 20110 citations