A group authenticated key exchange (GAKE) protocol allows a set of parties belonging to a certain designated group to agree upon a common secret key through an insecure communication network. In the last few years, many new cryptographic tools have been specifically designed to thwart attacks from adversaries which may have access to (different kinds of) quantum computation resources. However, few constructions for group key exchange have been put forward. Here, we propose a four-round GAKE which can be proven secure under widely accepted assumptions in the Quantum Random Oracle Model. Specifically, we integrate several primitives from the so-called Kyber suite of post-quantum tools in a (slightly modified) compiler from Abdalla et al. (TCC 2007). More precisely, taking as a starting point an IND-CPA encryption scheme from the Kyber portfolio, we derive, using results from Hövelmanns et al. (PKC 2020), a two-party key exchange protocol and an IND-CCA encryption scheme and prove them fit as building blocks for our compiled construction. The resulting GAKE protocol is secure under the Module-LWE assumption, and furthermore achieves authentication without the use of (expensive) post-quantum signatures.
A group authenticated key exchange (GAKE) protocol allows a set of parties belonging to a certain designated group to agree upon a common secret key through an insecure communication network. In the last few years, many new cryptographic tools have been specifically designed to thwart attacks from adversaries which may have access to (different kinds of) quantum computation resources. However, few constructions for group key exchange have been put forward. Here, we propose a four-round GAKE which can be proven secure under widely accepted assumptions in the Quantum Random Oracle Model. Specifically, we integrate several primitives from the so-called Kyber suite of post-quantum tools in a (slightly modified) compiler from Abdalla et al. (TCC 2007). More precisely, taking as a starting point an IND-CPA encryption scheme from the Kyber portfolio, we derive, using results from Hövelmanns et al. (PKC 2020), a two-party key exchange protocol and an IND-CCA encryption scheme and prove them fit as building blocks for our compiled construction. The resulting GAKE protocol is secure under the Module-LWE assumption, and furthermore achieves authentication without the use of (expensive) post-quantum signatures.
Group authenticated key exchange protocols (GAKE) are cryptographic tools enabling a group of several users communicating through an insecure channel to securely establish a common shared high-entropy key. In the last years, the need to design cryptographic tools which provide security in the presence of attackers with access to quantum resources has become unquestionable; the field dealing with these types of protocols is usually referred to as Post-Quantum Cryptography. The U.S. National Institute for Standards and Technology (NIST) launched in 2017 an open call to find suitable post-quantum public-key algorithms for standardization. In this work, we design a GAKE that can be instantiated with any key encapsulation mechanism (KEM) that satisfies the strong security notion IND-CCA, matching NIST’s requirements for this primitive. We have implemented our GAKE with the four finalist KEMs from the NIST process: Classic McEliece, Kyber, NTRU, and Saber, making use of the open-source library LibOQS where these algorithms are provided. We have conducted a detailed comparative performance analysis of the resulting GAKE protocols, taking into account all the parameter sets proposed in the submissions. We have also made a performance analysis of all the involved building pieces, including the four finalist KEMs. Finally, we also compare our GAKE with a previous proposal implemented with Kyber.
Quantum computing poses a threat on current cryptography methods, prompting initiatives such as the U.S. National Institute for Standards and Technology (NIST) standardization process toward developing post-quantum cryptographic tools. This process concentrates on deploying “key encapsulation mechanisms” and “signature schemes”, mainly focusing on Group Authenticated key exchange (GAKE), which is crucial for secure group communication while ensuring authentication is immune to quantum attacks. Despite various two-party key exchange designs adaptable for group key exchange protocols with multiple parties, experts face challenges in secure group interactions in a post-quantum environment due to the lack of such group protocols solutions. Addressing the necessity of secure group communication in IoTs, we proposed a GAKE protocol. This paper presents its design and implementation secure under QROM; we compared our initial findings on the “Saber-based GAKE” with a Kyber-based GAKE implementation named “Complied Kyber” proposed by Pablos, focusing on IoTs. Our findings show better efficiency than “Compiled Kyber” regarding overall communication duration, especially when involving up to 2000 participants in group communication. Furthermore, thorough investigation and calculations confirm the Saber-GAKE protocol’s interoperability with IoT contexts. The protocol has worthy computational efficiency, with execution speeds of 0.064 ms on ARM Cortex-M4 and 1.56 ms on ARM Cortex-M0 systems. The memory use is well below the allowed limits, with 50.86 KB on Cortex-M4 and 35.84 KB on Cortex-M0. The performance data validate that the Saber-GAKE protocol can effectively and safely function on IoT devices with limited resources, offering strong protection against quantum computing assaults.
Abstract Quantum computing poses fascinating challenges for current cryptography, threatening the security of many schemes and protocols widely used today. To adapt to this reality, the U.S. National Institute for Standards and Technology (NIST) is currently running a standardization process in search of post‐quantum (classical, yet resistant to quantum attacks ) cryptographic tools, focusing on signature schemes and key encapsulation mechanisms. Many of the competing proposals also include designs for two‐party key exchange, which can be combined in different ways to fit scenarios involving parties, that is, yielding group key exchange protocols. However, very few implementations of such group protocols are available to practitioners, which face a non‐trivial challenge when deciding how to implement a protocol for establishing secure group sessions in this new post‐quantum scenario. With this in mind, the authors report on the implementation of a secure post‐quantum group key exchange protocol in the so‐called Quantum Random Oracle Model . The protocol decided to implement is based on a KEM called Kyber , which is one of the finalists of the NIST competition. Not only this group construction is the only one available in the literature using a NIST finalist, but also, among all post‐quantum designs the authors are aware of, it uses this strongest security model (as, e.g. in other proposals, the adversarial interaction with the hash functions of the system is assumed to be exclusively classical). Furthermore, experimental evidence is provided supporting this choice in terms of performance, even if the number of involved entities is large (up to 2000). All data and code are publicly available.
In cryptography, key establishment protocols are often the starting point paving the way towards secure execution of different tasks. Namely, the parties seeking to achieve some cryptographic task, often start by establishing a common high-entropy secret that will eventually be used to secure their communication. In this paper, we put forward a security model for group key establishment (GAKE) with an adversary that may execute efficient quantum algorithms, yet only once the execution of the protocol has concluded. This captures a situation in which keys are to be established in the present, while security guarantees must still be provided in the future when quantum resources may be accessible to a potential adversary. Further, we propose a protocol design that can be proven secure in this model. Our proposal uses password authentication and builds upon efficient and reasonably well understood primitives: a message authentication code and a post-quantum key encapsulation mechanism. The hybrid structure dodges potential efficiency downsides, like large signatures, of some “true” post-quantum authentication techniques, making our protocol a potentially interesting fit for current applications with long-term security needs.
Rapid advances in quantum computing, together with the announcement by the National Institute of Standards and Technology (NIST) to define new standards for digitalsignature, encryption, and key-establishment protocols, have created significant interest in post-quantum cryptographic schemes. This paper introduces Kyber (part of CRYSTALS - Cryptographic Suite for Algebraic Lattices - a package submitted to NIST post-quantum standardization effort in November 2017), a portfolio of post-quantum cryptographic primitives built around a key-encapsulation mechanism (KEM), based on hardness assumptions over module lattices. Our KEM is most naturally seen as a successor to the NEWHOPE KEM (Usenix 2016). In particular, the key and ciphertext sizes of our new construction are about half the size, the KEM offers CCA instead of only passive security, the security is based on a more general (and flexible) lattice problem, and our optimized implementation results in essentially the same running time as the aforementioned scheme. We first introduce a CPA-secure public-key encryption scheme, apply a variant of the Fujisaki-Okamoto transform to create a CCA-secure KEM, and eventually construct, in a black-box manner, CCA-secure encryption, key exchange, and authenticated-key-exchange schemes. The security of our primitives is based on the hardness of Module-LWE in the classical and quantum random oracle models, and our concrete parameters conservatively target more than 128 bits of postquantum security.
One-round group authenticated key exchange (GAKE) protocols typically provide implicit authentication and appealing bandwidth efficiency. As a special case of GAKE – the pairing-based one-round tripartite authenticated key exchange (3AKE), recently gains much attention of research community due to its strong security. Several pairing-based one-round 3AKE protocols have recently been proposed to achieve provable security in the g-eCK model. In contrast to earlier GAKE models, the g-eCK model particularly formulates the security properties regarding resilience to the leakage of various combinations of long-term key and ephemeral session state, and provision of weak perfect forward secrecy in a single model. However, the g-eCK security proofs of previous protocols are only given under the random oracle model. In this work, we give a new construction for pairing-based one-round 3AKE protocol which is provably secure in the g-eCK model without random oracles. Security of proposed protocol is reduced to the hardness of Cube Bilinear Decisional Diffie-Hellman (CBDDH) problem for symmetric pairing. We also extend the proposed 3AKE scheme to a GAKE scheme with more than three group members, based on multilinear maps. We prove g-eCK security of our GAKE scheme in the standard model under the natural multilinear generalization of the CBDDH assumption.