Constructing group key agreement protocols using mKEMs

Konstantina Papadopoulou

Published Feb 26, 2018• 0 citations

Abstract

Over the last few years, researchers have introduced many group key agreement protocols, aiming to construct new efficient schemes in terms of both computation and communication. Group key agreement protocols aim to derive a common session key among a group of users, which will be used later in order to achieve secure communication between them. In this thesis, we provide a complete analysis of the protocols that have already been introduced in the literature from 2010 until now and require only one round. The main goal of this analysis is to evaluate these protocols in both communication and computation cost, in order to provide a comprehensive comparative analysis. The second part of the thesis is to analyze and evaluate the multi key encapsulation mechanisms that exist in the literature. A multi key encapsulation mechanism is the encryption technique by which a symmetric cryptographic algorithm is combined with an asymmetric one. To be more specific, such a mechanism uses an asymmetric cryptographic algorithm, as a method to encrypt the session key, while the key is derived by a symmetric cryptographic algorithm. Finally, we propose two new group key agreement protocols which use the multi key encapsulation mechanisms, and compare them with existing group key agreement protocols. These constructions are based on a generic methodology for creating a group key exchange protocol by using multi key encapsulation mechanisms. For this reason, emphasis has been given to both one round group key agreement protocols and multi key encapsulation mechanisms, in order to examine the possibility of combining them

DOI: 10.26215/heal.uoa.6752

Related papers

Design and analysis of group key exchange protocols

M. Choudary Gorantla

A group key exchange (GKE) protocol allows a set of parties to agree upon a common secret session key over a public network. In this thesis, we focus on designing efficient GKE protocols using public key techniques and appropriately revising security models for GKE protocols. For the purpose of modelling and analysing the security of GKE protocols we apply the widely accepted computational complexity approach. The contributions of the thesis to the area of GKE protocols are manifold. We propose the first GKE protocol that requires only one round of communication and is proven secure in the standard model. Our protocol is generically constructed from a key encapsulation mechanism (KEM). We also suggest an efficient KEM from the literature, which satisfies the underlying security notion, to instantiate the generic protocol. We then concentrate on enhancing the security of one-round GKE protocols. A new model of security for forward secure GKE protocols is introduced and a generic one-round GKE protocol with forward security is then presented. The security of this protocol is also proven in the standard model. We also propose an efficient forward secure encryption scheme that can be used to instantiate the generic GKE protocol. Our next contributions are to the security models of GKE protocols. We observe that the analysis of GKE protocols has not been as extensive as that of two-party key exchange protocols. Particularly, the security attribute of key compromise impersonation (KCI) resilience has so far been ignored for GKE protocols. We model the security of GKE protocols addressing KCI attacks by both outsider and insider adversaries. We then show that a few existing protocols are not secure against KCI attacks. A new proof of security for an existing GKE protocol is given under the revised model assuming random oracles. Subsequently, we treat the security of GKE protocols in the universal composability (UC) framework. We present a new UC ideal functionality for GKE protocols capturing the security attribute of contributiveness. An existing protocol with minor revisions is then shown to realize our functionality in the random oracle model. Finally, we explore the possibility of constructing GKE protocols in the attribute-based setting. We introduce the concept of attribute-based group key exchange (AB-GKE). A security model for AB-GKE and a one-round AB-GKE protocol satisfying our security notion are presented. The protocol is generically constructed from a new cryptographic primitive called encapsulation policy attribute-based KEM (EP-AB-KEM), which we introduce in this thesis. We also present a new EP-AB-KEM with a proof of security assuming generic groups and random oracles. The EP-AB-KEM can be used to instantiate our generic AB-GKE protocol.

Faculty of Science and Technology; Information Security InstituteJan 1, 20101 citation

On Constructing Dynamic and Forward Secure Authenticated Group Key Agreement Scheme from Multikey Encapsulation Mechanism

Iraj Fathirad, John C. Devlin

The approach of instantiating authenticated group key exchange (GAKE) protocol from the multikey encapsulation mechanism (mKEM) has an important advantage of achieving classical requirement of GAKE security in one communication round. In spite of the limitations of this approach, for example, lack of forward secrecy, it is very useful in group environments when maximum communication efficiency is desirable. To enrich this mKEM-based GAKE construction, we suggest an efficient solution to convert this static GAKE framework into a partially dynamic scheme. Furthermore, to address the associated lack of forward-secrecy, we propose two variants of this generic construction which can also provide a means of forward secrecy at the cost of extra communication round. In addition, concerning associated implementation cost of deploying this generic GAKE construction in elliptic curve cryptosystem, we compare the possible instantiations of this model from existing mKEM algorithms in terms of the number of elliptic curve scalar multiplications.

The Scientific World JOURNALJan 1, 20151 citation

Secure Session Framework: An Identity-based Cryptographic Key Agreement and Signature Protocol

Christian Schridde

Cryptographic protocols are used to encrypt data during their transmission over a network or to store it on a data carrier. This thesis is about the method of identity-based encryption. In this form of encryption, the name or identity of the target subject is used to encrypt the data. This property makes it a perfect tool for modern electronic communication, because all involved identities and endpoint addresses (e.g. IP addresses) have to be unique worldwide and must be known in order to establish a communication. The identity-based key agreement protocol that has been invented in this thesis has several advantages compared to existing schemes. One important property is its complete independence of key generators. This independence allows each participating security domain to set up and maintain its own key generator. They are not forced to agree on a common setup or a common secret anymore. Due to the properties of the protocol, the security domains are still compatible to each other. Users from one security domain can communicate with users from another security domain using encryption. This new property of independence is also carried over to a signature protocol. It allows users from different security domains to sign a certain object. Additionally, the act of signing is independent and the signers do not need to communicate with each other. Apart from the protocol and its security proofs with respect to standard definitions from the literature, the thesis contains an analysis of existing schemes. Attacks on known protocols and assumptions are presented, and it is shown under which circumstances these become insecure. On the one hand, a completely new approach that is based on defined or rather undefined objects in discrete structures is used. On the other hand, the method of lattice based reduction is successfully applied to the new area of secret sharing schemes. Finally, application scenarios for the protocol are presented. These scenarios are chosen such that the advantages of the protocol become apparent. Cryptographic protocols are used to encrypt data during their transmission over a network or to store it on a data carrier. This thesis is about the method of identity-based encryption. In this form of encryption, the name or identity of the target subject is used to encrypt the data. This property makes it a perfect tool for modern electronic communication, because all involved identities and endpoint addresses (e.g. IP addresses) have to be unique worldwide and must be known in order to establish a communication. The identity-based key agreement protocol that has been invented in this thesis has several advantages compared to existing schemes. One important property is its complete independence of key generators. This independence allows each participating security domain to set up and maintain its own key generator. They are not forced to agree on a common setup or a common secret anymore. Due to the properties of the protocol, the security domains are still compatible to each other. Users from one security domain can communicate with users from another security domain using encryption. This new property of independence is also carried over to a signature protocol. It allows users from different security domains to sign a certain object. Additionally, the act of signing is independent and the signers do not need to communicate with each other. Apart from the protocol and its security proofs with respect to standard definitions from the literature, the thesis contains an analysis of existing schemes. Attacks on known protocols and assumptions are presented, and it is shown under which circumstances these become insecure. On the one hand, a completely new approach that is based on defined or rather undefined objects in discrete structures is used. On the other hand, the method of lattice based reduction is successfully applied to the new area of secret sharing schemes. Finally, application scenarios for the protocol are presented. These scenarios are chosen such that the advantages of the protocol become apparent. The first application is telephony, GSM as well as Voice over IP (VoIP). In this case, the telephone number of the callee is used as the encryption key. Implementations on a modern mobile phone as well as within existing Voice over IP software are presented. The second application is IP networks. Here, the IP address of a communication unit is used as the encryption key. However, in this case, there are more problems than in the GSM/VoIP case, e.g., dynamic IP addresses or network address translation (NAT) where an IP address is substituted by another one. These are only two problems out of several for which solutions are presented.

Aug 10, 20100 citations

Group key agreement from bilinear pairings

Nicholas J Mailloux

The use of bilinear pairings as a building block for cryptographic protocols, most notably in the construction of identity-based cryptosystems, is a very popular area of cryptographic research. In this thesis, we provide a novel classification of pairing-based group key agreement (GKA) from current literature. We propose a new framework for constructing secure and efficient computationally asymmetric authenticated GKA protocols from identity-based signcryption schemes and adapt this framework to construct a novel identity-based authenticated GKA protocol with perfect forward secrecy. To the best of our knowledge, our protocol is the first that maintains perfect forward secrecy in the presence of auxiliary key agreement protocols. We formally prove the security of our protocols in the random oracle model and show that they are communication and computationally efficient in comparison to the pairing-based protocols from the literature.

Jan 1, 20090 citations

Secure multi-party key establishment

Chih-Hung Li

For a secure communication through the public network, cryptographic encryption must be applied. The key establishment issue is the most important part in cryptographic encryption. Only the legitimate principals who have the key can encrypt messages and decrypt cryptograms. A secure multi-party communication held through the public network can only take place after a multi-party key establishment protocol has been executed. The multi-party key establishment protocol is designed so that the principals can receive a common key and use it to securely exchange the messages.\nIn this thesis, the secure multi-party key establishment protocols are discussed. W e start from investigating properties of two-party key establishment protocols such as motivation of using session key, adversaries in the protocols, attacks of the protocol and security analysis of the protocol. Then we give the requirements of a multi-party key establishment protocol and summarize about what should be considered in designing a multi-party key establishment protocol. After that we review some of the previous proposed multi-party key establishment protocol. The existing multi-party key establishment protocols are either impractical ( not efficient enough) or missing some important security goals such as authentication of principals. Three new protocols are proposed in this thesis. The first protocol addresses how to hold a conference for members of two hierarchical groups in an efficient way. The message broadcasting is used to reduce the cost of secure message transport.\nThe second and the third protocols manage the authentication problem by using a secret sharing scheme. We replace the principal authentication with the group authentication so that the computational overhead and communication overhead will be reduced especially in reuse of the protocol for new communication. Again, message broadcasting is used for replacing the expansive secure communication channel.\nPart of this thesis appeared in ACSC'99(Australian Computer Science Conference) and ACISP'99(Australian Conference of Information Security and Privacy).

Jan 1, 20000 citations

Security Analysis Approaches for Group Key Agreement Protocols

Wei Da-wei

Group Key agreement allows multi users to establish a common session key though insecure channels.Designing secure group key agreement protocols is one of the most fundamental cryptographic tasks.This paper introduced two approaches developed for analyzing security group key agreement protocols:computational complexity approach and formal analysis approach.The key technologies of computational complexity approach were discussed,including the proof technology based on reduction and simulatability,and security models based on reduction and simulatability.The trends in this field were presented.

Jan 1, 20110 citations