The term cryptographic protocol was briefly introduced to us in footnote 2.24 on page 101. This chapter is devoted to studying several particular such protocols including: key establishment; key agreement; identification; commitment; secret sharing; electronic voting; protocol layer analysis with SSL as an Internet protocol providing authentication and secrecy for session-based communications; and we conclude with digital cash schemes and e-commerce.
The term cryptographic protocol was briefly introduced to us in footnote 2.24 on page 101. This chapter is devoted to studying several particular such protocols including: key establishment; key agreement; identification; commitment; secret sharing; electronic voting; protocol layer analysis with SSL as an Internet protocol providing authentication and secrecy for session-based communications; and we conclude with digital cash schemes and e-commerce.
This chapter considers key establishment protocols and related cryptographic techniques which provide shared secrets between two or more parties, typically for subsequent use as symmetric keys for a variety of cryptographic purposes including encryption, message authentication, and entity authentication. The main focus is two-party key establishment, with the aid of a trusted third party in some cases. While many concepts extend naturally to multi-party key establishment including conference keying protocols, such protocols rapidly become more complex, and are considered here only briefly, as is the related area of secret sharing. Broader aspects of key management, including distribution of public keys, certificates, and key life cycle issues, are deferred to Chapter 13 .
Key exchange protocols, first introduced by Diffie and Hellman in 1976, are one of the most widely-deployed cryptographic protocols. They allow two parties, that have never interacted before, to establish shared secrets. These shared cryptographic keys may subsequently be used to establish a secure communication channel. Use cases include the classic client-server setting that is for example at play when browsing the internet, but also chats via end-to-end-encrypted instant messaging applications. Security-wise, we generally demand of key exchange protocols to achieve key secrecy and authentication. While, informally, authentication ensures that the communicating parties have confidence in the identity of their peers, key secrecy ensures that any shared cryptographic key that is established via the key exchange protocol is only known to the participants in the protocol and can be used securely in cryptographic protocols, i.e., is sufficiently random. In 1993, Bellare and Rogaway gave a first formalization of key exchange protocol security that captures these properties with respect to powerful adversaries with full control over the network. Their model constitutes the basis of the many subsequent treatments of authenticated key exchange security, including the models presented in this thesis. The common methodological approach underlying all of these formalizations is the provable security paradigm, which has become a standard tool in assessing the security of cryptographic protocols and primitives. So-called security models specify the expected security guarantees of the scheme in question with regards to a well-defined class of adversaries. Proofs that validate these security claims do so by reducing the security of the overall scheme to the security of the underlying cryptographic primitives and hardness assumptions. However, advances in computational power and more sophisticated cryptanalytic capabilities often render exactly these components insecure. Especially the advent of quantum computers will have a devastating effect on much of today's public key cryptography. This is especially true for key exchange protocols since they rely crucially on public-key algorithms. In this thesis, our focus in future-proofing key exchange protocols is two-fold. First, we focus on extending security models for key exchange protocols to capture the (un)expected break of cryptographic primitives and hardness assumptions. The aim is to gain assurances with respect to future adversaries and to investigate the effects of primitive failures on key exchange protocols. More specifically, we explore how key exchange protocols can be safely transitioned to new, post-quantum secure algorithms with hybrid techniques. Hybrids combine classical and post-quantum algorithms such that the overall key agreement scheme remains secure as long as one of the two base schemes remains secure. For this, we introduce security notions for key encapsulation mechanisms that account for adversaries with varying levels of quantum capabilities and present three new constructions for hybrid key encapsulation mechanisms. Our hybrid designs are practice-inspired and for example capture draft proposals for hybrid modes in the Transport Layer Security (TLS) protocol, which is one of the most widely-deployed cryptographic protocols that enables key agreement. Furthermore, our notion of breakdown resilience for key exchange protocols allows to gauge the security of past session keys in the event of a failure of a cryptographic component in the key exchange. We exercise our model on variants of the post-quantum secure key exchange protocol NewHope by Alkim et al. Thereby, we confirm the intuition that, in order to guard against adversaries that only have access to quantum computing power in the (more distant) future, it is sufficient to use classically-secure authentication mechanisms alongside post-quantum key agreement to achieve authenticated key exchange. As with any mathematical statement, theorems in the provable security paradigm are only as valid as the underlying assumptions. A careful consideration of any newly made assumption is thus essential to ensure the meaningfulness of the statement itself and make the assumption a viable tool for future analyses. Thus, secondly, we systematically classify the PRF-ODH assumption, a complexity-theoretic hardness assumption that has been used in key exchange security analyses of such prominent protocols as TLS, Signal, and Wireguard. In particular, we give a unified, parametrized definition of the assumption encompassing different variants that are present in the literature. We relate the resulting parametrized notions in terms of their strength and show where these assumptions fit in the collection of well-understood related hardness assumptions. We finally sketch our result on the impossibility of instantiating this assumption in the standard model, thereby disposing of the uncertainty in the community whether PRF-ODH is in fact a standard model assumption, i.e., removes the usage of some idealized assumptions in key exchange protocol proofs.
For a secure communication through the public network, cryptographic encryption must be applied. The key establishment issue is the most important part in cryptographic encryption. Only the legitimate principals who have the key can encrypt messages and decrypt cryptograms. A secure multi-party communication held through the public network can only take place after a multi-party key establishment protocol has been executed. The multi-party key establishment protocol is designed so that the principals can receive a common key and use it to securely exchange the messages.\nIn this thesis, the secure multi-party key establishment protocols are discussed. W e start from investigating properties of two-party key establishment protocols such as motivation of using session key, adversaries in the protocols, attacks of the protocol and security analysis of the protocol. Then we give the requirements of a multi-party key establishment protocol and summarize about what should be considered in designing a multi-party key establishment protocol. After that we review some of the previous proposed multi-party key establishment protocol. The existing multi-party key establishment protocols are either impractical ( not efficient enough) or missing some important security goals such as authentication of principals. Three new protocols are proposed in this thesis. The first protocol addresses how to hold a conference for members of two hierarchical groups in an efficient way. The message broadcasting is used to reduce the cost of secure message transport.\nThe second and the third protocols manage the authentication problem by using a secret sharing scheme. We replace the principal authentication with the group authentication so that the computational overhead and communication overhead will be reduced especially in reuse of the protocol for new communication. Again, message broadcasting is used for replacing the expansive secure communication channel.\nPart of this thesis appeared in ACSC'99(Australian Computer Science Conference) and ACISP'99(Australian Conference of Information Security and Privacy).
This chapter is concerned with cryptographic protocols. We begin with an explanation of what components a cryptographic protocol consists of. We then illustrate the complexity of designing a secure cryptographic protocol by considering an artificially simple scenario, for which we propose and analyse seven candidate protocols. For each of these protocols, we comment on whether, or under which conditions, they meet the required specification. We go on to look at the important class of authentication and key establishment protocols. We identify typical goals and examine some important protocols in this class, including the Diffie–Hellman protocol.
ABSTRACT A three‐party post‐quantum key agreement protocol involves server with two communicating parties securely agreeing on a shared secret key in a way that is resistant to quantum attacks. Once the shared secret key is shared using authenticated key agreement protocol, then user (A), and user (B) can use it for securing communication channel using symmetric‐key encryption AES‐256 algorithm. Although there are few third‐party post‐quantum authenticated and key agreement schemes exist, but the recent studies in this paper illustrates that they are not satisfying properties like unlinkability, anonymity, perfect forward secrecy, and signal leakage attacks. Therefore, the proposed protocol ensures anonymity, unlinkablity, perfect forward secrecy, and resistant against signal leakage attacks. The proposed protocol uses different random numbers for each of sessions and ensures freshness of the session key to maintain forward secrecy. In this protocol, the user (A) only communicates with server, and establish an authenticated session key with user (B) which avoids server overheads. The use of ring learning with errors (RLWE) instead of the simpler learning with errors (LWE) is primarily motivated by the need for efficiency, compactness, and scalability in cryptographic applications. A comparative study, including both performance and security assessments, demonstrates that the proposed design is more secure and efficient.