Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International Conference on Applied System Innovation

Comments on a Computation-Transferable Authenticated Key Agreement Protocol for Smart Healthcare

Ya‐Fen Chang, Chung-Yi Tsai, Wei‐Liang Tai

Published Apr 21, 2023• 2 citations
Publisher

Abstract

Recently, Wang et al. proposed a computationally transferable authenticated key agreement protocol for smart healthcare by adopting the certificateless public-key cryptography. They claimed that their protocol could ensure privacy, resist various attacks, and possess superior properties. After analyzing their protocol, we find that it suffers from some flaws. Firstly, user privacy is not ensured as claimed. Secondly, some statements are inaccurate or missing. Thirdly, it cannot resist DoS attack. In this paper, the details of how these flaws threaten Wang et al.’s protocol are shown.

DOI
10.1109/icasi57738.2023.10179501

Related papers

On the security of certificateless authenticated key agreement protocol

Mengbo Hou, Qiuliang Xu

Authenticated key agreement protocol is a fundamental building block for ensuring private communications between two or more parties over an insecure network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In the recent work, Wang et al. proposed an efficient two-party certificateless authenticated key agreement protocol from pairings used to protect the Web client/server communication. However, we found the scheme cannot withstand key compromise impersonation attack, and also, is vulnerable to one form of the man-in-the-middle attack -- key replicating attack, thus it doesn't possess some desirable security attributes,such as key compromise impersonation resilience and key integrity. We analyze the key replicating attack against the protocol in the BR93 security model in detail, and demonstrate that the protocol is not secure if the adversary was allowed to send a reveal query to reveal non-partner players who had accepted the same session key.

International Conference on Information Technology in Medicine and Education•Aug 1, 2009•2 citations

An improved certificateless authenticated key agreement protocol

Haomin Yang, Yaoxue Zhang, Yuezhi Zhou

Recently, Mokhtarnameh, Ho, Muthuvelu proposed a certificateless key agreement protocol. In this paper, we show that their protocol is unsecured against a man-in-the-middle attack. In addition, the authors claimed that their scheme provides a binding long-term public key with a corresponding partial private key. In fact, their protocol does not achieve the binding. We propose an improved key agreement protocol based on the protocol proposed by Mokhtarnameh et al. The improved protocol can resist the man-in-the-middle attack as well as satisfy the desired security properties for key agreement. It truly achieves the one-to-one correspondence between the long-term public key and the partial private key of a user. Compared with the other related protocols, the protocol has advantages in both security and computational efficiency.

IEEE International Conference on Communication Technology (ICCT)•Nov 1, 2012•5 citations

Post-Quantum Attribute-Based Authenticated Key Agreement Protocol for Smart Healthcare

Liang Ni, Bingke Gu, Xiaoyan Liu +1 more

With the digitization and networking of medical and health data, intelligent medical devices are widely used to monitor patient health status and provide personalized medical services. However, these devices involve a large amount of personal health data and must ensure data security. The data security and privacy protection in the new complex network environment has become one of the important challenges in the field of healthcare. This study aims to propose a post quantum attribute based authentication key agreement protocol applicable to intelligent healthcare, to address the security risks and risks of medical data communication under traditional cryptographic systems. This new protocol is based on attribute authentication encryption technology without certificates on the grid, which completes mutual authentication and establishes secure communication through attribute and access control policies, and can optimize the deployment of certificate system components in public key infrastructure. Meanwhile, this scheme belongs to the post quantum cryptography protocol and has the ability to resist quantum computing attacks. Based on comprehensive analysis, this scheme can achieve certain advantages in execution efficiency and security, and can provide a more reliable choice for secure communication in the field of intelligent healthcare.

International Conference on Big Data Engineering (BDE)•Jul 24, 2024•0 citations

Cryptanalysis and improvement of two certificateless three-party authenticated key agreement protocols

Haiyan Sun, Qiaoyan Wen, Hua Zhang +2 more

Recently, two certificateless three-party authenticated key agreement protocols were proposed, and both protocols were claimed they can meet the desirable security properties including forward security, key compromise impersonation resistance and so on. Through cryptanalysis, we show that one neither meets forward security and key compromise impersonation resistance nor resists an attack by an adversary who knows all users' secret values, and the other cannot resist key compromise impersonation attack. Finally, we propose improved protocols to make up two original protocols' security weaknesses, respectively. Further security analysis shows that our improved protocols can remove such security weaknesses.

arXiv:1301.5091•Jan 22, 2013•2 citations

A secure and efficient certificateless authenticated key agreement protocol for smart healthcare

Yuqian Ma, Yongliu Ma, Yidan Liu +1 more

Computer Standards & Interfaces•Mar 5, 2023•18 citations

Key Replicating Attack on Certificateless Authenticated Key Agreement Protocol

Mengbo Hou, Qiuliang Xu

Authenticated key agreement protocol is crucial in providing data confidentiality and integrity to subsequent communications among two or more parties over a public network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In 2007, Y.J Shi and J.H Li proposed a two-party authenticated key agreement protocol based on the certificateless encryption scheme proposed by B. Libert and J.J. Quisquater. It is found that the scheme is vulnerable to the key replicating attack (one form of the man-in-the-middle attack), so it doesnpsilat possess the security attribute of implicit key authentication and key control. We analyze such an attack of this protocol in the BR93 model in detail, and demonstrate that the protocol is not secure if the adversary is allowed to send a reveal query to reveal non-partner players who had accepted the same session key.

Asia-Pacific Conference on Information Processing•Jul 1, 2009•6 citations
Recently, Wang et al. proposed a computationally transferable authenticated key agreement protocol for smart healthcare by adopting the certificateless public-key cryptography. They claimed that their protocol could ensure privacy, resist various attacks, and possess superior properties. After analyzing their protocol, we find that it suffers from some flaws. Firstly, user privacy is not ensured as claimed. Secondly, some statements are inaccurate or missing. Thirdly, it cannot resist DoS attack. In this paper, the details of how these flaws threaten Wang et al.’s protocol are shown.
Authenticated key agreement protocol is a fundamental building block for ensuring private communications between two or more parties over an insecure network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In the recent work, Wang et al. proposed an efficient two-party certificateless authenticated key agreement protocol from pairings used to protect the Web client/server communication. However, we found the scheme cannot withstand key compromise impersonation attack, and also, is vulnerable to one form of the man-in-the-middle attack -- key replicating attack, thus it doesn't possess some desirable security attributes,such as key compromise impersonation resilience and key integrity. We analyze the key replicating attack against the protocol in the BR93 security model in detail, and demonstrate that the protocol is not secure if the adversary was allowed to send a reveal query to reveal non-partner players who had accepted the same session key.
Recently, Mokhtarnameh, Ho, Muthuvelu proposed a certificateless key agreement protocol. In this paper, we show that their protocol is unsecured against a man-in-the-middle attack. In addition, the authors claimed that their scheme provides a binding long-term public key with a corresponding partial private key. In fact, their protocol does not achieve the binding. We propose an improved key agreement protocol based on the protocol proposed by Mokhtarnameh et al. The improved protocol can resist the man-in-the-middle attack as well as satisfy the desired security properties for key agreement. It truly achieves the one-to-one correspondence between the long-term public key and the partial private key of a user. Compared with the other related protocols, the protocol has advantages in both security and computational efficiency.
With the digitization and networking of medical and health data, intelligent medical devices are widely used to monitor patient health status and provide personalized medical services. However, these devices involve a large amount of personal health data and must ensure data security. The data security and privacy protection in the new complex network environment has become one of the important challenges in the field of healthcare. This study aims to propose a post quantum attribute based authentication key agreement protocol applicable to intelligent healthcare, to address the security risks and risks of medical data communication under traditional cryptographic systems. This new protocol is based on attribute authentication encryption technology without certificates on the grid, which completes mutual authentication and establishes secure communication through attribute and access control policies, and can optimize the deployment of certificate system components in public key infrastructure. Meanwhile, this scheme belongs to the post quantum cryptography protocol and has the ability to resist quantum computing attacks. Based on comprehensive analysis, this scheme can achieve certain advantages in execution efficiency and security, and can provide a more reliable choice for secure communication in the field of intelligent healthcare.
Recently, two certificateless three-party authenticated key agreement protocols were proposed, and both protocols were claimed they can meet the desirable security properties including forward security, key compromise impersonation resistance and so on. Through cryptanalysis, we show that one neither meets forward security and key compromise impersonation resistance nor resists an attack by an adversary who knows all users' secret values, and the other cannot resist key compromise impersonation attack. Finally, we propose improved protocols to make up two original protocols' security weaknesses, respectively. Further security analysis shows that our improved protocols can remove such security weaknesses.
Authenticated key agreement protocol is crucial in providing data confidentiality and integrity to subsequent communications among two or more parties over a public network. Certificateless public key cryptography (CL-PKC) combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In 2007, Y.J Shi and J.H Li proposed a two-party authenticated key agreement protocol based on the certificateless encryption scheme proposed by B. Libert and J.J. Quisquater. It is found that the scheme is vulnerable to the key replicating attack (one form of the man-in-the-middle attack), so it doesnpsilat possess the security attribute of implicit key authentication and key control. We analyze such an attack of this protocol in the BR93 model in detail, and demonstrate that the protocol is not secure if the adversary is allowed to send a reveal query to reveal non-partner players who had accepted the same session key.