ACM ASIA Public-Key Cryptography Workshop (APKC)

Tightly Secure ID-based Authenticated Key Exchange

Takumu Mita, Kazuki Yoneyama

Published Jun 28, 2024• 0 citations

Abstract

In CRYPTO 2021, Han et al. proposed a PKI-based authenticated key exchange (AKE) scheme that satisfies tight security in the standard model by using KEM and digital signature with multi-user security as building blocks. On the other hand, no tightly secure ID-based AKE (ID-AKE) scheme is known. ID-AKE has the advantage that certificate management is unnecessary, and the authentication can be based on the party’s public ID, such as an e-mail address. In this paper, we propose the first tightly secure ID-AKE scheme in the standard model. First, we extend the security model of Han et al.’s PKI-based AKE to the security model for ID-AKE. Next, we introduce a generic construction with multi-user secure KEM and ID-based signature (IBS) as building blocks and prove the tight security in our security model. For instantiating the underlying IBS, we also revisit the security proof of the existing generic construction of tightly secure IBS proposed by Lee et al. We point out a problem in their proof and correct it by strengthening an assumption. As an instantiation of our scheme, a tightly secure ID-AKE scheme under the MDDH assumption can be realized in the standard model.

DOI: 10.1145/3659467.3659903

Related papers

Strongly Secure Authenticated Key Exchange from Factoring, Codes, and Lattices.

Atsushi Fujioka, Koutarou Suzuki, Keita Xagawa +1 more

Abstract. An unresolved problem in research on authenticated key exchange (AKE) is to construct a secure protocol against advanced attacks such as key compromise impersonation and maximal exposure attacks without relying on random oracles. HMQV, a state of the art AKE protocol, achieves both efficiency and the strong security proposed by Krawczyk (we call it the CK + model), which includes resistance to advanced attacks. However, the security proof is given under the random oracle model. We propose a generic construction of AKE from a key encapsulation mechanism (KEM). The construction is based on a chosen-ciphertext secure KEM, and the resultant AKE protocol is CK + secure in the standard model. The construction gives the first CK + secure AKE protocols based on the hardness of integer factorization problem, code-based problems, or learning problems with errors. In addition, instantiations under the Diffie-Hellman assumption or its variant can be proved to have strong security without non-standard assumptions such as πPRF and KEA1. Furthermore, we extend the CK + model to identity-based (called the id-CK + model), and propose a generic construction of identity-based AKE (ID-AKE) based on identity-based KEM, which satisfies id-CK + security. The construction leads first strongly secure ID-AKE protocols under the hardness of integer factorization problem, or learning problems with errors.

Jan 1, 20123 citations

Adaptive-ID Secure Hierarchical ID-Based Authenticated Key Exchange under Standard Assumptions without Random Oracles

Ren Ishibashi, Kazuki Yoneyama

Hierarchical ID-based authenticated key exchange (HID-AKE) is a cryptographic protocol to establish a common session key between parties with authentication based on their IDs with the hierarchical delegation of key generation functionality. All existing HID-AKE schemes are selective ID secure, and the only known standard model scheme relies on a non-standard assumption such as the q-type assumption. In this paper, we propose a generic construction of HID-AKE that is adaptive ID secure in the HID-eCK model (maximal-exposure-resilient security model) without random oracles. One of the concrete instantiations of our generic construction achieves the first adaptive ID secure HID-AKE scheme under the (standard) k-lin assumption in the standard model. Furthermore, it has the advantage that the computational complexity of pairing and exponentiation operations and the communication complexity do not depend on the depth of the hierarchy. Also, the other concrete instantiation achieves the first HID-AKE scheme based on lattices (i.e., post-quantum).

IEICE Transactions on Fundamentals of Electronics Communications and Computer SciencesMar 23, 20221 citation

Practical and Exposure-Resilient Hierarchical ID-Based Authenticated Key Exchange without Random Oracles

Kazuki Yoneyama

ID-based authenticated key exchange (ID-AKE) is a cryptographic tool to establish a common session key between parties with authentication based on their IDs. If IDs contain some hierarchical structure such as an e-mail address, hierarchical ID-AKE (HID-AKE) is especially suitable because of scalability. However, most of existing HID-AKE schemes do not satisfy advanced security properties such as forward secrecy, and the only known strongly secure HID-AKE scheme is inefficient. In this paper, we propose a new HID-AKE scheme which achieves both strong security and efficiency. We prove that our scheme is eCK-secure (which ensures maximal-exposure-resilience including forward secrecy) without random oracles, while existing schemes is proved in the random oracle model. Moreover, the number of messages and pairing operations are independent of the hierarchy depth; that is, really scalable and practical for a large-system.

IEICE Transactions on Fundamentals of Electronics Communications and Computer SciencesJan 1, 20144 citations

Practical and post-quantum authenticated key exchange from one-way secure key encapsulation mechanism

Atsushi Fujioka, Koutarou Suzuki, Keita Xagawa +1 more

This paper discusses how to realize practical post-quantum authenticated key exchange (AKE) with strong security, i.e., CK+ security (Krawczyk, CRYPTO 2005). It is known that strongly secure post-quantum AKE protocols exist on a generic construction from IND-CCA secure key encapsulation mechanisms (KEMs) in the standard model.

ACM Asia Conference on Computer and Communications Security (ASIA CCS)May 8, 201353 citations

Authenticated Key Exchange Protocol in the Standard Model under Weaker Assumptions

Janaka Alawatugoda

A two-party authenticated key exchange (AKE) protocol allows each of the two parties to share a common secret key over insecure channels, even in the presence of active adversaries who can actively control and modify the exchanged messages. To capture the malicious behaviors of the adversaries, there have been many efforts to define security models. Amongst them, the extended Canetti–Krawczyk (eCK) security model is considered one of the strongest security models and has been widely adopted. In this paper, we present a simple construction of a pairing-based eCK-secure AKE protocol in the standard model. Our protocol can be instantiated with a suitable signature scheme (i.e., an existentially unforgeable signature scheme against adaptive chosen message attacks). The underlying assumptions of our construction are the decisional bilinear Diffie–Hellman assumption and the existence of a pseudorandom function. Note that the previous eCK-secure protocol constructions either relied on random oracles for their security or used somewhat strong assumptions, such as the existence of strong-pseudorandom functions, target collision-resistant functions, etc., while our protocol construction uses fewer and more-standard assumptions in the standard model. Furthermore, preserving the same security argument, our protocol can be instantiated with any appropriate signature scheme that comes in the future with better efficiency.

CryptographyJan 5, 20232 citations

Tightly-Secure Authenticated Key Exchange, Revisited.

Tibor Jager, Eike Kiltz, Doreen Riepel +1 more

We introduce new tightly-secure authenticated key exchange (AKE) protocols that are extremely efficient, yet have only a constant security loss and can be instantiated in the random oracle model both from the standard DDH assumption and a subgroup assumption over RSA groups. These protocols can be deployed with optimal parameters, independent of the number of users or sessions, without the need to compensate a security loss with increased parameters and thus decreased computational efficiency.

Jan 1, 20201 citation