Further Analysis of "Lattice-based key agreement protocol under ring-LWE problem for IoT-enabled smart devices"

Mohammad Reza Saeidi, Hamid Mala

Published Sep 27, 2024• 2 citations

Abstract

Abstract The increasing interconnectedness of devices via the Internet of Things (IoT) highlights the growing importance of addressing IoT security issues. Authenticated Key Agreement (AKA) protocols ensure secure communication between IoT devices, users, and central servers. Preserving anonymity in AKA protocols is especially crucial given privacy issues and user preferences. The emergence of Shor's algorithm in 1994 and recent advancements in quantum computing have posed a threat to the security of classical AKA schemes relying on integer factorization, discrete logarithm, and other number theory problems. Consequently, researchers have turned their attention to developing quantum-resistant AKA schemes. In this context, Rana and Mishra introduced a lattice-based key agreement protocol under ring-LWE problem for IoT-enabled smart devices. However, a thorough security assessment uncovered vulnerabilities in their protocol, specifically susceptibility to replay and Key Compromise Impersonation (KCI) attacks. Furthermore, their approach reveals potential weaknesses in user impersonation if the user's identity is compromised.

DOI: 10.21203/rs.3.rs-4970556/v1

Related papers

Cryptanalysis and improvement of Rana-Mishra's lattice-based key agreement protocol under ring-LWE problem for IoT enabled smart devices

Sonam Yadav, Vivek Dabra, Pradeep Malik +2 more

Abstract Advances in communication technologies as well as the availability of the Internet and Internet of Things (IoT) devices enable users to access various services on the internet. However, open communication with IoT devices can be attacked. Recently, Rana et al. proposed a secure key agreement protocol using RLWE. In this paper, we exploited the vulnerability of Rana et al.'s protocol by using a key mismatch attack. Moreover, it has been shown how an adversary who plays a user's role recovers the server's long-term secret key.

Sep 7, 20223 citations

Quantum-Safe Lattice-Based Certificateless Anonymous Authenticated Key Agreement for Internet of Things

Guanglu Wei, Kai Fan, Kuan Zhang +3 more

In recent years, the Internet of Things (IoT) has gained immense popularity in various aspects of work, learning, and daily life. Within the IoT realm, there is a growing concern regarding communication security issues between users and servers. However, addressing the communication security between servers is equally imperative, which has not received as much attention. To this end, we propose a certificateless anonymous authenticated key agreement (AKA) algorithm based on learning with errors (LWEs) and inhomogeneous small integer solution (ISIS) security assumptions. Our scheme provides strong resistance to quantum attacks and protects the privacy of communication servers. It also has constant communication costs and lower computational requirements than existing lattice-based anonymous AKA algorithms on the broadcast channel. Additionally, the proposed scheme eliminates the resource consumption of managing complex certificates and addresses the security risks associated with key escrow in the key generation center (KGC). Through security and performance analysis, we demonstrate that our approach can enhance the security of IoT-based healthcare systems while significantly improving communication efficiency. Our proposed scheme provides a promising solution to security issues related to server communication in IoT systems.

IEEE Internet of Things JournalOct 13, 202332 citations

Lower rounds lattice-based anonymous AKA under the seCK model for the IoT

Guanglu Wei, Kai Fan, Kuan Zhang +5 more

Abstract The authenticated key agreement (AKA) method used in the Internet of Things (IoT) provides identity authentication and agreed symmetric keys to encrypt large amounts of communication messages for devices and servers. With the development of the quantum computing techniques and corresponding algroithms, classical authenticated key agreement methods based on public key, such as RSA and ECC become vulnerable. Many scholars have proposed lattice-based authenticated key agreement schemes to achieve post-quantum security and address this issue. However, these scheme's security models (such as BR, CK, and ROR) only can capture limited types of adversary attacks and require many communication rounds. To this end, we propose a lower communication rounds lattice-based anonymous authenticated key agreement (LA-AKA) protocol under the seCK model, which can capture a wider range of adversary attacks. The LA-AKA scheme utilizes an identity-based public key system for key agreement, and this system avoids complex resource consumption caused by certificate verification. During the identity authentication and key agreement phase, the communication entities do not need to transmit static public keys; they only need to engage in two communication rounds to generate the session key. Furthermore, the LA-AKA scheme can resist signal leakage attacks caused by key reuse in the ring learning with errors (RLWE) security assumption. The LA-AKA scheme provides higher security, as security analysis proves. The performance evaluation shows that as the number of devices and servers in the system increases, the computational advantage of the LA-AKA scheme in the broadcast channel becomes more significant.

Peer-to-Peer Networking and ApplicationsApr 17, 20244 citations

Big Data Analytics-Envisioned Quantum-Safe Lattice-Based Three-Party Authenticated Key Agreement Protocol for Cloud IoT-Enabled Healthcare Applications

Prithwi Bagchi, Aakash Roy, Mohammad Wazid +3 more

Cloud-based Internet of Things (IoT)-enabled smart healthcare plays a vital role in modern society, yet security and privacy challenges remain unavoidable. The authenticated key agreement (AKA) process, which serves as the foundation of secure communication, is widely recognized as a key solution to these challenges. However, many existing AKA methods in the literature either involve high communication and computational costs or fail to withstand quantum attacks. Post-quantum cryptography (PQC) introduces a new class of cryptographic algorithms designed to resist future quantum computer threats. In this article, we present a quantum-secure, lattice-based three-party AKA scheme for smart IoT healthcare applications, leveraging the computationally complex Ring-Learning With Errors (Ring-LWE) problem. Our approach integrates secure big-data analytics with blockchain technology by utilizing authentication procedures for secure data aggregation before storing it in the blockchain. A comprehensive security evaluation including formal and informal analysis, demonstrates the scheme's strong resilience against both classical and quantum attacks. Additionally, experimental results confirm that the proposed scheme is well-suited for real-time smart healthcare applications.

IEEE Transactions on Dependable and Secure ComputingSep 3, 20257 citations

Lattice-Based Three Party Authenticated Key Agreement Scheme in Medical IoT for Post-Quantum Environment

Arman Ahmad, S. Jagatheswari

Rapid advancement in Internet of Things(IoT) changes the way people work and live deliberately. Medical IoT (MIoT) is a highly significant application in the world of IoT, allowing the user to communicate with smart medical devices with the help of a hospital gateway node. To establish a private communication channel, a three-party authenticated key agreement (AKA) technique using public-key cryptography is used. Currently, the AKA algorithms used in MIoT are based on classical cryptography such as ElGamal, RSA, ECC, etc. All of these techniques have become obsolete in the post-quantum environment as the Shor algorithm can solve these techniques on quantum computers. To overcome the problem stated above, a scheme called Lattice based Three party authenticated key agreement scheme in Medical IoT is proposed to accomplish security and efficiency in a post-quantum environment. Formal and informal security analysis is given to authenticate the protocol’s security. Also, the security analysis is conducted formally with the help of the Random Oracle Model (ROM) and ProVerif tool. The suggested scheme is compared to existing schemes in terms of security features, computing costs, and communication costs to evaluate the system’s performance. It validates that the suggested scheme exceeds the existing schemes.

IEEE AccessJan 1, 202424 citations

Post-Quantum Lattice-Based Secure Reconciliation Enabled Key Agreement Protocol for IoT

Dharminder Dharminder, Challa Bhageeratha Reddy, Ashok Kumar Das +2 more

The authenticated key agreement is one of the major security services that can be used to secure an Internet of Things (IoT) environment, where the devices collect the data and the data is then aggregated at the cloud server, and then a user needs to access the data stored at the server(s) securely. For this purpose, after a mutual authentication performed between a user and the accessed server, a session key needs to be established among them for secure communication. In this article, we design an efficient lattice-based authenticated key exchange protocol using ring-based version of learning with errors assumption for the IoT-enabled smart devices. The proposed protocol is basically a key exchange that uses the reconciliation mechanism. The detailed security analysis under the standard model has been performed along with the informal security analysis to show that the proposed protocol is robust against different attacks. We then simulate the proposed protocol under the NS-3 simulator to measure the network performance parameters like network throughput and latency. A comparative analysis shows that the proposed protocol has superior security, less computational cost, and comparable communication cost when compered these parameters with the other competing schemes.

IEEE Internet of Things JournalOct 12, 202261 citations