Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Lecture notes in computer science

Comparing the Pre- and Post-specified Peer Models for Key Agreement

Alfred Menezes, Berkant Ustaoğlu

Published Aug 12, 2008• 37 citations
Publisher
DOI
10.1007/978-3-540-70500-0_5

Related papers

Comparing the pre- and post-specified peer models for key agreement

Alfred Menezes, Berkant Ustaoğlu

In the pre-specified peer model for key agreement, it is assumed that a party knows the identifier of its intended communicating peer when it commences a protocol run. On the other hand, a party in the post-specified peer model for key agreement does not know the identifier of its communicating peer at the outset, but learns the identifier during the protocol run. In this article, we compare the security assurances provided by the Canetti-Krawczyk security definitions for key agreement in the pre- and post-specified peer models. We give examples of protocols that are secure in one model, but insecure in the other. We also enhance the Canetti-Krawczyk security models and definitions to encompass a class of protocols that are executable and secure in both the pre- and post-specified peer models.

International Journal of Applied Cryptography•Jan 1, 2009•14 citations

Key agreement protocols and their security analysis

Simon Blake-Wilson⋆⋆, Don B. Johnson, Alfred Menezes

Lecture notes in computer science•Jan 1, 1997•601 citations

Key Agreement Protocols

Colin Boyd, Anish Mathuria

Information security and cryptography•Jan 1, 2003•7 citations

Key establishment --- security models, protocols and usage

Berkant Ustaoğlu

Key establishment is the process whereby two or more parties derive a shared \nsecret, typically used for subsequent confidential communication. However, \nidentifying the exact security requirements for key establishment protocols is \na non-trivial task. This thesis compares, extends and merges existing security \ndefinitions and models for key establishment protocols. \n \nThe primary focus is on two-party key agreement schemes in the public-key \nsetting. On one hand new protocols are proposed and analyzed in the existing \nCanetti-Krawzcyk model. On the other hand the thesis develops a security model \nand novel definition that capture the essential security attributes of the \nstandardized Unified Model key agreement protocol. These analyses lead to the \ndevelopment of a new security model and related definitions that combine and \nextend the Canetti-Krawzcyk pre- and post- specified peer models in terms of \nprovided security assurances. \n \nThe thesis also provides a complete analysis of a one-pass key establishment \nscheme. There are security goals that no one-pass key establishment scheme can \nachieve, and hence the two-pass security models and definitions need to be \nadapted for one-pass protocols. The analysis provided here includes \nthe description of the required modification to the underlying security model. \nFinally, a complete security argument meeting these altered conditions is \npresented as evidence supporting the security of the one-pass scheme. \n \nLastly, validation and reusing short lived key pairs are related to \nefficiency, which is a major objective in practice. The thesis considers the \nformal implication of omitting validation steps and reusing short lived key \npairs. The conclusions reached support the generally accepted cryptographic \nconventions that incoming messages should not be blindly trusted and extra \ncare should be taken when key pairs are reused.

•Jul 30, 2008•3 citations

Key Agreement Protocols

Colin Boyd, Anish Mathuria, Douglas Stebila

Information security and cryptography•Nov 6, 2019•1 citation

Rethinking Definitions of Security for Session Key Agreement.

Wesley George, Charles Rackoff

We consider session key agreement (SKA) protocols operating in a public key infrastructure, with pre-specified peers, that take no session ID as input, and output only a session key. Despite much work on SKA, we argue that there is no good definition of security for this (very natural) protocol syntax. The difficulty is that in this setting the adversary may not be able to tell which processes share a key, and thus which session keys may be revealed without trivializing the security condition. We consider security against adversaries that control all network traffic, can register arbitrary public keys, and can retrieve session keys. We do not attempt to mitigate damage from hardware failures, such as session-state compromise, as we aim to improve our understanding of this simpler setting. We give two natural but substantially different game based definitions of security and prove that they are equivalent. Such proofs are rare for SKA. The bulk of this proof consists of showing that, for secure protocols, only compatible processes can be made to share a key. This property is very natural but surprisingly subtle. For comparison, we give a version of our definition in which processes output session IDs and we give strong theorems relating these two

•Jan 1, 2013•1 citation
In the pre-specified peer model for key agreement, it is assumed that a party knows the identifier of its intended communicating peer when it commences a protocol run. On the other hand, a party in the post-specified peer model for key agreement does not know the identifier of its communicating peer at the outset, but learns the identifier during the protocol run. In this article, we compare the security assurances provided by the Canetti-Krawczyk security definitions for key agreement in the pre- and post-specified peer models. We give examples of protocols that are secure in one model, but insecure in the other. We also enhance the Canetti-Krawczyk security models and definitions to encompass a class of protocols that are executable and secure in both the pre- and post-specified peer models.
Key establishment is the process whereby two or more parties derive a shared \nsecret, typically used for subsequent confidential communication. However, \nidentifying the exact security requirements for key establishment protocols is \na non-trivial task. This thesis compares, extends and merges existing security \ndefinitions and models for key establishment protocols. \n \nThe primary focus is on two-party key agreement schemes in the public-key \nsetting. On one hand new protocols are proposed and analyzed in the existing \nCanetti-Krawzcyk model. On the other hand the thesis develops a security model \nand novel definition that capture the essential security attributes of the \nstandardized Unified Model key agreement protocol. These analyses lead to the \ndevelopment of a new security model and related definitions that combine and \nextend the Canetti-Krawzcyk pre- and post- specified peer models in terms of \nprovided security assurances. \n \nThe thesis also provides a complete analysis of a one-pass key establishment \nscheme. There are security goals that no one-pass key establishment scheme can \nachieve, and hence the two-pass security models and definitions need to be \nadapted for one-pass protocols. The analysis provided here includes \nthe description of the required modification to the underlying security model. \nFinally, a complete security argument meeting these altered conditions is \npresented as evidence supporting the security of the one-pass scheme. \n \nLastly, validation and reusing short lived key pairs are related to \nefficiency, which is a major objective in practice. The thesis considers the \nformal implication of omitting validation steps and reusing short lived key \npairs. The conclusions reached support the generally accepted cryptographic \nconventions that incoming messages should not be blindly trusted and extra \ncare should be taken when key pairs are reused.
We consider session key agreement (SKA) protocols operating in a public key infrastructure, with pre-specified peers, that take no session ID as input, and output only a session key. Despite much work on SKA, we argue that there is no good definition of security for this (very natural) protocol syntax. The difficulty is that in this setting the adversary may not be able to tell which processes share a key, and thus which session keys may be revealed without trivializing the security condition. We consider security against adversaries that control all network traffic, can register arbitrary public keys, and can retrieve session keys. We do not attempt to mitigate damage from hardware failures, such as session-state compromise, as we aim to improve our understanding of this simpler setting. We give two natural but substantially different game based definitions of security and prove that they are equivalent. Such proofs are rare for SKA. The bulk of this proof consists of showing that, for secure protocols, only compatible processes can be made to share a key. This property is very natural but surprisingly subtle. For comparison, we give a version of our definition in which processes output session IDs and we give strong theorems relating these two