Multi-party Key Exchange Protocol and Man inthe Middle Attack

Abhijit Chowdhury, Shubhajit Nath, Jaydeep Howlader

Ministry of Electronics and Information Technology, Government of India, Bashir Alam

The Diffie-Hellman key exchange protocol provides the opportunity to arrive at a common secret key by exchanging texts over insecure medium without meeting in advance. Diffie-Hellman key exchange protocol is limited to the exchange of key only. Due to lack of authentication of entities, this protocol is vulnerable towards man-in-middle attack and impersonation attack. To eliminate the man-in-middle attack, Nanli[9] presented a research paper on Diffie-Hellma key exchange protocol. It is observed that Nanli‟s protocol, still suffers with impersonation attack. To deal with this vulnerability, an improved key exchange approach based on third party authentication scheme is proposed in this paper.

H. K. Pathak, Manju Sanghi

Sida Lin, Qi Xie

Recently, Lu and Cao proposed a novel three-party key exchange protocol. Guo et al pointed out that their protocol cannot resist man-in-the-middle attack and undetectable on-line dictionary attack, and then an improved protocol was proposed in 2008.However, we show that Guo et alpsilas protocol is still vulnerable to undetectable on-line dictionary attack. To overcome the security flaw, an improved scheme is proposed.

Qingchao Yang, Jingjun Lou, Shuyong Liu +1 more

Susmita Mandal, Sujata Mohanty

The paper proposes a multi-party key exchange scheme with Perfect Forward Secrecy (PFS) which ensures that a session key derived from a set of long-term public and private keys used in the protocol to authenticate, does not compromise the secrecy of session key. In this protocol, each group establishes connection by communicating through a trusted third party. The trusted party acts as a group controller generates a public key and broadcasts it among the groups. Each group generate their public keys and send to trusted party. After receiving all the keys the group controller shares it among all the parties to generate the session key. Similarly, each group manager of individual group communicates with the members of the corresponding group. The security of the proposed scheme is analysed rigorously and proved to be resistant against non-repudiation attack, replay attack, chosen cipher attack, man-in-the middle attack. The scheme has wider applications such as, sending encrypted e-mail in a military environment to multiple users, securing submitted bids information in online tender, contract signing by many organizations, etc.