Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

On robust key agreement based on public key authentication

F Hao

Published Jan 1, 2014• 0 citations
Publisher

Abstract

This paper discusses public-key authenticated key agreement protocols. First, we critically analyze several authenticatedkey agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks onthe HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one shouldtake when interpreting theoretical results from a formal model. We further point out that many of the protocol failures inthe past are caused by sidestepping an important engineering principle, namely “Do not assume that a message you receivehas a particular form (such as g^r for known r) unless you can check this”. Constructions in the past generally resistedthis principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive.In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocoldesign and meanwhile achieve good efficiency. Our new key agreement protocol, YAK, has comparable computationalefficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, ourprotocol appears to be the simplest so far. We believe simplicity is also an important engineering principle.

DOI
10.25405/ncl.34178064

Related papers

On robust key agreement based on public key authentication

Feng Hao

This paper discusses public key-authenticated key agreement protocols. First, we critically analyze several authenticated key agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks on the Hashed Menezes-Qu-Vanstone HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one should take when interpreting theoretical results from a formal model. We further point out that many of the protocol failures in the past are caused by sidestepping an important engineering principle, namely, Do not assume that a message you receive has a particular form such as gr for known r unless you can check this. Constructions in the past generally resisted this principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive. In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocol design and, meanwhile, achieve good efficiency. Our new key agreement protocol, YAK, has comparable computational efficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, our protocol appears to be the simplest so far. We believe simplicity is also an important engineering principle. Copyright © 2012 John Wiley & Sons, Ltd.

Security and Communication Networks•Apr 18, 2012•7 citations

Cryptanalysis of a robust key agreement based on public key authentication

Mohsen Toorani

Abstract This paper considers security analysis of the YAK, a public key‐based authenticated key agreement protocol. The YAK protocol is a variant of the two‐pass HMQV protocol but uses zero‐knowledge proofs for proving knowledge of ephemeral values. In this paper, we show that the YAK protocol lacks joint key control and perfect forward secrecy attributes and is vulnerable to some attacks including unknown key‐share and key‐replication attacks. This invalidates the semantic security of the protocol in several security models. There are also other considerations regarding the impersonation and small subgroup attacks. Copyright © 2015 John Wiley & Sons, Ltd.

Security and Communication Networks•Oct 30, 2015•5 citations

Authenticated Key Agreement Protocols: A Comparative Study

Areej Omar Baalghusun, Olfa Abusalem, Zahra Abbas Al Abbas +1 more

One of the most important and challenging cryptographic primitives in Public Key Cryptography is Key Agreement Protocol where two or more parties share secret values and establish the session key. Many authors have proposed key agreement protocols. In this article, we have viewed some authenticated Key Agreement Protocols and presented a comparative study. We have also described the design principle, security requirement and various attacks on Key Agreement Protocol.

Journal of Information Security•Jan 1, 2015•3 citations

Cryptanalysis and improvement of the YAK protocol with formal security proof and security verification via Scyther

Zeyad Mohammad

Summary Hao proposed the YAK as a robust key agreement based on public‐key authentication, and the author claimed that the YAK protocol withstands all known attacks and therefore is secure against an extremely strong adversary. However, Toorani showed the security flaws in the YAK protocol. This paper shows that the YAK protocol cannot withstand the known key security attack, and its consequences lead us to introduce a new key compromise impersonation attack, where an adversary is allowed to reveal both the shared static secret key between two‐party participation and the ephemeral private key of the initiator party in order to mount this attack. In addition, we present a new security model that covers these attacks against an extremely strong adversary. Moreover, we propose an improved YAK protocol to remedy these attacks and the previous attacks mentioned by Toorani on the YAK protocol, and the proposed protocol uses a verification mechanism in its block design that provides entity authentication and key confirmation. Meanwhile, we show that the proposed protocol is secure in the proposed formal security model under the gap Diffie‐Hellman assumption and the random oracle assumption. Moreover, we verify the security of the proposed protocol and YAK protocol by using an automatic verification method such as the Scyther tool, and the verification result shows that the security claims of the proposed protocol are proven, in contrast to those of the YAK protocol, which are not proven. The security and performance comparisons show that the improved YAK protocol outperforms previous related protocols.

International Journal of Communication Systems•Mar 11, 2020•12 citations

Obtaining a secure and efficient key agreement protocol from (H)MQV and NAXOS.

Berkant Ustaoğlu

LaMacchia, Lauter and Mityagin recently presented a strong security definition for authenticated key agreement strengthening the well-known Canetti-Krawczyk definition. They also described a protocol, called NAXOS, that enjoys a simple security proof in the new model. Compared to MQV and HMQV, NAXOS is less efficient and cannot be readily modified to obtain a one-pass protocol. On the other hand MQV does not have a security proof, and the HMQV security proof is extremely complicated. This paper proposes a new authenticated key agreement protocol, called CMQV (‘Combined’ MQV), which incorporates design principles from MQV, HMQV and NAXOS. The new protocol achieves the efficiency of HMQV and admits a natural one-pass variant. Moreover, we present a simple and intuitive proof that CMQV is secure in the LaMacchia-Lauter-Mityagin model.

•Jan 1, 2007•1 citation

Secure and Efficient Two-Party Authenticated Key Agreement Protocol from Certificateless Public Key Encryption Scheme

Mengbo Hou, Qiuliang Xu

As the fundamental building block for secure communication in the open network, authenticated key agreement protocols are usually constructed in the public key setting. Certificateless public key cryptography combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In this paper, we present a secure and efficient two-party authenticated key agreement protocol based on the efficient certificateless public key encryption scheme due to Cheng and Comley. Security analysis shows that it achieves perfect forward secrecy, PKG forward secrecy and almost all the other known security attributes for authenticated key agreement protocol, such as known-key secrecy, key-compromise impersonation resilience, unknown key-share resilience, known session-specific temporary information security, message independence and no key control. Compared to other comparable schemes, it is more secure and has nice efficiency.

International Joint Conference on INC, IMS and IDC (NCM)•Jan 1, 2009•4 citations
This paper discusses public-key authenticated key agreement protocols. First, we critically analyze several authenticatedkey agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks onthe HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one shouldtake when interpreting theoretical results from a formal model. We further point out that many of the protocol failures inthe past are caused by sidestepping an important engineering principle, namely “Do not assume that a message you receivehas a particular form (such as g^r for known r) unless you can check this”. Constructions in the past generally resistedthis principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive.In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocoldesign and meanwhile achieve good efficiency. Our new key agreement protocol, YAK, has comparable computationalefficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, ourprotocol appears to be the simplest so far. We believe simplicity is also an important engineering principle.
This paper discusses public key-authenticated key agreement protocols. First, we critically analyze several authenticated key agreement protocols and uncover various theoretical and practical flaws. In particular, we present two new attacks on the Hashed Menezes-Qu-Vanstone HMQV protocol, which is currently being standardized by IEEE P1363. These attacks suggest the caution one should take when interpreting theoretical results from a formal model. We further point out that many of the protocol failures in the past are caused by sidestepping an important engineering principle, namely, Do not assume that a message you receive has a particular form such as gr for known r unless you can check this. Constructions in the past generally resisted this principle on the grounds of efficiency: checking the knowledge of the exponent is commonly seen as too expensive. In a concrete example, we demonstrate how to effectively integrate the zero-knowledge proof primitive into the protocol design and, meanwhile, achieve good efficiency. Our new key agreement protocol, YAK, has comparable computational efficiency to the MQV and HMQV protocols with clear advantages on security. Among all the related techniques, our protocol appears to be the simplest so far. We believe simplicity is also an important engineering principle. Copyright © 2012 John Wiley & Sons, Ltd.
Abstract This paper considers security analysis of the YAK, a public key‐based authenticated key agreement protocol. The YAK protocol is a variant of the two‐pass HMQV protocol but uses zero‐knowledge proofs for proving knowledge of ephemeral values. In this paper, we show that the YAK protocol lacks joint key control and perfect forward secrecy attributes and is vulnerable to some attacks including unknown key‐share and key‐replication attacks. This invalidates the semantic security of the protocol in several security models. There are also other considerations regarding the impersonation and small subgroup attacks. Copyright © 2015 John Wiley & Sons, Ltd.
Summary Hao proposed the YAK as a robust key agreement based on public‐key authentication, and the author claimed that the YAK protocol withstands all known attacks and therefore is secure against an extremely strong adversary. However, Toorani showed the security flaws in the YAK protocol. This paper shows that the YAK protocol cannot withstand the known key security attack, and its consequences lead us to introduce a new key compromise impersonation attack, where an adversary is allowed to reveal both the shared static secret key between two‐party participation and the ephemeral private key of the initiator party in order to mount this attack. In addition, we present a new security model that covers these attacks against an extremely strong adversary. Moreover, we propose an improved YAK protocol to remedy these attacks and the previous attacks mentioned by Toorani on the YAK protocol, and the proposed protocol uses a verification mechanism in its block design that provides entity authentication and key confirmation. Meanwhile, we show that the proposed protocol is secure in the proposed formal security model under the gap Diffie‐Hellman assumption and the random oracle assumption. Moreover, we verify the security of the proposed protocol and YAK protocol by using an automatic verification method such as the Scyther tool, and the verification result shows that the security claims of the proposed protocol are proven, in contrast to those of the YAK protocol, which are not proven. The security and performance comparisons show that the improved YAK protocol outperforms previous related protocols.
LaMacchia, Lauter and Mityagin recently presented a strong security definition for authenticated key agreement strengthening the well-known Canetti-Krawczyk definition. They also described a protocol, called NAXOS, that enjoys a simple security proof in the new model. Compared to MQV and HMQV, NAXOS is less efficient and cannot be readily modified to obtain a one-pass protocol. On the other hand MQV does not have a security proof, and the HMQV security proof is extremely complicated. This paper proposes a new authenticated key agreement protocol, called CMQV (‘Combined’ MQV), which incorporates design principles from MQV, HMQV and NAXOS. The new protocol achieves the efficiency of HMQV and admits a natural one-pass variant. Moreover, we present a simple and intuitive proof that CMQV is secure in the LaMacchia-Lauter-Mityagin model.
As the fundamental building block for secure communication in the open network, authenticated key agreement protocols are usually constructed in the public key setting. Certificateless public key cryptography combines the advantage of the identity-based public key cryptography (ID-PKC) and the traditional PKI. In this paper, we present a secure and efficient two-party authenticated key agreement protocol based on the efficient certificateless public key encryption scheme due to Cheng and Comley. Security analysis shows that it achieves perfect forward secrecy, PKG forward secrecy and almost all the other known security attributes for authenticated key agreement protocol, such as known-key secrecy, key-compromise impersonation resilience, unknown key-share resilience, known session-specific temporary information security, message independence and no key control. Compared to other comparable schemes, it is more secure and has nice efficiency.