An unknown key-share attack on the MQV key agreement protocol

Abstract

The MQV key agreement protocol, a technique included in recent standards, is shown in its basic form to be vulnerable to an unknown key-share attack. Although the attack's practical impact on security is minimal---a key confirmation step easily prevents it---the attack is noteworthy in the principles it illustrates about protocol design. First, minor “efficiency improvements” can significantly alter the security properties of a protocol. Second, protocol analysis must consider potential interactions with all parties, not just those that are normally online. Finally, attacks must be assessed in terms of system requirements, not just in isolation.

Authenticated Key Exchange under Bad Randomness

“…In the Reset-1 model, the adversary directly picks random coins for the AKE participants, while in the Reset-2 model, the adversary does not pick random coins directly but can reset a participant so that the same random coins will be used in multiple AKE sessions. In addition, to capture Kaliski's online Unknown Key Share (UKS) attacks [12], our models allow the adversary to register malicious users with public keys of its own choice.…”

An Algebra for Symbolic Diffie-Hellman Protocol Analysis

“…The additional non-compromise assumption is about a , the long term secret of the principal E that B thinks he is communicating with [7,18,32]. MQV satisfies only this weaker form [27]. We focus on the stronger property here.…”

“…Moreover, important protocols, such as the implicitly authenticated key-agreement protocol MQV [7], appear to be out of reach of known symbolic techniques. Indeed, for these protocols, computational techniques have led to arduous proofs after which controversy remains [27,29,30,33]. In this paper, we develop algebraic ideas that allow us to give rigorous proofs of security goals such as authentication and confidentiality in a symbolic model.…”

On the Importance of Public-Key Validation in the MQV and HMQV Key Agreement Protocols

“…It can be seen that h(z) = h 1 (z)/h 2 (z), where h 1 , h 2 ∈ F p [z] and deg(h 1 ) = 288. 10 If the polynomial h 1 has a root z in F p , then the associated point T is guaranteed to have order 16 in E (F p ). Since X can be chosen uniformly at random from E(F p ), it is reasonable to make the heuristic assumption that h 1 is a "random" degree-288 polynomial over F p .…”

“…In [19] it was shown that the one-pass HMQV protocol succumbs to a Kaliskistyle unknown-key share attack [10] even if public keys are (fully) validated. The attack is 'on-line' in the sense that the adversary needs to have her static public key certified during the attack.…”