Authenticating ad hoc networks by comparison of short digests

Abstract

We show how to design secure authentication protocols for a non-standard class of scenarios. In these authentication is not bootstrapped from a PKI, shared secrets or trusted third parties, but rather using a minimum of work by human user(s) implementing the low-bandwidth unspoofable channels between them. We develop both pairwise and group protocols which are essentially optimal in human effort and, given that, computation. We compare our protocols with recent pairwise protocols proposed by, for example, Hoepman and Vaudenay. We introduce and analyse a new cryptographic primitive-a digest function-that is closely related to short-output universal hash functions.

Mobile Electronic Identity: Securing Payment on Mobile Phones

“…The Symmetric HCBK (SHCBK) protocol [31] is a typical HISP. This, the general description, connects an arbitrary-sized group.…”

“…The point is that by the time of this last publication, it was in fact committed to all the data used in the above protocol, even though it does not yet know all the hk A s. HCBK stands for Hash Commitment Before Knowledge. A careful security analysis of this protocol (see [31], for example) demonstrates that any attacker is unable to profit from combinatorial analysis aimed at getting the SASs (i.e. digests) to agree even though nodes have difference views of the authenticated information.…”

“…The digest function [30,31] is designed so that, as hk varies, the probability that digest(hk, X) = digest(hk, Y ) for X = Y is less than , where typically is very close to 2 −b for b the number of bits in the output of digest. It must also have the property that for any fixed value d, the chance that digest(hk, X) = d as hk varies is less than .…”

On a Construction of Short Digests for Authenticating Ad Hoc Networks

“…Such a case has been made in [14], in which it was argued that, in view of the large size of the input and the resulting performance impact on calculating its long hash or MAC output even when just a short output is really required, it is worthwhile to consider a digest function in which the computational complexity is quantifiably lower, if certain less stringent mathematical criteria are fulfilled.…”

“…, m n ) ∈ GF (2) n , R k is a b × n matrix with entries R i,j (k), which are independent Boolean valued random variables based on k ∈ GF (2) r . Although this is not defined explicitly in [14], we interpret it to mean: even if we know R i ,j (k) for all (i , j ) = (i 0 , j 0 ), we still have no information on the output of R i0,j0 (k), i.e.…”