Composability and On-Line Deniability of Authentication

Abstract

Abstract. Protocols for deniable authentication achieve seemingly paradoxical guarantees: upon completion of the protocol the receiver is convinced that the sender authenticated the message, but neither party can convince anyone else that the other party took part in the protocol. We introduce and study on-line deniability, where deniability should hold even when one of the parties colludes with a third party during execution of the protocol. This turns out to generalize several realistic scenarios that are outside the scope of previous models.We show that a protocol achieves our definition of on-line deniability if and only if it realizes the message authentication functionality in the generalized universal composability framework; any protocol satisfying our definition thus automatically inherits strong composability guarantees. Unfortunately, we show that our definition is impossible to realize in the PKI model if adaptive corruptions are allowed (even if secure erasure is assumed). On the other hand, we show feasibility with respect to static corruptions (giving the first separation in terms of feasibility between the static and adaptive setting), and show how to realize a relaxation termed deniability with incriminating abort under adaptive corruptions.

Deniable Key Exchanges for Secure Messaging

“…Implicit DAKE schemes, such as those from Cremers and Feltz [CF11], from Yao and Zhao [YZ13], and 3-DH [Ope13d], all lack online repudiation because they include non-repudiable (and thus non-simulatable) signatures. The scheme introduced as Φ dre by Walfish in his Ph.D. thesis [Wal08], and later reiterated in a publication by Dodis et al [DKSW09], does satisfy all of our requirements for a DAKE; we discuss this protocol in greater depth in Section 3.6.…”

The PACE|AA Protocol for Machine Readable Travel Documents, and Its Security

“…Ideally, the advantage should be small for any efficient D and A and where the simulator's efficiency characteristics are close to the one of the adversary. We note that there are even stronger versions, called online deniability [DKSW09] where the distinguisher can communicate with the malicious party resp. the simulator while the protocol is executed.…”

Non-Interactive Key Exchange

“…A recent paper [2] gives a detailed evaluation of the energy costs of interactive and non-interactive key exchange protocols in the ID-based and PKI settings for wireless communications with a jamming adversary, demonstrating that significant energy savings can be made by adopting a non-interactive approach to key establishment. Its non-interactive nature makes NIKE an abstract building block that is qualitatively different from interactive key exchange: e.g., to achieve deniable authentication, [3] explicitly requires a non-interactive key exchange. But NIKE can also be used as a basis for interactive key exhange [4,5,6]: for example, in [5], the authors use the shared key in a MAC to authenticate an exchange of ephemeral Diffie-Hellman values.…”

“…The model for NIKE in [10] is similar to, and presumably inspired by, the early work of Shoup [16] on interactive key exchange, where capturing so-called PKI attacks, also known as rogue-key attacks, was intrinsic to the security modelling. This modelling approach is referred to elsewhere in the literature as the plain setting (see [20,21] and the references therein) or the bare PKI setting [3]. The CKS model is certainly more challenging than settings where proofs of knowledge or proofs of possession of private keys are assumed to be given during registration, or where the adversary must reveal its secret key directly (as with the knowledge of secret key assumption used in [22,23]).…”

“…Certainly this problem could be solved instead by appealing to a suitable gap-DH assumption. We show how 3 Concretely, since shared keys do not depend on party identities in the unhashed DH-NIKE, an adversary A can (a) register the key g x of an honest party Alice as its own key, and (b) ask for the shared key between A and another honest party Bob with key g y . This immediately yields the shared key g xy between Alice and Bob.…”