Cryptanalysis and enhancement of two-pass authenticated key agreement with key confirmation protocols

Abstract

In NRSC24, Elkamchouchi et al. proposed a new approach for key controlled agreement to provide key control in the Pour public key distribution system. In NRSC25, they further proposed an efficient and confirmed protocol for authenticated key agreement to provide forward secrecy in their previously proposed protocol. This paper, however, will show that Pour's protocol and Elkamchouchi et al.'s two protocols cannot withstand key compromise impersonation resilience, and man-in-the-middle attacks, and do not have perfect forward secrecy resilience. To eliminate the pointed out security leaks, we further propose a new two-pass authenticated key agreement with a key confirmation protocol. The proposed protocol has the following properties: (i) it is proved to be secure against above attacks and stronger adversary attacks, and provides the desirable security properties as a three-pass authenticated key agreement protocol. (ii) It can provide entity authentication and assurance for key reception in an indirect way. (iii) It can withstand denial of service attacks. In addition, we also propose a derivation one-pass protocol from the proposed twopass protocol to fit a one-way communication channel, which is suitable for mobile stations and electronic business transactions. The security and the computational complexities of the proposed two protocols outperform those of previously proposed protocols.

Cryptanalysis and improvement of the YAK protocol with formal security proof and security verification via Scyther

“…They showed that it is possible to achieve PFS in two‐pass key exchange protocols even in the presence of very strong active adversaries that can reveal random values of sessions and compromise long‐term secret keys of parties 9 . Mohammad et al proposed a new two‐pass AKA with key confirmation protocol which uses a verification mechanism in its block in order to provide entity authentication, assurance for key reception in an indirect way, and PFS 15 ; therefore, it can provide security properties as the three‐pass AKA protocol 36 . Feltz and Cremers analyzed the security of AKA protocols against strong adversaries that can perform chosen‐randomness attacks 17 …”

“…We describe some desirable security properties of AKA protocol; for further details in the security properties of AKA, see previous studies 25,26, 28, 36, 40–47 PFS Resilience (PFS‐R) : If an eavesdropper might reveal any possible pairs of secret information without both private keys (static and ephemeral secret keys) owned by the party, it should not have any effect on the secrecy of previously established session keys. UKS : If party wants to establish a secret key with , it should not be possible that is tricked into sharing a key with party . Key control (KC) : Both of the parties should not be able to force the session key to a preselected value of their choice. Private key security : An adversary cannot learn the initiator's static private key even if she or he is able to learn all transient secrets in any of the initiator's session. Key confirmation : It is a guarantee exactly that the responder party owns the same computed session key of the initiator party in the same session.…”

“…The proposed protocol is depicted in Figure 3. It verifies the identities of participating parties as in Mohammad et al 36 It can provide entity authentication as a result of the session identifiers matching concept 30 …”

Authenticated Key Exchange (AKE) in Delay Tolerant Networks

“…Even though their scheme is the strongest against the general key-compromise impersonation (K-CI) attack compared to one-pass versions of MQV, HMQV and CMQV, the use of bilinear pairings, makes this scheme less efficient [6]. Work in [19] proposes a two-pass authenticated key agreement protocol with key confirmation (2P-AKACP) and the one-pass version of this protocol (1P-AKACP) for one-way communications. Both protocols are based on the discrete logarithm problem (DLP) and have three phases: the registration, the transfer and verification, and the key generation.…”

“…The key agreement protocols we selected for comparison are the Key Exchange Algorithm (KEA) [20], the one-pass version (KEA1) and the version with key confirmation (KEAA), the Unified Model (UM) [1], the one-pass version (UM1) and the version with key confirmation (UMA), the Menezes-Qu-Vanstone (MQV) [18], the one-pass version (MQV1) and the version with key confirmation (MQVA), the Revised Nyberg-Rueppel protocol (RNR) [21], the one-pass Authenticated Key Agreement with key confirmation protocol (1P-AKACP) and the two-pass version (2P-AKACP) [19], the Chalkias-Hristou-Stephanides-Alexiadis protocol (CHHSA) [5] and the Horster-Michels-Petersen protocol (HMP) [12]. From the above protocols the Nyberg-Rueppel (but not the revised version) and the Horster-Michels-Petersen protocol supports message recovery.…”