Design and Implementation of Constant-Round Dynamic Group Key Exchange from RLWE

Abstract

Group Key Exchange (GKE) is required for secure group communication with high confidentiality. In particular, a trusted authority can handle issues that happen by the malicious actions of group members, but it is expensive to deploy and not suitable in a dynamic setting where the network requires frequent membership status changes. To overcome these issues, we designed yet another quantum-resistant constant-round GKE based on lattice without a trusted authority based on Apon et al.'s protocol (PQCrypto 2019) by modifying their key computation phase. Then, we describe the novel dynamic authenticated GKE (called DRAG) with membership addition/deletion procedures in Ring Learning with Errors (RLWE) setting, while the former ones are built from Diffie-Hellman problem. Under the specific adversary who can leak the long-term secret key from the party, we suggest a rigorous proof of DRAG in the random oracle model based on the hardness assumption of RLWE problem and the property of Rényi divergence. As a proof of concept, implementation details are described to meet level 1 NIST security. Our implementation is reasonable for practical use since the total runtime to get a group secret key takes about 3 msec and it can be considered as a reference implementation of other quantum-resistant GKEs. INDEX TERMS Authenticated group key exchange, key establishment, lattice-based cryptography, post quantum cryptography, ring learning with errors (RLWE).

Authenticated logarithmic-order supersingular isogeny group key exchange

“…In this section, we compare our AGKEs with other postquantum R-LWE GKEs: Apon, Dachman-Soled, Gong, and Katz [3] and Choi, Hong, and Kim [4]. Apon et al [3] generalize a Diffie-Hellman based GKE construction by Burmester and Desmedt [6] into the R-LWE setting.…”

“…Apon et al [3] generalize a Diffie-Hellman based GKE construction by Burmester and Desmedt [6] into the R-LWE setting. Choi et al [4] generalize another Diffie-Hellman based GKE by Dutta and Barua [7] into the R-LWE setting. Both papers arrange the parties in a ring structure, letting P = P 0 , P +1 = P 1 , etc., and achieve post-quantum R-LWE -party AGKE protocols with communication and memory complexity ( ).…”

“…The reason for this is that it takes into account that receiving messages requires being online and also storing said messages while broadcasting/multicasting is usually a one-time operation. the parameters of [3] and [4] (including the number of parties) are required to satisfy further bounds set by the key reconciliation and Rényi bounds, for correctness and security.…”

“…As is, it has been applied to fundamental cryptography such as two party key exchanges, see for example Ding, Xie, and Lin [1] (with Peikert's reconcilliation tweak [2]). Apon, Dachman-Soled, Gong, and Katz [3] at PQCrypto 2019, and Choi, Hong, and Kim [4] from 2020, both manage to extend the applicability further by showing how to create authenticated group key exchanges (AGKEs) from the decisional R-LWE problem [5]. Their schemes are interesting generalizations of Diffie-Hellman based group key exchanges (GKEs), one by Burmester and Desmedt [6] and one by Dutta and Barua [7].…”

“…The authenticated compiler for our GKEs is given in Sect. 4. We compare our AGKEs to other post-quantum R-LWE AGKEs in Sect.…”