Key distribution system based on identification information

Okamoto, Eiji; Tanaka, K.

doi:10.1109/49.17711

Cited by 121 publications

(49 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While the need for the former hash is quite clear (it is somewhat hinted to in [22] and included in the variant of the protocol in [37]), the need for the second hashing is more subtle. And in fact, the second hash does not appear in [32] and follow-up work (including [22] and other works that claimed the protocol's security); they defined the session key to be the value (β e /B) x mod N = (α e /A) x mod N without the hashing operation. As we see next, both hashing steps are essential for the security of the protocol and, in particular, for proving its security.…”

Section: Rationale For the Modifications Of The Original Mot Protocolmentioning

confidence: 99%

“…In this section we describe in full detail the modified version of the Okamoto-Tanaka protocol and provide rationale for the modifications made to the original protocol from [32]. Throughout the paper we refer to this protocol as the "Modified Okamoto-Tanaka Protocol (mOT)".…”

Section: The Modified Okamoto-tanaka Protocolmentioning

confidence: 99%

“…Even to date it seems that very few (e.g., [5,42]) were given full proofs of security (many others were broken or enjoy only a restricted notion of security, such as partial resistance to known-key attacks). Also in the case of the original Okamoto-Tanaka protocol one can find several papers [31,32,27,22] with partial or flawed analysis of the protocol 4 . In all, the mOT protocol studied here compares very favorably with other id-based and traditional KAPs in provability and security properties (e.g., PFS) as well as performance-wise.…”

Section: Introductionmentioning

confidence: 99%

“…Key agreement protocols (KAPs) have played an important role in the development of identity-based cryptography, with Okamoto [31], Okamoto and Tanaka [32], Gunther [16] being early examples of id-based cryptography. (Even earlier, the work by Blom [3] on key distribution can be seen as a precursor of id-based schemes.)…”

Section: Introductionmentioning

confidence: 99%

“…We answer this question in the affirmative by resorting to an old and elegant key agreement protocol: the Okamoto-Tanaka protocol [32]. We present a variant of the protocol (denoted mOT) which achieves the above minimal communication, incurs a computational overhead relative to the basic DHP that is practically negligible, and yet achieves full provable key agreement security, including PFS, against active attackers.…”

mentioning

confidence: 99%

See 4 more Smart Citations

Okamoto-Tanaka Revisited: Fully Authenticated Diffie-Hellman with Minimal Overhead

Gennaro

Krawczyk

Rabin

2010

Applied Cryptography and Network Security

View full text Add to dashboard Cite

Abstract. The Diffie-Hellman protocol (DHP) is one of the most studied protocols in cryptography. Much work has been dedicated to armor the original protocol against active attacks while incurring a minimal performance overhead relative to the basic (unauthenticated) DHP. This line of work has resulted in some remarkable protocols, e.g., MQV, where the protocol's communication cost is identical to that of the basic DHP and the computation overhead is small. Unfortunately, MQV and similar 2-message "implicitly authenticated" protocols do not achieve full security against active attacks since they cannot provide forward secrecy (PFS), a major security goal of DHP, against active attackers.In this paper we investigate the question of whether one can push the limits of authenticated DHPs even further, namely, to achieve communication complexity as in the original DHP (two messages with a single group element per message), maintain low computational overhead, and yet achieve full PFS against active attackers in a provable way. We answer this question in the affirmative by resorting to an old and elegant key agreement protocol: the Okamoto-Tanaka protocol [32]. We present a variant of the protocol (denoted mOT) which achieves the above minimal communication, incurs a computational overhead relative to the basic DHP that is practically negligible, and yet achieves full provable key agreement security, including PFS, against active attackers. Moreover, due to the identity-based properties of mOT, even the sending of certificates (typical for authenticated DHPs) can be avoided in the protocol.As additional contributions, we apply our analysis to prove the security of a recent multi-domain extension of the Okamoto-Tanaka protocol by Schridde et al. and show how to adapt mOT to the (non id-based) certificate-based setting.

show abstract

Section: Rationale For the Modifications Of The Original Mot Protocolmentioning

confidence: 99%

Section: The Modified Okamoto-tanaka Protocolmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 3 more Smart Citations

Okamoto-Tanaka Revisited: Fully Authenticated Diffie-Hellman with Minimal Overhead

Gennaro

Krawczyk

Rabin

2010

Applied Cryptography and Network Security

View full text Add to dashboard Cite

show abstract

References

2015

Applied Cryptography, Second Edition

View full text Add to dashboard Cite

Perfectly Secure Key Distribution for Dynamic Conferences

Blundo

Santis

Vaccaro

et al. 1998

Information and Computation

425

560

View full text Add to dashboard Cite

A key distribution scheme for dynamic conferences is a method by which initially an (off-line) trusted server distributes private individual pieces of information to a set of users. Later any group of users of a given size (a dynamic conference) is able to compute a common secure key. In this paper we study the theory and applications of such perfectly secure systems, In this setting, any group of t users can compute a common key by each user computing using only his private piece of information and the identities of the other t-1 group users. Keys are secure against coalitions of up to k users, that is, even if E users pool together their pieces they cannot compute anything about a key of any t-size conference comprised of other users. First we consider a non-interactive model where users compute the common key without any interaction. We prove a lower bound on the size of the user's piece of information of ("2; ') times the size of the common key. W e then establish the optimality of this bound, by describing and analyzing a scheme which exactly meets this limitatioii (the construction extends the one in [2]). Then, we consider the model where interaction is allowed in the common key computation phase, and show a gap between the models by exhibiting an interactive scheme in which the user's information is only k + t-1 times the size of the common key. We further show various applications and useful modifications of our basic scheme. Finally, we present its adaptation to network topologies with neighborhood constraints.

show abstract

Key distribution system based on identification information

Cited by 121 publications

References 9 publications

Okamoto-Tanaka Revisited: Fully Authenticated Diffie-Hellman with Minimal Overhead

Okamoto-Tanaka Revisited: Fully Authenticated Diffie-Hellman with Minimal Overhead

References

Perfectly Secure Key Distribution for Dynamic Conferences

Contact Info

Product

Resources

About