Key Escrow Protocol Based on a Tripartite Authenticated Key Agreement and Threshold Cryptography

Abstract

While instant messaging systems bring convenience to people's lives and work, they also make it easier for malicious users to discuss and plot illegal activities. Therefore, determining how to balance the privacy protection requirements of user communication in the network with the authorized monitoring requirements of law enforcement agencies (LEAs) is a meaningful task. To solve this problem, a new tripartite authenticated key agreement (Tri-AKA) protocol and a session key escrow scheme based on threshold cryptography and the new Tri-AKA protocol were proposed. In the proposed scheme, the LEA participates as a normal user in the key agreement process of two users and uses (t, n) threshold cryptography to share its ephemeral private key with n key escrow agents (KEAs). When necessary, the LEA can combine t KEAs to recover the specified session key and decrypt the communications, thereby preventing malicious administrators in the LEA from arbitrarily monitoring user communications. Finally, we proved the security of the proposed Tri-AKA protocol under the Computational Diffie-Hellman (CDH) assumption with the Random Oracle Model and the security of the proposed key escrow scheme under the Elliptic Curve Discrete Logarithm (ECDL) assumption. Analysis of our session key escrow scheme and comparison with other schemes show that our scheme can avoid the ''once monitor, monitor forever'' scenario and achieve finegrained control in each session. Moreover, our scheme has low storage overhead for each KEA.

How to (Legally) Keep Secrets from Mobile Operators

“…LIKE also provides much stronger guarantees than key-escrow [37,21,7,44,40,10,18,34,32,33,26,35,41,38,19]: we can handle malicious authority input; we fine-grain exceptional opening so that it only holds for one session at a time; we allow authorities to remain offline at all times except for exceptional opening; we minimize storage and computational costs for users and authorities; we have no central key-generation authority which knows all secret keys; and we guarantee the new properties of non-frameability and honest operator, which are tailored to the LI requirements analyzed above. In return, our use-case is narrower than typically considered in key-escrow: by considering the case of mobile communications, we can safely assume that parties always use the operator as a proxy, unlike in generic key-escrow settings.…”

Pairing-free secure-channel establishment in mobile networks with fine-grained lawful interception

“…We provide stronger guarantees than typical key-escrow [19,12,4,23,21,6,10,17,15,16,13,18,22,20,11]. First, our chosen use-case (mobile communications) obliges participants to communicate via two serving networks which can now vouchsafe for Alice's and Bob's protocol-compliance.…”

CCA Secure A Posteriori Openable Encryption in the Standard Model

“…On the application side, Key-Escrow (KE) and Key-Recovery (KR) [13,18,23,24] schemes deal with the capability of an authority to decrypt the messages exchanged between two users by recovering their secret key. Some works deal with KR mechanisms for lawful interception [1,13,24], where a set of authorities has to collude to open an encrypted phone conversation between two users. As in APOPKE, the security model ensures that the recovered conversation is the same as the exchanged one.…”