One-Round Protocols for Two-Party Authenticated Key Exchange

Abstract

Cryptographic protocol design in a two-party setting has often ignored the possibility of simultaneous message transmission by each of the two parties (i.e., using a duplex channel). In particular, most protocols for two-party key exchange have been designed assuming that parties alternate sending their messages (i.e., assuming a bidirectional half-duplex channel). However, by taking advantage of the communication characteristics of the network it may be possible to design protocols with improved latency. This is the focus of the present work.We present three provably-secure protocols for two-party authenticated key exchange (AKE) which require only a single round. Our first, most efficient protocol provides key independence but not forward secrecy. Our second scheme additionally provides forward secrecy but requires some additional computation. Security of these two protocols is analyzed in the random oracle model. Our final protocol provides even stronger security guarantees than our second protocol, but does not require random oracles. This scheme is only slightly less efficient (from a computational perspective) than the previous ones. Our work provides the first provably-secure one-round protocols for two-party AKE which achieve forward secrecy.

Relations among Security Models for Authenticated Key Exchange

“…In [3], Jeong and others suggested the JKL model for a duplex channel. In a duplex channel, the two communicating parties can send their messages simultaneously.…”

“…There exist a few key-establishment schemes in the JKL model [3], [21]- [22]. We note that a multiparty authenticated key-establishment protocol can be used as a twoparty authenticated key-establishment protocol.…”

“…▪ A session identifier in the KR model has been defined as sid i,k = strID i,k [2]. ▪ A session identifier in the JKL model has been defined as sid i,k = strID i,k [3], [22]. (Note that strTIME i,k cannot be used as a session identifier in the JKL model, because the two parties may send their messages simultaneously.)…”

“…For a concrete definition of the KKS/w-FS/s-FS/KCI/SSRsecurity through an experiment, refer to [1]- [3].…”

“…In a duplex channel, the two communicating parties can send their messages at the same time. For such a channel, it is necessary to create new security models since those for the half-duplex channel are not transferable; one such model is defined by Jeong and others, which we call the JKL model [3].…”