SAS-Based Group Authentication and Key Agreement Protocols

Abstract

Abstract. New trends in consumer electronics have created a strong demand for fast, reliable and user-friendly key agreement protocols. However, many key agreement protocols are secure only against passive attacks. Therefore, message authentication is often unavoidable in order to achieve security against active adversaries. Pasini and Vaudenay were the first to propose a new compelling methodology for message authentication. Namely, their two-party protocol uses short authenticated strings (SAS) instead of pre-shared secrets or public-key infrastructure that are classical tools to achieve authenticity. In this article, we generalise this methodology for multi-party settings. We give a new group message authentication protocol that utilises only limited authenticated communication and show how to combine this protocol with classical key agreement procedures. More precisely, we describe how to transform any group key agreement protocol that is secure against passive attacks into a new protocol that is secure against active attacks.

Accumulative Secure Group Association in an Ad-hoc and Ubiquitous Network (Version 3.0)

“…There have been relatively few studies on secure mobile group; however, a number of group security protocols including MultiParty [15], SAS-GMA [16], and SPATE [17] have been proposed. In simple terms, each device sends its public key to every other device via a wireless network, and thus each device generates authentication data independently.…”

“…Recently, few attempts [19], [20] were made to apply SAS-GMA protocol [16] to the existing OOB channels and to investigate the practical usability of secure group association. However, these studies used three and four OOB channels respectively, which require rich user interfaces, as most OOB channels are not suitable for the protocol.…”

“…Literature reports: There has been little discussion of SGA, and all published studies have described all-at-once group association [15], [16], [17], [18]. The comparison in Table 2 is between these association protocols and our proposed method.…”

“…Even though a specific output was not mentioned in SAS-GMA protocol [16], it needs all devices to be equipped with similar interfaces so that users could compare authentication data. However, the authentication of each device in our accumulative method involves two devices: the new device and an existing group member.…”

Practical unconditionally secure two-channel message authentication

“…Noninteractive protocols have been proposed in Balfanz et al [1]; Pasini and Vaudenay [19]; Mashatan and Stinson [14]; and Reyhanitabar et al [21]. Interactive protocols have been discussed in many papers, including the following: the so-called MANA protocols were introduced in Gehrmann et al [5] and Gehrmann and Nyberg [6]; Hoepman [8]; the SAS protocol proposed by Vaudenay [27]; Pasini and Vaudenay [20]; Laur and Nyberg [11]; Laur and Pasini [12,13]; and Mashatan and Stinson [15]. Group protocols are studied in Nguyen and Roscoe [18].…”