Stronger Security of Authenticated Key Exchange

Abstract

Abstract. Recent work by Krawczyk [12] and Menezes [16] has highlighted the importance of understanding well the guarantees and limitations of formal security models when using them to prove the security of protocols. In this paper we focus on security models for authenticated key exchange (AKE) protocols. We observe that there are several classes of attacks on AKE protocols that lie outside the scope of the Canetti-Krawczyk model. Some of these additional attacks have already been considered by Krawczyk [12]. In an attempt to bring these attacks within the scope of the security model we extend the Canetti-Krawczyk model for AKE security by providing significantly greater powers to the adversary. Our contribution is a more compact, integrated, and comprehensive formulation of the security model. We then introduce a new AKE protocol called NAXOS and prove that it is secure against these stronger adversaries.

Authenticated Key Exchange under Bad Randomness

“…The CK model was used to demonstrate the security of many popular AKE protocols such as the ISO protocol [24,14], the SIGMA protocol [15,27], the HMQV protocol [26] and many more. Recently, LaMacchia et al [29] extended the CK model to a new model (referred to as eCK model). In their model, the adversary is allowed to compromise either the long-live keys or the ephemeral keys (the latter are related to the randomness) of the participants of a protocol session.…”

“…In their model, the adversary is allowed to compromise either the long-live keys or the ephemeral keys (the latter are related to the randomness) of the participants of a protocol session. There have been many discussions on the strength of the two (CK and eCK) models [29,33,11]. In [11], Boyd et al suggested that these two models are incomparable.…”

“…Although for AKE protocols resilience to the leakage of ephemeral secret key has been studied by Krawczyk [26] and by LaMacchia et al [29], their work is different from ours: firstly, ephemeral secret key is related but not equivalent to the randomness required by an AKE protocol, in particular, randomness may be required in other parts of the protocol; secondly, in the case of ephemeral secret key leakage, the adversary can only passively learn the ephemeral secret key, but not control its value. Another piece of work that is "somehow" related to ours is the work by Aiello et al [2] in which the JFK (Just Fast Keying) AKE protocol was proposed and discussions about the reuse of Diffie-Hellman (DH) exponents in multiple JFK AKE sessions were made.…”

Computationally Analyzing the ISO 9798–2.4 Authentication Protocol

“…Still later, more fully specified session identifiers that capture similar information to that of BR (e.g. [9]) have been utilized. Due to the simplicity of matching conversations and the natural session-identifier format that they epitomize, they will be employed in this work to capture partnering between sessions.…”

On the Connection Between Signcryption and One-Pass Key Establishment

“…On the other hand, the extensions proposed by Krawczyk assumed a weak corruption model in which the adversary is allowed to compromise only the long-term private key of a party by issuing corrupt query. Later, LaMacchia et al [27] extended the CK model and proposed a unified model (called eCK model) which captures most of the desired security properties of key establishment protocols. We now briefly review the eCK model using some well known notations from earlier models.…”