Authenticated Key Exchange in Underwater Acoustic Sensor Networks based on Implicit Certificates: Performance Analysis

The analysis of real-world protocols, in particular key exchange protocols and protocols building on these protocols, is a very complex, error-prone, and tedious task. Besides the complexity of the protocols itself, one important reason for this is that the security of the protocols has to be reduced to the security of the underlying cryptographic primitives for every protocol time and again. We would therefore like to get rid of reduction proofs for real-world key exchange protocols as much as possible and in many cases altogether, also for higher-level protocols which use the exchanged keys. So far some first steps have been taken in this direction. But existing work is still quite limited, and, for example, does not support Diffie-Hellman (DH) key exchange, a prevalent cryptographic primitive for real-world protocols. In this paper, building on work by Kusters and Tuengerthal, we provide an ideal functionality in the universal composability setting which supports several common cryptographic primitives, including DH key exchange. This functionality helps to avoid reduction proofs in the analysis of real-world protocols and often eliminates them completely. We also propose a new general ideal key exchange functionality which allows higherlevel protocols to use exchanged keys in an ideal way. As a proof of concept, we apply our framework to three practical DH key exchange protocols, namely ISO 9798-3, SIGMA, and OPTLS.

This chapter explains the elements of key exchange, specifically the steps in a key exchange protocol, the parties that are involved and the messages which may be sent. It details key exchange security models and protocols, considering first the simpler case of unauthenticated key exchange before turning to authenticated protocols. The chapter deals with key exchange protocols designed to be secure against a passive adversary. It examines that unauthenticated protocols may be used as building blocks for authenticated key exchange protocols. Key exchange protocols that allow parties to verify the identity of other participating parties are called authenticated key exchange protocols. Key exchange has a long history and a vast literature, yet remains a very active research area with significant practical impact. It is inevitable that as new computational assumptions emerge as the basis for cryptographic security, so will their use in key exchange be relevant.

In cryptography, the key exchange protocol is very important before starting secure communication. Both parties will use an asymmetric key algorithm to exchange their keys for encryption and decryption. One of the methods to securely exchange the keys is Diffie-Hellman Key Exchange (DHKE) protocol. DHKE allows both parties to exchange their keys over the insecure public channel safely. However, DHKE protocol does not authenticate the message, making it easily exposed to third-party interruptions like Man-in-the-Middle (MitM) attack. Therefore, Station to Station (STS) protocols was introduced after modifying the DHKE protocol and adding authentication elements. Thus, this paper proposes to provide the authentication of the STS protocol by using Lamport Digital Signature Scheme. Lamport Digital Signature Scheme, also known as Lamport one-time signature scheme, gives very strong security because it can be built from any cryptographically secure one-way function and usually uses a cryptographic hash function. The results from the study are STS protocol algorithms that provide a verification scheme using the Lamport Digital Signature Scheme. As a result, both parties will obtain a common key for encryption and decryption, in which both parties play a role by using their respective digital signature for verification within the STS of this protocol

This paper investigates the performance of two popular packet level erasure coding approaches, i.e., end-to-end and hop-by-hop, for improving the data transmission reliability in Underwater Acoustic Sensor Networks (UWASNs). In the end-to-end approach, encoding and decoding are performed by the source node and sink node, respectively, while the intermediate nodes just forward the data packets without any processing. In this case, the number of redundant packets to be transmitted by the source (i.e., code rate) is chosen based on packet success probability along the path. On the other hand, the hop-by-hop erasure coding is used to achieve reliability over each hop along the path. In this case, apart from the source node, all the intermediate nodes perform the encoding process and each node adaptively computes the number of redundant packets for the next hop based on the quality of the corresponding hop. We present an analytical model to find the communication overhead, energy consumption and average delay of the multi-hop UWASN under the above erasure coding approaches. The results show that hop-by-hop erasure coding outperforms end-to-end erasure coding.

Diffie-Hellman (D-H) key exchange protocol, first published in 1976 is one of the most distinguished and widely used secured key exchange protocols. The protocol makes it possible to exchange a symmetric key between two parties over an unsecured communication channel without pre-agreement of any shared secret. The D-H key exchange protocol however requires a pre-set public parameters P (a large prime) and g a generator of ℤp to be public i.e. known to all users of the system. This paper proposes a key exchange mechanism without any public parameter. Unlike D-H key exchange mechanism our scheme uses encryption to transmit intermediate data during key exchange stage, thus it is non-vulnerable to man-in-the-middle attach.

Many authentication and key exchange protocols are built using an accepted set of standard concepts such as Diffie-Hellman key exchange, nonces to avoid replay, certificates from an accepted author...

With the increasing demand for marine exploration, underwater acoustic sensor networks (UASNs) are prone to have the characteristics of large-scale, long term monitoring, and high data traffic load. Underwater media access control (MAC) protocols, which allow multiple users to share the common medium fairly and efficiently, are essential for the performance of UASNs. However, the design of MAC protocols is confronted with the challenges of spatial unfairness, data eruption, and low energy efficiency. In this paper, we propose a novel data concurrent transmission (DCT) MAC protocol, which is able to exploit long propagation delay and conduct concurrent transmission. Specifically, we present the theoretical performance analysis of the proposed MAC protocol in detail and give an analytical solution of the success concurrent transmission probability between nodes. In addition, simulation results are provided to demonstrate that our proposed protocol is appropriate for UASNs and can significantly improve the performance in terms of network throughput and energy consumption. Finally, we give some typical future applications of UASNs and discuss the demands on MAC protocol design.

Many authentication and key exchange protocols are built using an accepted set of standard concepts such as Diffie-Hellman key exchange, nonces to avoid replay, certificates from an accepted authority, and encrypted or signed messages. We introduce a basic framework for deriving security protocols from such simple components. As a case study, we examine the structure of a family of key exchange protocols that includes station-to-station (STS), ISO-9798-3, just fast keying (JFK), IKE and related protocols, deriving all members of the family from two basic protocols using a small set of refinements and protocol transformations. As initial steps toward associating logical derivations with protocol derivations, we extend a previous security protocol logic with preconditions and temporal assertions. Using this logic, we prove the security properties of the standard signature based challenge-response protocol and the Diffie-Hellman key exchange protocol. The ISO-9798-3 protocol is then proved correct by composing the correctness proofs of these two simple protocols.

SFDM: A time-synchronization-free detection mechanism for mobile underwater acoustic sensor networks

After going through past research, it is observed that the security of data depends on five important key features such as authentication, data Integrity, mutual authentication between two parties, non-repudiation, and key exchange algorithm. Even if one of these features fail then it may breach security in real-world scenarios. The Diffie-Hellman Key Exchange (DHKE) algorithm allows securing one feature called key exchange in the cryptography field. However, this key exchange algorithm is unable to provide authentication. As a result, this key exchange scheme is prone to a hostile attack named as Man-In-The-Middle Attack (MITM). To solve this type of attack, a novel algorithm has been proposed called modification of the DHKE algorithm. In this algorithm, they claim that the MITM attack on classical DHKE can be prevented by applying the necessary functionalities like encryption and Zero-Knowledge Proof (ZKP). Although, after going through result analysis and working techniques, it is observed that the modified DHKE algorithm is still suffering from MITM attack. In this paper, the main objective is to develop an algorithm for finding out this type of security flaw in the existing modified DH algorithm which includes the concept of required authentication and encryption functions and able to perform the MITM attack on the existing modified DHKE algorithm.

The key exchange protocol is the most important cryptography mechanism to protect end-to-end communications by the secret session key encryption. This paper focuses on the four-party key exchange protocol in a environment in which two clients (or UEs) are registered under two distinct servers. We propose a Three-Way Key Exchange and Agreement Protocol, denoted by TW-KEAP. It makes two communication parties have a secret session key to protect their subsequent communications on an efficient way, and intends the servers to involve with the key exchange procedure to derive the session key for the lawful interception support. Security analyses show that it provides mutual authentication, replay attack protection and perfect forward secrecy. Furthermore, the TW-KEAP has not only the shortest total service time based on the experimental results but also the shortest queuing delay from the queuing model analyses, as compared with current alternatives.

ECQV implicit certificates are special public-key certificates, proposed for smaller size and faster verification. In resource-constrained environments such as Internet of Things (IoT), it's common to replace X.509 certificates with ECQV implicit certificates for better efficiency. Google's Certificate Transparency (CT) makes the certificate issuance be publicly-visible to everyone, to enhance the trustworthiness of Public Key Infrastructure (PKI). However, the conventional CT approach based on Signed Certificate Timestamp (SCT) will be a burden for ECQV certificate verifiers in resource-constrained environments. In this paper, we propose an efficient scheme, named ECQV Implicit Certificate Transparency (EICT), to integrate CT with implicit certificates following the same assumption and approach of ECQV implicit certificates. EICT obtains better performance than CT applied in traditional X.509 PKIs. We also conduct the security analysis and performance evaluation of the proposed scheme.

Nicanfar and Leung proposed a multilayer consensus elliptic curve based password authenticated key-exchange (MCEPAK) protocol for smart grid. They claimed that their protocol is secure against possible attacks. In this paper, we show that the MCEPAK protocol is vulnerable to the dictionary attack and an adversary can obtain the passwords of the appliances by eavesdropping the communicated messages in the protocol. Moreover, we state that the passwords can be discovered by curious operators of the building area networks and the neighbor area networks. Theses weaknesses motivated us to introduce a chaotic maps based authenticated key exchange protocol for smart grid. To the best of our knowledge, the chaotic maps based key exchange protocol has not yet been devised for smart grid and the same objective has been fulfilled in this paper. In addition, we prove the security of the proposed protocol by a formal analysis.

Security issues play an important role in modern communication worlds. Via distrusted networks, exchanged messages need to be encrypted by a session key for security requirements. Session keys are preferred to be generated by communication parties, and how to authenticate the other communication party is an important problem needed to be solved. In three-party encrypted key exchange (3PEKE) protocols, a special type of indirect-authenticated protocols, a trusted third party is involved to have two communication parties be able to authenticate each other and negotiate one session key. In 2008, Yoon and Yoo proposed a three-party encrypted key exchange protocol and claimed their protocol provides a more secure way for exchanging messages. Unfortunately, we find that their protocol suffers from undetectable one-line password guessing attacks. In this manuscript, we first review the important related works and show how to mount attacks on Yoon and Yoo’s 3PEKE protocol

A key exchange protocol is an important primitive in the field of information and network security and is used to exchange a common secret key among various parties. A number of key exchange protocols exist in the literature and most of them are based on the Diffie-Hellman (DH) problem. But, these DH type protocols cannot resist to the modern computing technologies like quantum computing, grid computing etc. Therefore, a more powerful non-DH type key exchange protocol is required which could resist the quantum and exponential attacks. In the year 2013, Lei and Liao, thus proposed a lattice-based key exchange protocol. Their protocol was related to the NTRU-ENCRYPT and NTRU-SIGN and so, was referred as NTRU-KE. In this paper, we identify that NTRU-KE lacks the authentication mechanism and suffers from the man-in-the-middle (MITM) attack. This attack may lead to the forging the authenticated users and exchanging the wrong key.