Efficient and Provably Secure Generic Construction of Three-Party Password-Based Authenticated Key Exchange Protocols

This chapter explains the elements of key exchange, specifically the steps in a key exchange protocol, the parties that are involved and the messages which may be sent. It details key exchange security models and protocols, considering first the simpler case of unauthenticated key exchange before turning to authenticated protocols. The chapter deals with key exchange protocols designed to be secure against a passive adversary. It examines that unauthenticated protocols may be used as building blocks for authenticated key exchange protocols. Key exchange protocols that allow parties to verify the identity of other participating parties are called authenticated key exchange protocols. Key exchange has a long history and a vast literature, yet remains a very active research area with significant practical impact. It is inevitable that as new computational assumptions emerge as the basis for cryptographic security, so will their use in key exchange be relevant.

Security issues play an important role in modern communication worlds. Via distrusted networks, exchanged messages need to be encrypted by a session key for security requirements. Session keys are preferred to be generated by communication parties, and how to authenticate the other communication party is an important problem needed to be solved. In three-party encrypted key exchange (3PEKE) protocols, a special type of indirect-authenticated protocols, a trusted third party is involved to have two communication parties be able to authenticate each other and negotiate one session key. In 2008, Yoon and Yoo proposed a three-party encrypted key exchange protocol and claimed their protocol provides a more secure way for exchanging messages. Unfortunately, we find that their protocol suffers from undetectable one-line password guessing attacks. In this manuscript, we first review the important related works and show how to mount attacks on Yoon and Yoo’s 3PEKE protocol

A three-party password-based authenticated key exchange (PAKE) protocol allows two clients registered with a trusted server to generate a common cryptographic key from their individual passwords shared only with the server. A key requirement for three-party PAKE protocols is to prevent an adversary from mounting a dictionary attack. This requirement must be met even when the adversary is a malicious (registered) client who can set up normal protocol sessions with other clients. This work revisits three existing three-party PAKE protocols, namely, Guo et al.’s (2008) protocol, Huang’s (2009) protocol, and Lee and Hwang’s (2010) protocol, and demonstrates that these protocols are not secure against offline and/or (undetectable) online dictionary attacks in the presence of a malicious client. The offline dictionary attack we present against Guo et al.’s protocol also applies to other similar protocols including Lee and Hwang’s protocol. We conclude with some suggestions on how to design a three-party PAKE protocol that is resistant against dictionary attacks.

The key exchange protocol is the most important cryptography mechanism to protect end-to-end communications by the secret session key encryption. This paper focuses on the four-party key exchange protocol in a environment in which two clients (or UEs) are registered under two distinct servers. We propose a Three-Way Key Exchange and Agreement Protocol, denoted by TW-KEAP. It makes two communication parties have a secret session key to protect their subsequent communications on an efficient way, and intends the servers to involve with the key exchange procedure to derive the session key for the lawful interception support. Security analyses show that it provides mutual authentication, replay attack protection and perfect forward secrecy. Furthermore, the TW-KEAP has not only the shortest total service time based on the experimental results but also the shortest queuing delay from the queuing model analyses, as compared with current alternatives.

In cryptography, the key exchange protocol is very important before starting secure communication. Both parties will use an asymmetric key algorithm to exchange their keys for encryption and decryption. One of the methods to securely exchange the keys is Diffie-Hellman Key Exchange (DHKE) protocol. DHKE allows both parties to exchange their keys over the insecure public channel safely. However, DHKE protocol does not authenticate the message, making it easily exposed to third-party interruptions like Man-in-the-Middle (MitM) attack. Therefore, Station to Station (STS) protocols was introduced after modifying the DHKE protocol and adding authentication elements. Thus, this paper proposes to provide the authentication of the STS protocol by using Lamport Digital Signature Scheme. Lamport Digital Signature Scheme, also known as Lamport one-time signature scheme, gives very strong security because it can be built from any cryptographically secure one-way function and usually uses a cryptographic hash function. The results from the study are STS protocol algorithms that provide a verification scheme using the Lamport Digital Signature Scheme. As a result, both parties will obtain a common key for encryption and decryption, in which both parties play a role by using their respective digital signature for verification within the STS of this protocol

In this paper we present the design, rationale, and implementation of the Internet Key Exchange (IKE) Protocol. This protocol is used to create and maintain Internet Protocol Security (IPSec) associations and secure tunnels in the IP layer. Secure tunnels are used to construct virtual private networks (VPNs) over the Internet. The implementation is done in the application layer. The design includes four components: (1) an IKE protocol engine to execute the IKE protocol, (2) a tunnel manager to create and manage secure tunnels—it generates requests to the IKE protocol engine to establish security associations, (3) VPN policy administration tools to manage VPN policies that guide the actions of the IKE protocol engine and the tunnel manager, and (4) a certificate proxy server to acquire and verify public key certificates that are used for authentication of messages and identities in the IKE protocol. The implementation was done on the Advanced Interactive Executive® (AIX®) operating system at IBM Research and has been transferred to IBM's AIX, Application System/400®, and System/390® products.

Many authentication and key exchange protocols are built using an accepted set of standard concepts such as Diffie-Hellman key exchange, nonces to avoid replay, certificates from an accepted authority, and encrypted or signed messages. We introduce a basic framework for deriving security protocols from such simple components. As a case study, we examine the structure of a family of key exchange protocols that includes station-to-station (STS), ISO-9798-3, just fast keying (JFK), IKE and related protocols, deriving all members of the family from two basic protocols using a small set of refinements and protocol transformations. As initial steps toward associating logical derivations with protocol derivations, we extend a previous security protocol logic with preconditions and temporal assertions. Using this logic, we prove the security properties of the standard signature based challenge-response protocol and the Diffie-Hellman key exchange protocol. The ISO-9798-3 protocol is then proved correct by composing the correctness proofs of these two simple protocols.

Both mutual authentication and generation of session keys can be accomplished by an authenticated key exchange (AKE) protocol. Let us consider the following situation: (1) a client, who communicates with many different servers, remembers only one password and has insecure devices (e.g., mobile phones or PDAs) with very-restricted computing power and built-in memory capacity; (2) the counterpart servers have enormous computing power, but they are not perfectly secure against various attacks (e.g., virus or hackers); (3) neither PKI (Public Key Infrastructures) nor TRM (Tamper-Resistant Modules) is available. The main goal of this paper is to provide security against the leakage of stored secrets as well as to attain high efficiency on client's side. For those, we propose an efficient and leakage-resilient RSA-based AKE (RSA-AKE) protocol suitable for the above situation whose authenticity is based on password and another secret. In the extended model where an adversary is given access to the stored secret of client, we prove that its security of the RSA-AKE protocol is reduced tightly to the RSA one-wayness in the random oracle model. We also show that the RSA-AKE protocol guarantees several security properties (e.g., security of password, multiple sever scenario with only one password, perfect forward secrecy and anonymity). To our best knowledge, the RSA-AKE protocol is the most efficient, in terms of both computation costs of client and communication costs, over the previous AKE protocols of their kind (using password and RSA).

In this paper we have proposed an efficient password security of multiparty Key Exchange Protocol based on Elliptic Curve Discrete Logarithm Problem. Key exchange protocols allow a group of parties communicating over a public network to establish a common secret key called session key. Due to their significance by in building a secure communication channel, a number of key exchange protocols have been suggested over the years for a variety of settings.our Protocol is password authentication model, where group member are assumed to hold an individual password rather than a common password. In this work we propose a new multiparty key agreement protocol which addresses truly contributory property and assures users about their participation in the key computation. The design of the protocol is based on polynomial interpolation. We demonstrate that the protocol is provably secure against active adversaries. The performance analysis of the proposed protocol shows that its well suited for mobile environment. Also here we have taken two one-way hash functions to construct high level of security.

A revocable ID-based authenticated group key exchange protocol with resistant to malicious participants

An improved password-authenticated key exchange protocol for VANET

Chapter 8 - IPv6 Security

Smart home technology is gaining popularity among end-users, as it allows them to remotely control a variety of devices in their homes. Such systems have obvious benefits in terms of automation, but at the same time pose significant threats to home owners if the underlying communications are not secure. To this end, we introduce a novel security protocol that simplifies the pairwise authentication and key exchange among smart home devices. The protocol leverages identity-based cryptography (IBC), thus relaxing the requirement for storing and managing public key certificates. Furthermore, to mitigate the risks associated with centralized key generation in IBC, we opt to generate the private keys in a distributed manner, involving all smart devices. We implemented our protocol on Raspberry Pi 3 devices and demonstrate its efficiency in terms of both computational and communication cost.

이 논문에서는 사전 연산이 가능한 세션 키와 복잡한 암호 프로토콜 디자인에 도움이 될 수 있는 변형된 Diffie-Hellman 키 교환 프로토콜을 보인다. 제안된 프로토콜은 Diffie-Hellman 키 교환 프로토콜을 간결화 하였으며 본래의 프로토콜과 같은 보안성을 가진다. In this paper, we propose a variant of Diffie-Hellman key exchange protocol to provide pre-computable session key and to give another version of Diffie-Hellman key exchange protocol that might be useful in designing more sophisticated cryptographic protocols. We prove the security of the key exchange protocol by reducing DH key exchange protocol to ours.

Password-based Authenticated Key Exchange (PAKE) allows a server to authenticate a user and to establish a session key shared between the server and the user just by having memorable passwords. In PAKE, conventionally the server is assumed to have the authentication functionality and also provide on-line services simultaneously. However, in the real-life applications, this may not be the case, and the authentication server may be separate from on-line service providers. In such a case, there is a problem that a malicious service provider with no authentication functionality may be able to guess the passwords by interacting with other participants repeatedly. Abdalla et al. put forward a notion of the server password protection security to deal with this problem. However, their proposed schemes turned out to be vulnerable to Undetectable On-line Dictionary Attack (UDonDA). To cope with this situation, we propose the Gateway Threshold PAKE provably secure against this password guessing attack by also taking the corruption of authentication servers into consideration.