Secure Key Establishment (eBook)

Foreword 6
Preface 8
Comments and Errata 9
Acknowledgements 10
Contents 12
List of Protocols 18
List of Attacks 20
List of Figures 21
List of Tables 22
Introduction 23
1.1 The Key Distribution Problem 23
1.2 Solution: Key Establishment Protocols 25
1.2.1 Computer Security Approach 26
1.2.2 Computational Complexity Approach 27
1.2.3 Research Objectives and Deliverables 28
1.3 Structure of Book and Contributions to Knowledge 28
References 32
Background Materials 41
2.1 Mathematical Background 41
2.1.1 Abstract Algebra and the Main Groups 41
2.1.2 Bilinear Maps from Elliptic Curve Pairings 42
2.1.3 Computational Problems and Assumptions 43
2.1.4 Cryptographic Tools 45
2.2 Key Establishment Protocols and their Basis 51
2.2.1 Protocol Architectures 52
2.2.2 Protocol Goals and Attacks 55
2.3 The Computational Complexity Approach 60
2.3.1 Adversarial Powers 61
2.3.2 Definition of Freshness 63
2.3.3 Definition of Security 63
2.3.4 The BellareÒRogaway Models 64
2.3.5 The CanettiÒKrawczyk Model 68
2.3.6 Protocol Security 70
2.4 Summary 71
References 71
A Flawed BR95 Partnership Function 78
3.1 A Flaw in the Security Proof for 3PKD Protocol 79
3.1.1 The 3PKD Protocol 79
3.1.2 Key Replicating Attack on 3PKD Protocol 80
3.1.3 The Partner Function used in the BR95 Proof 81
3.2 A Revised 3PKD Protocol in Bellare–Rogaway Model 83
3.2.1 Defining SIDs in the 3PKD Protocol 83
3.2.2 An Improved Provably Secure 3PKD Protocol 83
3.2.3 Security Proof for the Improved 3PKD Protocol 84
3.3 Summary 91
References 91
On The Key Sharing Requirement 92
4.1 Bellare–Rogaway 3PKD Protocol in CK2001 Model 93
4.1.1 The 3PKD Protocol 93
4.1.2 New Attack on 3PKD Protocol 94
4.1.3 A New Provably-Secure 3PKD Protocol in CK2001 Model 95
4.2 Jeong–Katz–Lee ProtocolT S2 97
4.2.1 ProtocolT S2 97
4.2.2 New Attack on ProtocolT S2 98
4.2.3 An Improved ProtocolT S2 98
4.3 The Key Sharing Requirement 99
4.4 Summary 101
References 101
Comparison of Bellare–Rogaway and Canetti – Krawczyk Models 104
5.1 Relating The Notions of Security 107
5.1.1 Proving BR93 (EA+KE) . BPR2000 ( EA+ KE) 109
5.1.2 Proving CK2001 . BPR2000 ( KE) 111
5.1.3 Proving CK2001 . BR93 ( KE) 112
5.1.4 BR93 (KE) . BR95 and BR93 ( KE), CK2001 BR95 113
5.1.5 BR93 (KE) / CK2001 BPR2000 (KE) 114
5.1.6 CK2001 BR93 (EA+KE) 114
5.1.7 BR93 (KE) CK2001 115
5.1.8 BPR2000 (KE) BR95 117
5.2 A Drawback in the BPR2000 Model 117
5.2.1 Case Study: AbdallaÒPointcheval 3PAKE 117
5.2.2 Unknown Key Share Attack on 3PAKE 118
5.3 Summary 120
References 120
An Extension to the Bellare–Rogaway Model 122
6.1 A Provably-Secure Revised Protocol of Boyd 123
6.1.1 Secure Authenticated Encryption Schemes 123
6.1.2 Revised Protocol of Boyd 124
6.1.3 Security Proof 125
6.2 An Extension to the BR93 Model 129
6.3 An Efficient Protocol in Extended Model 131
6.3.1 An Efficient Protocol 131
6.3.2 Security Proof 132
6.4 Comparative Security and Efficiency 135
6.5 Summary 136
References 137
A Proof of Revised Yahalom Protocol 138
7.1 The Yahalom Protocol and its Simplified Version 139
7.2 A New Provably-Secure Protocol 140
7.2.1 Proof for Protocol 7.2 141
7.2.2 An Extension to Protocol 7.2 144
7.3 Partnering Mechanism: A Brief Discussion 145
7.4 Summary 147
References 148
Errors in Computational Complexity Proofs for Protocols 150
8.1 Boyd–Gonz ´ alez Nieto Protocol 151
8.1.1 Unknown Key Share Attack on Protocol 152
8.1.2 An Improved Conference Key Agreement Protocol 153
8.1.3 Limitations of Existing Proof 154
8.2 Jakobsson–Pointcheval MAKEP 155
8.2.1 Unknown Key Share Attack on JP-MAKEP 156
8.2.2 Flaws in Existing Security Proof for JP-MAKEP 156
8.3 Wong–Chan MAKEP 157
8.3.1 A New Attack on WC-MAKEP 157
8.3.2 Preventing the Attack 158
8.3.3 Flaws in Existing Security Proof for WC-MAKEP 158
8.4 An MT-Authenticator 159
8.4.1 Encryption-Based MT-Authenticator 159
8.4.2 Flaw in Existing Security Proof Revealed 160
8.4.3 Addressing the Flaw 161
8.4.4 An Example Protocol as a Case Study 161
8.5 Summary 163
References 164
On Session Key Construction 167
9.1 Chen–Kudla ID-Based Protocol 168
9.1.1 The ID-Based Protocol 169
9.1.2 Existing Arguments on Restriction of Reveal Query 169
9.1.3 Improved ChenÒKudla Protocol 170
9.1.4 Security Proof for Improved ChenÒKudla Protocol 171
9.2 McCullagh–Barreto 2P-IDAKA Protocol 173
9.2.1 The 2P-IDAKA Protocol 173
9.2.2 Why Reveal Query is Restricted 173
9.2.3 Errors in Existing Proof for 2P-IDAKA Protocol 174
9.2.4 Improved 2P-IDAKA Protocol 176
9.3 A Proposal for Session Key Construction 177
9.4 Another Case Study 178
9.4.1 Reflection Attack on LeeÒKimÒYoo Protocol 179
9.4.2 Preventing the Attack 180
9.5 Summary 180
References 181
Complementing Computational Protocol Analysis 183
10.1 The Formal Framework 184
10.2 Analysing a Provably-Secure Protocol 185
10.2.1 Protocol Specification 186
10.2.2 Protocol Analysis 188
10.3 Analysing Another Two Protocols With Claimed Proofs of Security 192
10.3.1 Protocol Analysis 193
10.3.2 Flaws in Refuted Proofs 197
10.3.3 A Possible Fix 197
10.4 Analysing Protocols with Heuristic Security Arguments 198
10.4.1 Case Studies 198
10.4.2 Protocol Analyses 201
10.5 Summary 208
References 208
An Integrative Framework to Protocol Analysis and Repair 211
11.1 Case Study Protocol 213
11.2 Proposed Integrative Framework 214
11.2.1 Protocols Specification 214
11.2.2 Protocols Analysis 217
11.2.3 Protocol Repair 219
11.3 Summary 221
References 222
Conclusion and Future Work 224
12.1 Research Summary 224
12.2 Open Problems and Future Directions 225
References 227
Index 229