Anonymity and one-way authentication in key exchange protocols

Abstract

Key establishment is a crucial cryptographic primitive for building secure communication channels between two parties in a network. It has been studied extensively in theory and widely deployed in practice. In the research literature a typical protocol in the public-key setting aims for key secrecy and mutual authentication. However, there are many important practical scenarios where mutual authentication is undesirable, such as in anonymity networks like Tor, or is difficult to achieve due to insufficient public-key infrastructure at the user level, as is the case on the Internet today. In this work we are concerned with the scenario where two parties establish a private shared session key, but only one party authenticates to the other; in fact, the unauthenticated party may wish to have strong anonymity guarantees. We present a desirable set of security, authentication, and anonymity goals for this setting and develop a model which captures these properties. Our approach allows for clients to choose among different levels of authentication. We also describe an attack on a previous protocol of Øverlier and Syverson, and present a new, efficient key exchange protocol that provides one-way authentication and anonymity.

ASICS: authenticated key exchange security incorporating certification systems

“…3. An additional query is added specifically to set up a user with a new key chosen by the adversary [16,25,46]. This query is typically called establishparty and takes as input the user name and its long-term public key.…”

Challenges in Protecting Tor Hidden Services from Botnet Abuse

“…In response to this, the Tor Project released a modified version (0.2.4.17-rc) that prioritizes processing of onionskins using the more efficient ntor [8] key exchange protocol. Adoption of this release has helped the situation: as Figure 1 shows, measured download 50 KiB times as of late September decreased to roughly 2.0 seconds.…”

CellFlood: Attacking Tor Onion Routers on the Cheap

“…Starting with v0.2.4.8-alpha (released in January 2013), Tor supports a new circuit extension handshake protocol, ntor, designed by Goldberg et al [10]. ntor improves upon the original protocol we described in Sect.…”