ASICS: Authenticated Key Exchange Security Incorporating Certification Systems

Abstract

Most security models for authenticated key exchange (AKE) do not explicitly model the associated certification system, which includes the certification authority (CA) and its behaviour. However, there are several well-known and realistic attacks on AKE protocols which exploit various forms of malicious key registration and which therefore lie outside the scope of these models. We provide the first systematic analysis of AKE security incorporating certification systems (ASICS). We define a family of security models that, in addition to allowing different sets of standard AKE adversary queries, also permit the adversary to register arbitrary bitstrings as keys. For this model family we prove generic results that enable the design and verification of protocols that achieve security even if some keys have been produced maliciously. Our approach is applicable to a wide range of models and protocols; as a concrete illustration of its power, we apply it to the CMQV protocol in the natural strengthening of the eCK model to the ASICS setting.

Deniable Key Establishment Resistance against eKCI Attacks

“…Note that this proposition also is not secure to aKCI attacks. In [40] the authors analyzed security model with the adversary registering arbitrary bit strings as keys. They showed generic results for protocols that achieve security even if some keys have been produced maliciously in this way.…”

Automation and Modularity of Cryptographic Proofs in the Computational Model

“…For key exchange protocols, this approach was pioneered by Bellare, Canetti, and Krawczyk [26] and other transformations have been proposed by Kudla and Paterson [73], Cremers and Feltz [53], and Boyd et al [40]. This kind of result constitutes a natural target for machine-checked proofs, since the cost overhead of building such proof is justified by its multiple applications.…”

“…If a protocol Π is secure with respect to an adversary model M, then Π can be transformed into a (more complicated) protocol Π that is secure with respect to a stronger adversary model M . For key exchange, this approach was pioneered by Bellare, Canetti, and Krawczyk [26] and other transformations have been proposed by Kudla and Paterson [73], Cremers and Feltz [53], and Boyd et al [40]. However, existing transformations have several drawbacks, in particular: the transformation in [26] cannot be applied to many protocols of interest; the transformations in [53,40] assume that the initial protocol is already secure in the eCK model; and the transformation in [73] only supports proofs under Gap assumptions, predates the eCK model and is only applicable to weaker security models.…”

“…We slightly deviate from the original definition by removing the identities fromh's input (like in MQV) and includingÂ,B, X and Y as input to the key derivation hash. Including additional session data in the hash is considered a prudent engineering principle [40] because it ensures agreement on this data. Second, it allows us to apply our generic proof directly since the resulting protocol satisfies P3.…”