Computationally sound analysis of protocols using bilinear pairings

Abstract

In this paper, we introduce a symbolic model to analyse protocols that use a bilinear pairing between two cyclic groups. This model consists in an extension of the Abadi-Rogaway logic and we prove that the logic is still computationally sound: symbolic indistinguishability implies computational indistinguishability provided that the Bilinear Decisional DiffieHellman assumption holds and that the encryption scheme is IND-CPA secure. We illustrate our results on classical protocols using bilinear pairing like Joux tripartite Diffie-Hellman protocol or the TAK-2 and TAK-3 protocols. We also investigate the security of a newly designed variant of the Burmester-Desmedt protocol using bilinear pairings. More precisely, we show for each of these protocols that the generated key is indistinguishable from a random element.

A Survey of Symbolic Methods in Computational Analysis of Cryptographic Systems

“…In the same vein than [28], Mazaré [76,89] presents an extension the AbadiRogaway logic with a bilinear pairing operation. Their soundness result assumes the hardness of the bilinear decisional Diffie-Hellman problem and an IND-CPA encryption scheme.…”

“…Since the ideal system is secure by construction it follows that no attack is possible against the real system. The desired connection between symbolic and computational models can therefore be obtained by showing a simulatability relation between an idealized, symbolic cryptographic system and a real, cryptographic implementation of such a Table 1 Summary of the results of symbolic methods for computational security proofs Security proof in symbolic models implies proof in computational ones Passive adversary Active adversary Soundness of pattern equivalence Soundness of trace-based properties -Symmetric encryption [8] -Public key encryption [95] -Completeness result [71,93,94] -with signatures [55,72] -Public key encryption [69,70] -with hash functions [53,73] -Symmetric encryption with composed -Non-malleable commitment [62] keys [84] -Zero-knowledge proofs [46] -Handling key cycles [1,79] Soundness of indistinguishability-based properties -Key dependent message [20] -Nonce indistinguishability for public key -Information-theoretic security [2] encryption and signatures [55] -Hash functions [67] and -Nonce indistinguishability for public key completeness [68] encryption and hash [53,72] -Modular exponentiation [28] and -Soundness of observational equivalence bilinear pairings [76,89] for symmetric encryption [54] -Offline guessing attacks [3] A universally composable cryptographic library -Cryptographically controlled access -Public key encryption and signatures [40] to XML [11,12] -M A C s [ 41] -Adaptive adversary [75] -Symmetric encryption [34] Soundness of static equivalence -Nonce indistinguishabil...…”

Automated Verification of Group Key Agreement Protocols

“…Kremer and Mazaré propose in [29] a manual symbolic analysis method for secrecy with respect to a passive adversary that is computationally sound. They extend Bellare-Rogaway's soundness results to bilinear pairing.…”

Decidability for Lightweight Diffie-Hellman Protocols

“…Meadows and Pavlovic adopt an axiomatic approach, which leads to a flexible and suggestive method, but does not elucidate the message structures [38]. Many papers also use linear algebra as we do, such as Pereira and Quisquater's generic insecurity for AGDH [39] and Kremer and Mazaré on protocols using bilinear pairings [27].…”