KEM Combiners

Giacon, Federico; Heuer, Felix; Poettering, Bertram

doi:10.1007/978-3-319-76578-5_7

Cited by 36 publications

(33 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This concatenated key is given as input to HKDF to generate shared session keys which can be used by symmetric-key algorithm for encryption and decryption. Only one HKDF operation is required [Giacon F., et al (2018)] [Bindel N., et al (2019)].…”

Section: Concat_then_kdfmentioning

confidence: 99%

New Approach to Combine Secret Keys for Post-Quantum (Pq) Transition

Meher¹,

Midhunchakkaravarthy²

2021

INDJCSE

View full text Add to dashboard Cite

Many companies are working to build a powerful quantum computer. Once quantum computer with large qubits is reality, asymmetric-key cryptosystem will be vulnerable for Shor's algorithm. The transition from one cryptosystem to another is very slow process and consumes many years. National Institute of Standards and Technology (NIST) is working on standardization of post-quantum cryptographic (PQC) algorithms. Security of current PQC algorithms cannot be fully verified today. So, in coming years we need to rely on both traditional algorithms and PQC algorithms. Hybrid mode consisting of one traditional algorithm and one post quantum algorithm is a best solution for smooth migration to quantum-safe cryptosystem. For key exchange, it means using two or more key exchange encapsulation algorithms for generating session key ]. For authentication, it means using two or more digital signature algorithms ]. There are number of approaches to combine secret key from traditional algorithm and PQC algorithm to make key encapsulation mechanism quantum-proof. In the paper we propose a new approach of using secret master key generated from one of the KEM algorithm as a salt for hashbased key derivation function (HKDF) to drive session keys from secret master key generated from another KEM algorithm.

show abstract

Section: Concat_then_kdfmentioning

confidence: 99%

New Approach to Combine Secret Keys for Post-Quantum (Pq) Transition

Meher¹,

Midhunchakkaravarthy²

2021

INDJCSE

View full text Add to dashboard Cite

show abstract

“…Berndt and Liśkiewicz [29] proved that successful ASAs correspond to secure stegosystems on certain channels and vice versa. Giacon, Heuer, and Poettering [30] proposed key-encapsulation mechanism (KEM) combiners, which can be potentially employed to prevent ASAs. Auerbach, Bellare, and Kiltz [31] studied the security of publickey encryption schemes and KEMs when public parameters they use may be subverted.…”

Section: B Related Workmentioning

confidence: 99%

On the Security of Symmetric Encryption Against Mass Surveillance

Sun

2020

IEEE Access

View full text Add to dashboard Cite

For mass surveillance, the algorithm substitution attacks (ASAs) are serious security threats to the symmetric encryption schemes. At CRYPTO 2014, Bellare, Paterson, and Rogaway (BPR) formally developed the security notions of decryptability, undetectability, and surveillance and presented a unique ciphertext symmetric encryption scheme against all possible ASAs. At FSE 2015, Degabriele, Farshim, and Poettering (DFP) relaxed the correctness of decryptability and presented an input-triggered ASA, which meets the BPR security definitions but violates the security of the BPR unique ciphertext scheme. Hence, DFP refined the security notions of detectability and subversion resistance to remove their ASA from the BPR unique ciphertext scheme. At CCS 2015, Bellare, Jaeger, and Kane (BJK) also developed the security notion of key recovery to make the input-triggered ASA infeasible. We investigate ASAs on the symmetric encryption scheme. Our contribution is twofold. (1) We propose a new trigger ASA against the symmetric encryption scheme. Our proposed ASA cannot be captured by the BJK security definitions. Comparatively, the DFP security definitions can detect our proposed ASA. In the view of ASAs, this result demonstrates that the DFP security definitions are not identical to the BJK security definitions. (2) We improve the DFP definition of subversion resistance. DFP proved that the BPR unique ciphertext scheme defeats the input-triggered ASA under their subversion resistance definition. However, we show that the BPR unique ciphertext scheme fails to meet the DFP subversion resistance definition due to our proposed ASA. Therefore, an improved definition on subversion resistance is proposed to cover all existing trigger ASAs. We prove that the BPR unique ciphertext scheme is secure under our improved definition. Therefore, we believe that our improved definition is more suitable to evaluate the ASA security of the symmetric encryption scheme.

show abstract

“…Combiners for other primitives have since followed, including hybrid digital signatures by Bindel et al [12]. Most relevant to our setting of key exchange and KEMs is the work by Giacon et al [26] which considers various KEM combiners. While this work on KEM combiners is an important first step towards constructing hybrid KEMs, their solutions focus solely on classical adversaries.…”

Section: Introductionmentioning

confidence: 99%

“…While this work on KEM combiners is an important first step towards constructing hybrid KEMs, their solutions focus solely on classical adversaries. Since the advent of quantum computing and thus the introduction of more powerful adversaries is an important motivation for investigating hybrid key exchange, quantum security analyses of hybrid schemes is not to be neglected; in particular because most of the constructions of [26] use idealized assumptions such as random oracles that might not immediately transfer to the quantum setting [13]. Moreover, the (quantum) security of hybrid authenticated key exchange remains unresolved in [26].…”

Section: Introductionmentioning

confidence: 99%

“…Since the advent of quantum computing and thus the introduction of more powerful adversaries is an important motivation for investigating hybrid key exchange, quantum security analyses of hybrid schemes is not to be neglected; in particular because most of the constructions of [26] use idealized assumptions such as random oracles that might not immediately transfer to the quantum setting [13]. Moreover, the (quantum) security of hybrid authenticated key exchange remains unresolved in [26]. An alternative recent approach to model security of protocols in which a component fails is the breakdown-resilience model of Brendel, Fischlin, and Günther [20].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange

Bindel

Brendel

Fischlin

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Concerns about the impact of quantum computers on currently deployed public key cryptography have instigated research into not only quantum-resistant cryptographic primitives but also how to transition applications from classical to quantum-resistant solutions. One approach to mitigate the risk of quantum attacks and to preserve common security guarantees are hybrid schemes, which combine classically secure and quantum-resistant schemes. Various academic and industry experiments and draft standards related to the Transport Layer Security (TLS) protocol already use some form of hybrid key exchange; however sound theoretical approaches to substantiate the design and security of such hybrid key exchange protocols are missing so far.We initiate the modeling of hybrid authenticated key exchange protocols, considering security against adversaries with varying levels of quantum power over time, such as adversaries who may become quantum in the future or are quantum in the present. We reach our goal using a three-step approach: First, we introduce security notions for key encapsulation mechanisms (KEMs) that enable a fine-grained distinction between different quantum scenarios. Second, we propose several combiners for constructing hybrid KEMs that correspond closely to recently proposed Internet-Drafts for hybrid key exchange in TLS 1.3. Finally, we present a provably sound design for hybrid key exchange using KEMs as building blocks.

show abstract

KEM Combiners

Cited by 36 publications

References 21 publications

New Approach to Combine Secret Keys for Post-Quantum (Pq) Transition

New Approach to Combine Secret Keys for Post-Quantum (Pq) Transition

On the Security of Symmetric Encryption Against Mass Surveillance

Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange

Contact Info

Product

Resources

About