Modeling key compromise impersonation attacks on group key exchange protocols

Abstract

Two-party key exchange (2PKE) protocols have been rigorously analyzed under various models considering different adversarial actions. However, the analysis of group key exchange (GKE) protocols has not been as extensive as that of 2PKE protocols. Particularly, an important security attribute called key compromise impersonation (KCI) resilience has been completely ignored for the case of GKE protocols. Informally, a protocol is said to provide KCI resilience if the compromise of the long-term secret key of a protocol participant A does not allow the adversary to impersonate an honest participant B to A . In this paper, we argue that KCI resilience for GKE protocols is at least as important as it is for 2PKE protocols. Our first contribution is revised definitions of security for GKE protocols considering KCI attacks by both outsider and insider adversaries. We also give a new proof of security for an existing two-round GKE protocol under the revised security definitions assuming random oracles. We then show how to achieve insider KCIR in a generic way using a known compiler in the literature. As one may expect, this additional security assurance comes at the cost of an extra round of communication. Finally, we show that a few existing protocols are not secure against outsider KCI attacks. The attacks on these protocols illustrate the necessity of considering KCI resilience for GKE protocols.

Sufficient Condition for Ephemeral Key-Leakage Resilient Tripartite Key Exchange

“…This model extends strongly-authenticated key exchange model for two-party protocols from [32] to the group setting and it is described using notations and terminology of the state-of-the-art GKE model [19].…”

“…[14,24,15,25,32,37,16], and group KE (GKE), e.g. [10,29,22,12,31,19], reaching out to other flavors such as password-based solutions [8,6,9,3] or flexible combinations of GKE and 2KE [30,1]. The security notion, shared by most KE flavors, takes its roots in [7] and is called authenticated key exchange (AKE) security.…”

“…as to add authentication (without ephemeral key leakage-resilience) to unauthenticated KE protocols [22,13] or to obtain optional insider security [21,11,19] in GKE protocols. Yet another interesting direction is to search for sufficient conditions for achieving a security goal.…”

Flexible Group Key Exchange with On-demand Computation of Subgroup Keys

“…Security of key exchange protocols is usually defined with the requirement of Authenticated Key Exchange (AKE) security; see [3,14,15,26] for the 2KE case and [8,10,18,21,22] for the GKE case. AKE-security models the indistinguishability of the established session group key with respect to an active adversary treated as an external entity from the perspective of the attacked session.…”

“…Besides AKE-security some security models for GKE protocols (e.g. [10,11,18,21]) define optional security against insider attacks.…”