On Continuous After-the-Fact Leakage-Resilient Key Exchange

Abstract

Side-channel attacks are severe type of attack against implementation of cryptographic primitives. Leakage-resilient cryptography is a new theoretical approach to formally address the problem of side-channel attacks. Recently, the Continuous After-the-Fact Leakage (CAFL) security model has been introduced for two-party authenticated key exchange (AKE) protocols. In the CAFL model, an adversary can adaptively request arbitrary leakage of long-term secrets even after the test session is activated. It supports continuous leakage even when the adversary learns certain ephemeral secrets or session keys. The amount of leakage is limited per query, but there is no bound on the total leakage. A generic leakage-resilient key exchange protocol π has also been introduced that is formally proved to be secure in the CAFL model. In this paper, we comment on the CAFL model, and show that it does not capture its claimed security. Furthermore, we present an attack and counterproofs for the security of protocol π which invalidates the formal security proofs of protocol π in the CAFL model.

Security Protocols in a Nutshell

“…Computing devices leak information not just through input-output interaction, but through physical characteristics of computation such as power consumption, timing, or electromagnetic radiation. Such information leakage can break many cryptosystems in common use, and are feasible when an adversary has access to the device, as it is often the case for devices such as smartcards, TPM chips, mobile phones and laptops [87]. Side-channel attacks can be divided into passive and active attacks.…”

On Vulnerabilities of the Security Association in the IEEE 802.15.6 Standard

“…Several security properties must be satisfied by AKE and PAKE protocols, and they should obviously withstand well-known attacks. Many protocols have been proposed in the literature, but some of them have been shown to have security problems [5][6][7]. It is desirable for AKE protocols to provide known-key security, forward secrecy, key control, and resilience to well-known attacks such as Key-Compromise Impersonation (KCI) and its variants, unknown key-share (UKS), replay, and Denning-Sacco attacks.…”

Identity‐based encryption resilient to continuous key leakage

“…Thus, to further improve the practicability, a cryptography scheme must keep its original security in the continuous leakage setting. For the past few years, several constructions have captured continuous leakage resilience in their security consideration, such as the continuous leakage‐resilient public‐key encryption (CLR‐PKE) [14–16], the continuous leakage‐resilient authentication key exchange (CLR‐AKE) [17], the continuous leakage‐resilient (CLR) signature [18], the CLR certificate‐based encryption (CLR‐CBE) [10, 11, 19], the CLR certificateless public‐key encryption (CLR‐CL‐PKE) [20] and so on. In the identity‐based setting, CLR identity‐based encryption (CLR‐IBE) schemes with the semantic security were presented in [21–23].…”