SAS-Based Authenticated Key Agreement

Pasini, Sylvain; Vaudenay, Serge

doi:10.1007/11745853_26

Cited by 53 publications

(72 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is the idea we have briefly seen in Wong-Stajano, and it appears in many other schemes proposed in the literature [2,6,22,23,38,53,56,57]. We will analyse these here.…”

Section: Indirect Bindingmentioning

confidence: 97%

“…For this reason, there have been a number of algorithms proposed to compute short digest [2,14,15,22,23,33,38]. To the best of our knowledge, the only ones that explicitly exploit the short output to improve efficiency as well as being proved to satisfy the above specification are based on the idealised framework invented by the authors [32,33], which are adaptations of several well-studied universal hash constructions of Mansour et al [26], and Krawczyk [20,21].…”

Section: Short Hash and Digest Functionsmentioning

confidence: 99%

“…In contrast, several research authors in [14,15,22,38] make use of universal hash functions presented in [5,19,49] to compute digest functions. These algorithms put an upper bound on the input length, and consequently they have to compress a long message into a fixed number of bits (say 512 or 256 bits) by using a cryptographic hash prior to running the algorithms themselves, which turns out to be neither ideally secure nor cost effective [33].…”

Section: Short Hash and Digest Functionsmentioning

confidence: 99%

“…These algorithms put an upper bound on the input length, and consequently they have to compress a long message into a fixed number of bits (say 512 or 256 bits) by using a cryptographic hash prior to running the algorithms themselves, which turns out to be neither ideally secure nor cost effective [33]. Alternatively, others [2,38] suggest using first or last b bits of a hash of a large message, which is inefficient and does not necessarily have the precise property we need of being an ideal digest.…”

Section: Short Hash and Digest Functionsmentioning

confidence: 99%

See 3 more Smart Citations

Authentication protocols based on low-bandwidth unspoofable channels: A comparative survey

Nguyen

Roscoe

2011

JCS

View full text Add to dashboard Cite

One of the main challenges in pervasive computing is how we can establish secure communication over an untrusted high-bandwidth network without any initial knowledge or a Public Key Infrastructure. An approach studied by a number of researchers is building security though human work creating a low-bandwidth empirical (or authentication) channel where the transmitted information is authentic and cannot be faked or modified. In this paper, we give an analytical survey of authentication protocols of this type. We start with non-interactive authentication schemes, and then move on to analyse a number of strategies used to build interactive pair-wise and group protocols that minimise the human work relative to the amount of security obtained as well as optimising the computation processing. In studying these protocols, we will discover that their security is underlined by the idea of commitment before knowledge, which is refined by two protocol design principles introduced in this survey.

show abstract

“…This is the idea we have briefly seen in Wong-Stajano, and it appears in many other schemes proposed in the literature [2,6,22,23,38,53,56,57]. We will analyse these here.…”

Section: Indirect Bindingmentioning

confidence: 97%

Section: Short Hash and Digest Functionsmentioning

confidence: 99%

Section: Short Hash and Digest Functionsmentioning

confidence: 99%

Section: Short Hash and Digest Functionsmentioning

confidence: 99%

See 2 more Smart Citations

Authentication protocols based on low-bandwidth unspoofable channels: A comparative survey

Nguyen

Roscoe

2011

JCS

View full text Add to dashboard Cite

show abstract

“…Noninteractive protocols have been proposed in Balfanz et al [1]; Pasini and Vaudenay [19]; Mashatan and Stinson [14]; and Reyhanitabar et al [21]. Interactive protocols have been discussed in many papers, including the following: the so-called MANA protocols were introduced in Gehrmann et al [5] and Gehrmann and Nyberg [6]; Hoepman [8]; the SAS protocol proposed by Vaudenay [27]; Pasini and Vaudenay [20]; Laur and Nyberg [11]; Laur and Pasini [12,13]; and Mashatan and Stinson [15]. Group protocols are studied in Nguyen and Roscoe [18].…”

Section: Interactive Versus Noninteractive Protocolsmentioning

confidence: 99%

Practical unconditionally secure two-channel message authentication

Mashatan

Stinson

2010

Des. Codes Cryptogr.

View full text Add to dashboard Cite

We investigate unconditional security for message authentication protocols that are designed using two-channel cryptography. (Two-channel cryptography employs a broadband, insecure wireless channel and an authenticated, narrow-band manual channel at the same time.) We study both noninteractive message authentication protocols (NIMAPs) and interactive message authentication protocols (IMAPs) in this setting.First, we provide a new proof of nonexistence of nontrivial unconditionally secure NIMAPs. This proof consists of a combinatorial counting argument and is much shorter than the previous proof by Wang and Safavi-Naini, which was based on probability distribution arguments. We also prove a new result which holds in a weakened attack model.Further, we propose a generalization of an unconditionally secure 3-round IMAP due to Naor, Segev and Smith. The IMAP is based on two -∆ universal hash families. With a careful choice of parameters, our scheme improves that of Naor et al. Our scheme is very close to optimal for most parameter situations of practical interest. Finally, a variation of the 3-round IMAP is presented, in which only one hash family is required.

show abstract

Flashing displays: user-friendly solution for bootstrapping secure associations between multiple constrained wireless devices

Kovačević

Perković

Čagalj

2015

Security Comm. Networks

View full text Add to dashboard Cite

Future healthcare systems, smart homes, and similar will involve a large number of smart inter-connected wireless devices (such as wireless sensor nodes). One of the major challenges to securing these systems presents loading initial cryptographic credentials into a relatively large number of wireless devices. Furthermore, many of these technologies involve low-cost and highly interface constrained devices (lacking usual wired interfaces, displays, keypads, and alike). We propose two novel multichannel key deployment schemes for wireless networks that only require a presence of a light source device, such as a multi-touch screen (tablet or smartphone device). The first key deployment scheme is based on secret key cryptography and is suitable for interface/resource-constrained wireless devices. The second scheme assumes a strong attacker and requires the use of public key cryptography. In both our solutions, we use one-way visible light channel of multi-touch screens (flashing displays) to initialize devices in a secure, usable, and scalable way. From the user's perspective, this boils down to placing the devices on the multitouch screen after which the remaining process is fully automatized. We showed through the experiments with 48 users that our solution is user-friendly and scales linearly with the number of nodes.

show abstract

SAS-Based Authenticated Key Agreement

Cited by 53 publications

References 17 publications

Authentication protocols based on low-bandwidth unspoofable channels: A comparative survey

Authentication protocols based on low-bandwidth unspoofable channels: A comparative survey

Practical unconditionally secure two-channel message authentication

Flashing displays: user-friendly solution for bootstrapping secure associations between multiple constrained wireless devices

Contact Info

Product

Resources

About