Security Analysis of the PACE Key-Agreement Protocol

Bender, Jens; Fischlin, Marc; Kügler, Dennis

doi:10.1007/978-3-642-04474-8_3

Cited by 57 publications

(42 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The Diffie-Hellman key is subsequently used to secure the communication. In [BFK09] it has been shown that the PACE protocol achieves the widely accepted security notion of password-based authenticated key agreement of Bellare-Pointcheval-Rogaway [BPR00], in its strong form of Abdalla et al [AFP05]. This holds under a variant of the Diffie-Hellman assumption, assuming secure cryptographic building blocks, and idealizing the underlying block cipher and the hash function.…”

Section: Introductionmentioning

confidence: 89%

“…Basically, this assumption says that H acts like a random function to which all parties have access. We do not make any explicit assumption about the cipher C here, but note that the security proof for PACE in [BFK09] (to which we reduce AKE security to) relies on an ideal cipher.…”

Section: Security Assumptionsmentioning

confidence: 99%

“…As noted in [BFK09] using the derived keys already in the key agreement step does not allow for a proof in the Bellare-Pointcheval-Rogaway model. We hence also use the variant that the keys K SC and K MAC are independent from the keys output as the result of the key agreement.…”

Section: Security Analysis Of Pace|aamentioning

confidence: 99%

“…The most common instantiations are based on another Diffie-Hellman step (used within the German identity card), or on hashing into elliptic curves as proposed by Icart [Ica09] and Brier et al [BCI + 10]. The security proof for PACE [BFK09] holds for general Map2Point protocols satisfying some basic security properties.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

The PACE|AA Protocol for Machine Readable Travel Documents, and Its Security

Bender

Dagdelen

Fischlin

et al. 2012

Financial Cryptography and Data Security

Self Cite

View full text Add to dashboard Cite

Abstract. We discuss an efficient combination of the cryptographic protocols adopted by the International Civil Aviation Organization (ICAO) for securing the communication of machine readable travel documents and readers. Roughly, in the original protocol the parties first run the Password-Authenticated Connection Establishment (PACE) protocol to establish a shared key and then the reader (optionally) invokes the Active Authentication (AA) protocol to verify the passport's validity. Here we show that by carefully re-using some of the secret data of the PACE protocol for the AA protocol one can save one exponentiation on the passports's side. We call this the PACE|AA protocol. We then formally prove that this more efficient combination not only preserves the desirable security properties of the two individual protocols but also increases privacy by preventing misuse of the challenge in the Active Authentication protocol. We finally discuss a solution which allows deniable authentication in the sense that the interaction cannot be used as a proof towards third parties.

show abstract

Section: Introductionmentioning

confidence: 89%

Section: Security Assumptionsmentioning

confidence: 99%

Section: Security Analysis Of Pace|aamentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

The PACE|AA Protocol for Machine Readable Travel Documents, and Its Security

Bender

Dagdelen

Fischlin

et al. 2012

Financial Cryptography and Data Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…A combination of EKE and SPEKE is used in PACE as described in [BFK09], which is, e.g., used in international travel documents. In this method, a nonce is encrypted rather than a key.…”

Section: Transmission Of Public Keysmentioning

confidence: 99%

Requirements for Password-Authenticated Key Agreement (PAKE) Schemes

Schmidt¹

2017

View full text Add to dashboard Cite

ePassport and eID Technologies

Hanzlik

Kutyłowski

2021

Security of Ubiquitous Computing Systems

View full text Add to dashboard Cite

This chapter is devoted to the design and implementation of electronic ID (eID) such as ePassports and electronic personal identity documents. We present an overview of existing and emerging concepts, both concerning threats and possible countermeasures. Thereby we aim to shed light on the development of ubiquitous systems, where many artifacts will require strong electronic identification with similar properties to those in the case of eIDs issued for humans.

show abstract

Security Analysis of the PACE Key-Agreement Protocol

Cited by 57 publications

References 8 publications

The PACE|AA Protocol for Machine Readable Travel Documents, and Its Security

The PACE|AA Protocol for Machine Readable Travel Documents, and Its Security

Requirements for Password-Authenticated Key Agreement (PAKE) Schemes

ePassport and eID Technologies

Contact Info

Product

Resources

About