Strongly-Resilient and Non-interactive Hierarchical Key-Agreement in MANETs

Abstract

Key agreement is a fundamental security functionality by which pairs of nodes agree on shared keys to be used for protecting their pairwise communications. In this work we study key-agreement schemes that are well-suited for the mobile network environment. Specifically, we describe schemes with the following characteristics:• Non-interactive: any two nodes can compute a unique shared secret key without interaction;• Identity-based: to compute the shared secret key, each node only needs its own secret key and the identity of its peer;• Hierarchical: the scheme is decentralized through a hierarchy where intermediate nodes in the hierarchy can derive the secret keys for each of its children without any limitations or prior knowledge on the number of such children or their identities;• Resilient: the scheme is fully resilient against compromise of any number of leaves in the hierarchy, and of a threshold number of nodes in each of the upper levels of the hierarchy.Several schemes in the literature have three of these four properties, but the schemes in this work are the first to possess all four. This makes them well-suited for environments such as MANETs and tactical networks which are very dynamic, have significant bandwidth and energy constraints, and where many nodes are vulnerable to compromise. We provide rigorous analysis of the proposed schemes and discuss implementations aspects. *

Programmable Hash Functions in the Multilinear Setting

“…Moreover, their schemes do not scale well to large numbers of levels. The same criticisms apply to earlier schemes [2,21] on which the scheme of Gennaro et al [14] is based. Indeed, one of the open problems left in [14] is to construct a H-ID-NIKE scheme with security against not only compromise of any number of leaves, but also against any number of nodes at higher levels of the hierarchy.…”

“…The same criticisms apply to earlier schemes [2,21] on which the scheme of Gennaro et al [14] is based. Indeed, one of the open problems left in [14] is to construct a H-ID-NIKE scheme with security against not only compromise of any number of leaves, but also against any number of nodes at higher levels of the hierarchy. 5 By substituting the random oracles in the SOK scheme [23] with our new PHFs, we obtain the first secure ID-NIKE schemes in the standard model.…”

“…For one thing, it implies secure IBE under a minor technical requirement [20]. More importantly, it has important applications in managing keys and enabling secure communications in mobile ad hoc and sensor networks, where the energy cost of communication is at a premium [14,9]. In the hierarchical setting, H-ID-NIKE allows the same functionality, but also allows the TA's operations to be distributed over a hierarchy, which is well-suited to military and emergency response scenarios.…”

“…The advantages of ID-NIKE, in terms of reducing communication costs and latency in a realistic adversarial environment, are demonstrated in [9]. For further discussion of applications of NIKE and ID-NIKE, see [14,12].…”

“…In the hierarchical setting, Gennaro et al [14] constructed H-ID-NIKE schemes that are secure under certain classes of key exposure, but which do not offer full security, the desirable and natural generalisation of the existing ID-NIKE security notion from [20] to the hierarchical setting. Moreover, their schemes do not scale well to large numbers of levels.…”