Strongly Secure Authenticated Key Exchange without NAXOS’ Approach

Abstract

Abstract. LaMacchia, Lauter and Mityagin [15] proposed the extended Canetti-Krawczyk (eCK) model and an AKE protocol, called NAXOS. Unlike previous security models, the adversary in the eCK model is allowed to obtain ephemeral secret information related to the test session, which makes the security proof difficult. To overcome this NAXOS combines an ephemeral private key x with a static private key a to generate an ephemeral public key X; more precisely X = g H(x,a) . As a result, no one is able to query the discrete logarithm of X without knowing both the ephemeral and static private keys. In other words, the discrete logarithm of an ephemeral public key, which is typically the ephemeral secret, is hidden via an additional random oracle. In this paper, we show that it is possible to construct eCK-secure protocol without the NAXOS' approach by proposing two eCK-secure protocols. One is secure under the GDH assumption and the other under the CDH assumption; their efficiency and security assurances are comparable to the well-known HMQV [12] protocol. Furthermore, they are at least as secure as protocols that use the NAXOS' approach but unlike them and HMQV, the use of the random oracle is minimized and restricted to the key derivation function.

A New Security Model for Authenticated Key Agreement

“…6, 12] (shown eCK-secure) fail in authentication when leakages one the intermediate results are considered. Indeed an attacker, which learns the ephemeral secret exponents s 1 = x + a 1 and s 2 = x + a 2 in a session at (see the steps 2 and 3 of the protocols 1 and 2 [12]), can indefinitely impersonate to any party. Notice that the attacker cannot computeÂ's static key from s 1 and s 2 , while it is not difficult to see that leakages on s 1 (or s 2 ) and the ephemeral key, in the same session implyÂ's static key disclosure.…”

Strongly Secure One Round Authenticated Key Exchange Protocol with Perfect Forward Security

“…While there have already been some two-pass AKE protocols [9,15,6,11,7] provably secure in the eCK model, none of them achieve perfect forward security against active adversary. Although it is possible to transform a two-pass AKE protocol provably secure in eCK model into a three-pass AKE protocol with perfect forward security against active adversary by adding two messages [2,8], the resulting protocol have a higher round-complexity.…”

“…On the other hand, constructing the authenticated key exchange protocol secure in eCK model without NAXOS transformation has its advantages. For example, it can reduce the risk of leakage of the static private key and use of the random oracle [7].…”

Deniable Key Establishment Resistance against eKCI Attacks

“…Many general AKE schemes have been proposed so far; see, for example, MQV [3], HMQV [4], SIGMA [5], KEA+ [6], NAXOS [7], CMQV [8], SMQV [9], E-NAXOS [10], Huang [11], or Kim et al [12] with numerous additional modifications. Their security has been analyzed in many models, for example, CK [13], eCK [7], and seCK [9], under various attack scenarios.…”