Sufficient Condition for Ephemeral Key-Leakage Resilient Tripartite Key Exchange

Abstract

Abstract. Tripartite (Diffie-Hellman) Key Exchange (3KE), introduced by Joux (ANTS-IV 2000), represents today the only known class of group key exchange protocols, in which computation of unauthenticated session keys requires one round and proceeds with minimal computation and communication overhead. The first one-round authenticated 3KE version that preserved the unique efficiency properties of the original protocol and strengthened its security towards resilience against leakage of ephemeral (session-dependent) secrets was proposed recently by Manulis, Suzuki, and Ustaoglu (ICISC 2009).In this work we explore sufficient conditions for building such protocols. We define a set of admissible polynomials and show how their construction generically implies 3KE protocols with the desired security and efficiency properties. Our result generalizes the previous 3KE protocol and gives rise to many new authenticated constructions, all of which enjoy forward secrecy and resilience to ephemeral key-leakage under the gap Bilinear Diffie-Hellman assumption in the random oracle model.

Strongly Secure One-Round Group Authenticated Key Exchange in the Standard Model

“…the test session and its partner session in the security game), and provision of weak perfect forward secrecy (wPFS) in a single model. So far the g-eCK model is known as one of the strongest security model for one-round GAKE [19]. Therefore proving security for one-round GAKE in the g-eCK model may provide more guarantees.…”

“…This has also pushed forward the development of security model for GAKE. Meanwhile, the most recently proposed one is the g-eCK model by Fujioka et al [19]. The g-eCK model basically can be seen as a generalization from the two party eCK model [30].…”

“…Manulis et al [35] recently pointed out that the one-round 3AKE constructions [2,33,32] fail to achieve implicit key authentication, and introduced an improved protocol (which is called MSU protocol in the following). In 2012, Fujioka et al (FMSU) [19] generalized previous 3AKE protocols into one framework based on admissible polynomials developed from [20] which yields many further one-round 3AKE protocols. Meanwhile the one-round version of MSU protocol [35] can be seen as a concrete instantiation of FMSU protocol.…”

“…Several attempts, e.g. [2,33,32,35,19], have been made to improve the original Joux's protocol. This has also pushed forward the development of security model for GAKE.…”

“…Meanwhile the one-round version of MSU protocol [35] can be seen as a concrete instantiation of FMSU protocol. 1 The generic FMSU protocol [19] was shown to satisfy g-eCK security. However its security proof is given in the random oracle model (ROM) [6] under a specific strong assumption, i.e.…”