Validation of Elliptic Curve Public Keys

Antipa, Adrian; Brown, Daniel R. L.; Menezes, Alfred; Struik, René; Vanstone, Scott A.

doi:10.1007/3-540-36288-6_16

Cited by 75 publications

(64 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Parties must also ensure that the Diffie-Hellman contributions they receive are in the expected group and are not the identity element. Otherwise, the implementation may be vulnerable to identity-element [40], small-subgroup [69], or invalid-curve [6] attacks.…”

Section: Secure Messaging Integrationmentioning

confidence: 99%

See 1 more Smart Citation

Improved Strongly Deniable Authenticated Key Exchanges for Secure Messaging

Unger

Goldberg

2018

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

A deniable authenticated key exchange (DAKE) protocol establishes a secure channel without producing cryptographic evidence of communication. A DAKE offers strong deniability if transcripts provide no evidence even if long-term key material is compromised (offline deniability) and no outsider can obtain evidence even when interactively colluding with an insider (online deniability). Unfortunately, existing strongly deniable DAKEs have not been adopted by secure messaging tools due to security and deployability weaknesses. In this work, we propose three new strongly deniable key exchange protocols-DAKEZ, ZDH, and XZDHthat are designed to be used in modern secure messaging applications while eliminating the weaknesses of previous approaches. DAKEZ offers strong deniability in synchronous network environments, while ZDH and XZDH can be used to construct asynchronous secure messaging systems with offline and partial online deniability. DAKEZ and XZDH provide forward secrecy against active adversaries, and all three protocols can provide forward secrecy against future quantum adversaries while remaining classically secure if attacks against quantumresistant cryptosystems are found. We seek to reduce barriers to adoption by describing our protocols from a practitioner's perspective, including complete algebraic specifications, cryptographic primitive recommendations, and prototype implementations. We evaluate concrete instantiations of our DAKEs and show that they are the most efficient strongly deniable schemes; with all of our classical security guarantees, our exchanges require only 1 ms of CPU time on a typical desktop computer and at most 464 bytes of data transmission. Our constructions are nearly as efficient as key exchanges with weaker deniability, such as the ones used by the popular OTR and Signal protocols.

show abstract

Section: Secure Messaging Integrationmentioning

confidence: 99%

“…Due to its relative novelty, attacks against SIDH are still being discovered [52]. 6 In Section 10, we evaluate the performance of SIDH and New Hope in relation to the core DAKEs. Developers should consider all of these factors when selecting a quantum-resistant KEM.…”

Section: Incorporating Quantum Resistancementioning

confidence: 99%

Improved Strongly Deniable Authenticated Key Exchanges for Secure Messaging

Unger

Goldberg

2018

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…When comparing computational efficiency, we do not take into account publickey validation, which is a necessary procedure to prevent potential leakage of private information similar to invalid-curve attacks [1] and small subgroup attacks [14]; see also [19,21]. Okamoto's protocol is secure in the standard model, but the proof depends on a rather strong assumption of the existence of πPRF family.…”

Section: Comparisonmentioning

confidence: 99%

Strongly Secure Authenticated Key Exchange without NAXOS’ Approach

Kim

Fujioka

Ustaoğlu

2009

Advances in Information and Computer Security

View full text Add to dashboard Cite

Abstract. LaMacchia, Lauter and Mityagin [15] proposed the extended Canetti-Krawczyk (eCK) model and an AKE protocol, called NAXOS. Unlike previous security models, the adversary in the eCK model is allowed to obtain ephemeral secret information related to the test session, which makes the security proof difficult. To overcome this NAXOS combines an ephemeral private key x with a static private key a to generate an ephemeral public key X; more precisely X = g H(x,a) . As a result, no one is able to query the discrete logarithm of X without knowing both the ephemeral and static private keys. In other words, the discrete logarithm of an ephemeral public key, which is typically the ephemeral secret, is hidden via an additional random oracle. In this paper, we show that it is possible to construct eCK-secure protocol without the NAXOS' approach by proposing two eCK-secure protocols. One is secure under the GDH assumption and the other under the CDH assumption; their efficiency and security assurances are comparable to the well-known HMQV [12] protocol. Furthermore, they are at least as secure as protocols that use the NAXOS' approach but unlike them and HMQV, the use of the random oracle is minimized and restricted to the key derivation function.

show abstract

“…Now to determine T , the adversary computes h(z) = g(u 3 ), where g(U ) is associated with E : V 2 = U 3 + αU + β , and where u 3 and β are defined in (4) and (5). It can be seen that h(z) = h 1 (z)/h 2 (z), where h 1 , h 2 ∈ F p [z] and deg(h 1 ) = 288.…”

Section: Theorem 1 Consider the Division Polynomialsmentioning

confidence: 99%

“…Lim and Lee [18] demonstrated the importance of public-key validation by presenting small-subgroup attacks on some discrete logarithm key agreement protocols that are effective if the receiver of a group element does not verify that the element belongs to the desired group of high order (e.g., a prime-order DSA-type subgroup of F * p ). In [5,3], invalid-curve attacks were designed that are effective on elliptic curve protocols if the receiver of a point does not verify that the point indeed lies on the chosen elliptic curve. Kunz-Jacques et al [15] showed that the zero-knowledge proof proposed in [4] for proving possession of discrete logarithms in groups of unknown order can be broken if a dishonest verifier selects invalid parameters during its interaction with the prover.…”

Section: Introductionmentioning

confidence: 99%

On the Importance of Public-Key Validation in the MQV and HMQV Key Agreement Protocols

Menezes

Ustaoğlu

2006

Progress in Cryptology - INDOCRYPT 2006

Self Cite

View full text Add to dashboard Cite

Abstract. HMQV is a hashed variant of the MQV key agreement protocol proposed by Krawczyk at CRYPTO 2005. In this paper, we present some attacks on HMQV and MQV that are successful if public keys are not properly validated. In particular, we present an attack on the twopass HMQV protocol that does not require knowledge of the victim's ephemeral private keys. The attacks illustrate the importance of performing some form of public-key validation in Diffie-Hellman key agreement protocols, and furthermore highlight the dangers of relying on security proofs for discrete-logarithm protocols where a concrete representation for the underlying group is not specified.

show abstract

Validation of Elliptic Curve Public Keys

Cited by 75 publications

References 12 publications

Improved Strongly Deniable Authenticated Key Exchanges for Secure Messaging

Improved Strongly Deniable Authenticated Key Exchanges for Secure Messaging

Strongly Secure Authenticated Key Exchange without NAXOS’ Approach

On the Importance of Public-Key Validation in the MQV and HMQV Key Agreement Protocols

Contact Info

Product

Resources

About