Authenticated key agreement without using one-way hash functions

1. Authenticated key agreement without using one-way hash functions Harn, L.; Lin, H.-Y.Electronics Letters , Volume: 37 Issue: 10 , 10 May 2001 Presented by Bin-Cheng Tzeng 2002/10/01

2. Outlines • Introduction • Digital signature schemes for Diffie-Hellman public keys • Key agreement protocols • Possible attacks • Proposed protocol • Conclusions

3. Introduction • Diffie and Hellman proposed in 1976 the public-key distribution scheme • The scheme requires an authentication channel to exchange the public keys • Use digital signatures of the exchanged public keys to provide authentication

4. Introduction • The security assumption for most signature schemes are based on some well-known computational problems • The security of a one-way hash function is based on the complexity of analysing a simple iterated function • It would be more secure to have a key distribution without using one-way hash functions

5. Introduction • The MQV key agreement protocol proposed in 1995 • In 1998, authors published a key agreement protocol • Some attacks on this key agreement protocol were found • The attacks can easily be avoided by modifying the signature signing equation

6. Digital signature schemes for Diffie-Hellman public keys • r = k mod p • k and r : short-term private key and short-term public key • x : long-term private key • y = x mod p : long-term public key

7. Key agreement protocols • A sends {rA, sA, cert(yA)} to B • B sends {rB, sB, cert(yB)} to A • A verifies rB and computes the shared secret key • B verifies rA and computes the shared secret key

8. Possible attack • Does not offer perfect forward secrecy • Assume that the protocol uses x = rk + s • is the long-term shared secret key

9. Proposed protocol • Enables A and B to share multiple secret keys in one round of message exchange • To share four secrets :A generates two random short-term secret keys, kA1 and kA2 ,public keys rA1, rA2signature sA for {rA1, rA2}for example :

10. Proposed protocol(cont.) • A sends {rA1, rA2, sA, cert(yA)} to B • B does the same things • A verifies {rB1, rB2} • A computes the shared secret keys as

11. Proposed protocol(cont.) • B verifies {rA1, rA2} and computes the shared secret keys as

12. Discussion • Have modified the original protocol in signature signing and verification equations • The attacks on the original protocol cannot work successfully in this modified protocol • This modified protocol does not increase any computational load and does not involve any additional one-way hash function

13. Discussion(cont.) • Multiplying these two equations together

14. Discussion(cont.) • If the adversary knows four consecutive shared secret keys, he can solve the long-term shared secret KAB • To achieve the perfect forward secrecy, limit ourselves to use only three out of the four shared secret keys • The protocol can be generalised to enable A and B to share n2-1 secrets if each user sends n Diffie-Hellman public keys in each pass

15. Conclusions • The security assumption relies solely on solving the discrete logarithm problem • This protocol allows two parties to share multiple secret keys in two-pass interaction • The computation for shared secret keys is simpler than the MQV protocol