A Secure Identification and Key Agreement Protocol with User Anonymity (SIKA)

A Secure Identification and Key Agreement Protocol with User Anonymity (SIKA) Authors: Kumar Mangipudi and Rajendra Katti Source: Computers & Security, vol. 25, 2006, pp. 420-425Presenter: Jung-wen Lo (駱榮問) Date: 2008/12/12

Outline • Introduction • Yang et al.’s scheme • DoS Attack on Yang et al.’s scheme • SIKA scheme • Conclusions & Comment • Improved SIKA scheme

Introduction • Login Process • User’s private information leaking • Review • WB Lee and CC Chang, “User identification and key distribution maintaining anonymity for distributed computer network”Computer Systems Science and Engineering, 15(4), 2000, pp.113–6 • Impersonation attack • TS Wu and CL Hsu, “Efficient user identification scheme with key distribution preserving anonymity for distributed computer networks,”Computer & Security, 23(2), 2004, pp.120–125 • Server obtains user’s token • Y Yang, S Wang, F Bao, J Wang and RH Deng, “New efficient user identification and key distribution scheme providing enhanced security.”Computer & Security, 23(8), 2004, pp. 697-704 • User anonymity, User identification and Key agreement • Vulnerable to a Denial-of-Service (DoS) attack

Notation • (e,N),d: Public key & private key • SCPC: Smart Card Producing Center • Pi: Secret token (Pi=IDid mod N) • Ek(.),Dk(.): Symmetric-key cryptosystem • H(.): Hash function • IDi: Identity of user Ui or server Si • Kij: Session key • T: Time stamp • k,t: Random numbers

Yang et al.’s scheme Key GenerationPhase SCPC Ui Pi=IDid mod N {(e,N),d} Ui Sj M1(req.) Random kz=gkPj-1 mod N Random ta=zeIDj mod NKij=at mod Nx=get mod Np=gtPiH(x,T) mod N y=EKij(IDi) M2(z) Key AgreementPhase M3(x,y,p,T) Kij=xk mod NID’i=DKij(y)xID’iH(x,T)?=pe mod N a=zeIDj=(gk(IDjd)-1)eIDj=gke pe=(gtPiH(x,T))e = get PieH(x,T)=x (IDid)eH(x,T) =x (IDi)H(x,T)

DoS Attack on Yang et al.’s scheme Key GenerationPhase SCPC Ui Pi=IDid mod N {(e,N),d} Ui Sj M1(req.) Random kz=gkPj-1 mod N M2(z) M2’(z’) Random ta’=z’eIDj mod NK’ij=a’t mod Nx=get mod Np=gtPiH(x,T) mod N y’=EK’ij(IDi) Attacker Key AgreementPhase M3(x,y’,p,T) Kij=xk mod NID’i=DKij(y’)xID’iH(x,T)?=pe mod N

SIKA scheme Key GenerationPhase SCPC Ui Pi=IDid mod N {(e,N),d} Ui Sj {(es,Ns),ds},gs M1(req.) Random kz=gkPj-1 mod Nu=H(z,T,IDs)v=udsw=gsv mode Ns Random tu=H(z,T,IDs) wes mod Ns ?=gsu mod Nsa=zeIDj mod NKij=at mod Nx=get mod Np=gtPiH(x,T) mod N y=EKij(IDi) M2(z,T,w) Key AgreementPhase M3(x,y,p,T) Kij=xk mod NID’i=DKij(y)xID’iH(x,T)?=pe mod N wes =(gsv)es=(gsuds) es=gsu

Conclusions & Comment • Conclusions • Inherited security • Enhanced security • No DoS attack • Comments • Always has DoS attack • Lots M1 makes server busy • Efficiency improvement • Improved SIKA scheme

Improved SIKA scheme Key GenerationPhase SCPC Ui Pi=IDid mod N {(e,N),d} Ui Sj {(es,Ns),ds},gs M1(req.) Random kz=gkPj-1 mod Nw=H(z,T) Random tw’=H(z,T) W’ ?=wa=zeIDj mod NKij=at mod Nx=get mod Np=gtPiH(x,T) mod N y=EKij(IDi ||z) M2(z,T,w) Key AgreementPhase M3(x,y,p,T) Kij=xk mod NID’i ||z=DKij(y)xID’iH(x,T)?=pe mod N

A Secure Identification and Key Agreement Protocol with User Anonymity (SIKA)