Citation Context

...e cases makes a modular approach of this sort compelling, especially when this approach is compared to the largely ad hoc methods which are often used when analyzing group AKE protocols (as in, e.g., =-=[1, 26, 27]-=-). 1.2 Previous Work Group key exchange. A number of works have considered the problem of extending the 2-party Diffie-Hellman protocol [19] to the multi-party setting. Most well-known among these are...

Citation Context

...osed in this paper using a security model, which was proposed by Bellare and Rogaway in [BR95] and used in a number of other papers such as Blake-Wilson et al in [BJM97] and A1-Riyami and Paterson in =-=[AP02]-=-. We now highlight the model as follows. The model includes a set U = { 1 ..... T(k) } of protocol participants and a set V = { 1 ..... T4(k) } of TAs, where k is a security parameter, T(k) is a polyn...

Citation Context

...n [5, 16]. Shim presents two key agreements [18, 17], but both these schemes have been broken by Sun and Hsieh [20]. Another authenticated tripartite key agreement proposed by Al-Riyami and Patterson =-=[1]-=- was broken by Shim [15]. Most identity-based key agreement protocols have the property of key escrow : the trusted authority that issues private keys can recover the agreed session key. This feature ...

Citation Context

...al state of the corrupted principal) is not allowed. In this paper, we consider the BR93 model which allows the adversary access to a Corrupt query because later proofs of security in the BR93 model (=-=Al-Riyami & Paterson 2003-=-, Blake-Wilson et al. 1997, Blake-Wilson & Menezes 1997, Chen & Kudla 2003, MacKenzie & Swaminathan 1999, McCullagh & Barreto 2005, Wong & Chan 2001) allow the Corrupt query. However, we consider the ...

Citation Context

..., the Corrupt query is not allowed. However, such a query is important as it captures the notion of unknown key share attack [25] and insider attack. Hence, later proofs of security in the BR93 model =-=[1, 11, 12, 15, 20, 29, 30, 37]-=- allow such a query. 2.1 Definition of Partnership Partnership is defined using the notion of matching conversations, where a conversation is defined to be the sequence of messages sent and received b...

Citation Context

...urity threat, many one-round authenticated key agreement protocols have been proposed. Basically these protocols can be divided into two broad categories, i.e. certification-based protocols including =-=[1]-=-[19] and identity-based protocols such as [15][16][20][23]. Unfortunately most of them have been broken or shown not to achieve some desirable security attributes by the attacks presented in [8][20][2...

Citation Context

...the BG protocol and suggested an improvement. We show that the improved protocol is not outsider KCI resilient. We also show that the tripartite key agreement protocol TAK-3 of Al-Riyami and Paterson =-=[1]-=- and the GKE protocol of Bresson et al. [7] are not secure against outsider KCI attacks. One way to modify the BG protocol to make it secure against KCI attacks is by applying the compiler of Katz and...

Citation Context

...|| || ||AK= kdf K A B C = ( )|| || ||B kdf K A B C = ( ||C kdf K || || )A B C , where kdf is a key derivation function. 4. Cryptanalysis on Shim’ s protocol 4.1. The insider attack The insider attack =-=[3]-=- in a tripartite key agreementsprotocol means that some one of the entities tries tosimpersonate any other one of the entities. For instance, B is an insider attacker who might try tosimpersonate C (t...