Cryptanalysis of an efficient three‐party password‐based key exchange scheme

Three‐party password‐authenticated key exchange (3PAKE) protocols allow entities to negotiate a secret session key with the aid of a trusted server with whom they share a human‐memorable password. Recently, Lou and Huang proposed a simple 3PAKE protocol based on elliptic curve cryptography, which is claimed to be secure and to provide superior efficiency when compared with similar‐purpose solutions. In this paper, however, we show that the solution is vulnerable to key‐compromise impersonation and offline password guessing attacks from system insiders or outsiders, which indicates that the empirical approach used to evaluate the scheme's security is flawed. These results highlight the need of employing provable security approaches when designing and analyzing PAKE schemes. Copyright © 2011 John Wiley & Sons, Ltd.     

Cryptanalysis and enhancements of efficient three‐party password‐based key exchange scheme

In this paper, we first showed that Lou and Huang's three‐party password‐based key exchange protocol is still vulnerable to offline dictionary attacks. Thereafter, we proposed an enhanced protocol that can defeat the attack described and yet is efficient. Finally, we provided the rigorous proof of the security for it. Copyright © 2011 John Wiley & Sons, Ltd.     

Cryptanalysis and improvement of an efficient authenticated key exchange protocol with tight security reduction

The SMEN protocol, proposed by Wu and Ustaoglu in 2009, has been considered to be secure as the authors claimed, and numerous theories are proposed based on this protocol. This paper analyzes the SMEN protocol and finds that this protocol is not resistant to the session corruption attack and the key compromise impersonation attack. Then, we propose an improved protocol with tight security reduction. Our improved protocol not only avoids the above attacks but also embraces the same efficiency as the SMEN protocol in terms of exponentiation. Besides, formal analysis of the improved protocol is presented by using the formal automatic security analysis tool Scyther. Copyright © 2014 John Wiley & Sons, Ltd.     

Cryptanalysis of a simple three‐party password‐based key exchange protocol

In order to secure communications between two clients with a trusted server's help in public network environments, a three‐party authenticated key exchange (3PAKE) protocol is used to provide the transaction confidentiality and the efficiency. In 2009, Huang proposed a simple three‐party password‐based authenticated key exchange (HS‐3PAKE) protocol without any server's public key. By analysis, Huang claimed that the proposed HS‐3PAKE protocol is not only secure against various attacks, but also more efficient than previously proposed 3PAKE protocols. However, this paper demonstrates that HS‐3PAKE protocol is vulnerable to undetectable online password guessing attacks and off‐line password guessing attacks by any other user. Copyright © 2010 John Wiley & Sons, Ltd.     

Cryptanalysis and improvement of a three‐party password‐based authenticated key exchange protocol with user anonymity using extended chaotic maps

Three‐party password‐authenticated key exchange (3PAKE) protocols allow two clients to agree on a secret session key through a server via a public channel. 3PAKE protocols have been designed using different arithmetic aspects including chaotic maps. Recently, Lee et al. proposed a 3PAKE protocol using Chebyshev chaotic maps and claimed that their protocol has low computation and communication cost and can also resist against numerous attacks. However, this paper shows that in spite of the computation and communication efficiency of the Lee et al. protocol, it is not secure against the modification attack. To conquer this security weakness, we propose a simple countermeasure, which maintains the computation and communication efficiency of the Lee et al. protocol. Copyright © 2014 John Wiley & Sons, Ltd.     

An ECC‐based authenticated group key exchange protocol in IBE framework

With the rapid demand for various increasing applications, the internet users require a common secret key to communicate among a group. The traditional key exchange protocols involve a trusted key generation center for generation and distribution of the group key among the various group members. Therefore, the establishment of a trusted key generation center server and the generation (and distribution) of common session key require an extra overhead. To avoid this difficulty, a number of group key exchange protocols have been proposed in the literature. However, these protocols are vulnerable to many attacks and have a high computational and communication cost. In this paper, we present an elliptic curve cryptography–based authenticated group key exchange (ECC‐AGKE) protocol, which provides better security and has lower computational cost compared to related proposed schemes. Further, a complexity reduction method is deployed to reduce the overall complexity of the proposed elliptic curve cryptography–based authenticated group key exchange protocol. The security of proposed work is ensured by the properties of elliptic curves. A security adversarial model is given and an extensive formal security analysis against our claim is done in the random oracle model. We also made a comparison of our proposed protocol with similar works and found that ours have better complexity, security and efficiency over others.     

A pairing‐free certificateless authenticated key agreement protocol

Many certificateless two‐party authenticated key agreement schemes using bilinear pairings have been proposed. But the relative computation cost of the pairing is approximately twenty times higher than that of the scalar multiplication over elliptic curve group In order to improve the performance we propose a certificateless two‐party authenticated key agreement scheme without bilinear pairings in this paper. A security proof under random oracle model is also provided. Copyright © 2011 John Wiley & Sons, Ltd.     

Smart card–based password authenticated key agreement protocol using chaotic maps

In 2015, Lee proposed time stamp–based and nonce‐based password authenticated key agreement protocols based on the Chebyshev chaotic map to enhance the security of relevant schemes. However, in this paper, we demonstrate that Lee's protocols are vulnerable to user impersonation and stolen verifier attacks. To overcome these security problems, we thus provide an improved version using a smart card. Security analysis and comparisons show that the proposed protocol is more secure and maintains better performance. Furthermore, we perform a formal verification of the proposed protocol using the widely accepted AVISPA tool for error detection.     

A novel and efficient lattice‐based authenticated key exchange protocol in C‐K model

Key exchange protocols play an important role in securing the network communication over an insecure channel. In literature, a large number of key exchange schemes exist. The security of most of them is based on the Diffie‐Hellman (DH) problems over a group. But these types of DH problems are solvable in the presence of quantum computers. Thus, we require a non‐DH type key exchange scheme that resists to the quantum computers and new modern technologies. In this paper, 2 novel lattice‐based authenticated key exchange (LB‐AKE) protocols, (1) using a signature‐based authenticator and (2) using a signcryption‐based authenticator, are devised in Canetti‐Krawczyk proof model. The security of proposed protocols depends on the hardness of small integer solutions on the lattice. An extensive proof of security to our claim is given. The proposed AKEs characterize faster computation speed and resistance to the modern complex computers.     

An enhanced anonymous identity‐based key agreement protocol for smart grid advanced metering infrastructure

Sprouting populace mass within the urban areas furnishes critical challenges of providing uninterruptible community services to fulfill the primitive needs of inhabitants in smart cities. Smart cities facilitate and uplift the living standards of inhabitants through various smart systems or infrastructures, and smart grid is one of them. Secure transmission is a key requirement in the advanced metering infrastructure (AMI) of most smart grids, and key establishment cryptographic protocols can be used to achieve such a requirement. Designing efficient and secure key establishment protocols for AMI remains challenging. For example, in this paper, we reveal several weaknesses in the identity‐based key establishment protocol of Mohammadali et al (published in IEEE Trans Smart Grid, 2017), which is based on elliptic curves. We then improve their protocol and prove its security in the random oracle model. We also demonstrate that the improved protocol achieves both anonymity and untraceability, before presenting a comparative summary of the security and computational overheads of the proposed protocol and several other existing protocols.     

标准模型下完美前向安全的基于身份认证密钥交换

一轮Diffie-Hellman密钥交换(One-Round Diff ie-Hellman key exchange,OR-DHKE)协议被认为无法实现完美的前向安全性(Perfect Forward Secrecy,PFS)。基于身份的OR-DHKE协议也是如此,现有研究仅实现了弱的完美 前向安全性(wPFS)。基于Cremers等人对密钥交换协议完美前向安全性的研究,文章提出 一种新的具有完美前向安全的基于身份认证密钥交换方案。文章首先提出一种较弱安全性的 基于身份 OR-DHKE协议π₀,然后采用Cremers等人提出的SIG变换方法,将π₀转化为具有完美前 向安全的基于身份认 证密钥交换方案π₁。文章简要分析了CK、CK⁺、eCK和eCK-PFS安全模型的异同,在此 基 础上定义了基于身 份认证密钥交换协议分析的强安全模型ID-eCK-PFS。在ID-eCK-PFS模型下,协议π₀和π₁的安全性被规约为 求解判定性BDH(Decisional Bilinear Diffie-Hellman,DBDH)问题,规约过程未使用随 机预言机,实现了在标准模型下的完美前向安全性和可证明安全性。     

无证书的层次认证密钥协商协议

提出了一种无证书的层次认证密钥协商协议,协议的安全性基于计算性Diffie-Hellman困难假设,并在eCK（extended Canetti–Krawczyk）模型下证明了该协议的安全性。该协议中,根PKG为多层的域PKG验证身份并生成部分私钥,域PKG为用户验证身份并生成部分私钥,私钥则由用户选定的秘密值和部分私钥共同生成。与已有协议相比,协议不含双线性映射配对运算,且具有较高的效率。     

新型组织隐藏的认证密钥交换协议

提出了一个实现组织集合交集认证策略的新型组织隐藏的密钥协商协议,2个匿名用户从属的组织集合存在交集且元素个数至少为一个门限值时可以完成一次成功的秘密认证和密钥协商,同时保证集合交集之外的组织信息机密性。新协议在随机预言机模型下可证安全,并且在计算和通信性能上仍具备一定的优势。     

A simple three‐party password‐based key exchange protocol

In three‐party password‐based key exchange (3PAKE) protocol, a client is allowed to share a human‐memorable password with a trusted server such that two clients can agree on a secret session key for secure connectivity. Recently, many 3PAKE protocols have been developed. However, not all of them can simultaneously achieve security and efficiency. Without any server's public key, this article will propose a simple three‐party password‐based authenticated key exchange scheme. Compared with the existing schemes, the proposed scheme is not only more efficient, but also is secure. Copyright © 2009 John Wiley & Sons, Ltd.     

An efficient pairing‐free identity‐based authenticated group key agreement protocol

An authenticated group key agreement protocol allows participants to agree on a group key that will be subsequently used to provide secure group communication over an insecure network. In this paper, we give a security analysis on a pairing‐free identity‐based authenticated group key agreement because of Islam et al. We show that the protocol of Islam et al. cannot satisfy the minimal security requirements of the key agreement protocols. We propose an efficient pairing‐free identity‐based authenticated group key agreement for imbalanced mobile network. The proposed protocol can be implemented easily for practical application in mobile networks as it is free from bilinear. Under the difficulty of the InvCDH and CDH we demonstrate that the proposed protocol provides perfect forward secrecy, implicit key authentication and the dynamic functionality. As compared with the group key agreement protocols for imbalanced mobile network, the proposed protocol provides stronger security properties and high efficiency. Copyright © 2013 John Wiley & Sons, Ltd.     

A pairing‐free identity‐based handover AKE protocol with anonymity in the heterogeneous wireless networks

Nowadays, seamless roaming service in heterogeneous wireless networks attracts more and more attention. When a mobile user roams into a foreign domain, the process of secure handover authentication and key exchange (AKE) plays an important role to verify the authenticity and establish a secure communication between the user and the access point. Meanwhile, to prevent the user's current location and moving history information from being tracked, privacy preservation should be also considered. However, existing handover AKE schemes have more or less defects in security aspects or efficiency. In this paper, a secure pairing‐free identity‐based handover AKE protocol with privacy preservation is proposed. In our scheme, users' temporary identities will be used to conceal their real identities during the handover process, and the foreign server can verify the legitimacy of the user with the home server's assistance. Besides, to resist ephemeral private key leakage attack, the session key is generated from the static private keys and the ephemeral private keys together. Security analysis shows that our protocol is provably secure in extended Canetti‐Krawczyk (eCK) model under the computational Diffie‐Hellman (CDH) assumption and can capture desirable security properties including key‐compromise impersonation resistance, ephemeral secrets reveal resistance, strong anonymity, etc. Furthermore, the efficiency of our identity‐based protocol is improved by removing pairings, which not only simplifies the complex management of public key infrastructure (PKI) but also reduces the computation overhead of ID‐based cryptosystem with pairings. It is shown that our proposed handover AKE protocol provides better security assurance and higher computational efficiency for roaming authentication in heterogeneous wireless networks.     

MaTRU‐KE revisited: CCA2‐secure key establishment protocol based on MaTRU

Quantum attack–resistant cryptosystems are required for secure communication since there is a big demand to have quantum computers. Lattice‐based cryptography is one of the quantum‐secure families due to its key/ciphertext sizes and performance. NTRU‐based cryptosystems, a member of lattice‐based cryptosystems, have received much more attention. MaTRU, a noncommutative version of NTRU with some matrix properties, is used to obtain a key exchange protocol in 2018. In this paper, we focus on MaTRU‐based key exchange protocols having CCA2 properties. We propose CCA2‐secure versions of MaTRU‐KE and then provide a security analysis of CCA2‐secure key establishment protocols. We also provide a comparison with the previous ones.     

A chaotic map‐based anonymous multi‐server authenticated key agreement protocol using smart card

Authenticated key agreement protocols play an important role for network‐connected servers to authenticate remote users in Internet environment. In recent years, several authenticated key agreement protocols for single‐server environment have been developed based on chaotic maps. In modern societies, people usually have to access multiple websites or enterprise servers to accomplish their daily personal matters or duties on work; therefore, how to increase user's convenience by offering multi‐server authentication protocol becomes a practical research topic. In this study, a novel chaotic map‐based anonymous multi‐server authenticated key agreement protocol using smart card is proposed. In this protocol, a legal user can access multiple servers using only a single secret key obtained from a trusted third party, known as the registration center. Security analysis shows this protocol is secure against well‐known attacks. In addition, protocol efficiency analysis is conducted by comparing the proposed protocol with two recently proposed schemes in terms of computational cost during one authentication session. We have shown that the proposed protocol is twice faster than the one proposed by Khan and He while preserving the same security properties as their protocol has. Copyright © 2014 John Wiley & Sons, Ltd.     

An efficient identity‐based protocol for private matching

An important application of the Internet is that people can find partners satisfying their requirements from the huge number of users. In this paper, we present a cryptographic protocol for private matching, in which a user finds her desired partners without revealing her requirements, and the potential partners do not need to reveal their profiles. An additional advantage of our protocol is that it is identity‐based, which means the involved parties do not need to have a priori knowledge of each other's public keys; as long as they know each other's identities, the protocol can be executed. Copyright © 2010 John Wiley & Sons, Ltd.