1 Authenticated key agreement without using one-way hash functions Harn, L.; Lin, H.-Y. Electronics Letters, Volume: 37 Issue: 10, 10 May 2001 Presented by Bin-Cheng Tzeng 2002/10/01

2 Outlines  Introduction  Digital signature schemes for Diffie- Hellman public keys  Key agreement protocols  Possible attacks  Proposed protocol  Conclusions

3 Introduction  Diffie and Hellman proposed in 1976 the public-key distribution scheme  The scheme requires an authentication channel to exchange the public keys  Use digital signatures of the exchanged public keys to provide authentication

4 Introduction  The security assumption for most signature schemes are based on some well-known computational problems  The security of a one-way hash function is based on the complexity of analysing a simple iterated function  It would be more secure to have a key distribution without using one-way hash functions

5 Introduction  The MQV key agreement protocol proposed in 1995  In 1998, authors published a key agreement protocol  Some attacks on this key agreement protocol were found  The attacks can easily be avoided by modifying the signature signing equation

6 Digital signature schemes for Diffie-Hellman public keys  r =  k mod p  k and r : short-term private key and short- term public key  x : long-term private key  y =  x mod p : long-term public key

7 Key agreement protocols  A sends {r A, s A, cert(y A )} to B  B sends {r B, s B, cert(y B )} to A  A verifies r B and computes the shared secret key  B verifies r A and computes the shared secret key

8 Possible attack  Does not offer perfect forward secrecy  Assume that the protocol uses x = rk + s  is the long-term shared secret key

9 Proposed protocol  Enables A and B to share multiple secret keys in one round of message exchange  To share four secrets : A generates two random short-term secret keys, k A1 and k A2,public keys r A1, r A2 signature s A for {r A1, r A2 } for example :

10 Proposed protocol(cont.)  A sends {r A1, r A2, s A, cert(y A )} to B  B does the same things  A verifies {r B1, r B2 }  A computes the shared secret keys as

11 Proposed protocol(cont.)  B verifies {r A1, r A2 } and computes the shared secret keys as

12 Discussion  Have modified the original protocol in signature signing and verification equations  The attacks on the original protocol cannot work successfully in this modified protocol  This modified protocol does not increase any computational load and does not involve any additional one-way hash function

13 Discussion(cont.)  Multiplying these two equations together

14 Discussion(cont.)  If the adversary knows four consecutive shared secret keys, he can solve the long-term shared secret K AB  To achieve the perfect forward secrecy, limit ourselves to use only three out of the four shared secret keys  The protocol can be generalised to enable A and B to share n 2 -1 secrets if each user sends n Diffie- Hellman public keys in each pass

15 Conclusions  The security assumption relies solely on solving the discrete logarithm problem  This protocol allows two parties to share multiple secret keys in two-pass interaction  The computation for shared secret keys is simpler than the MQV protocol